Questions about access control list wildcards

It's the inverse of its subnet mask!

It depends on the port you want to set for the route.

?I don't understand, your 3 PC gateways are completely different, how to access?

To access your gateway must be in the same gateway as follows:

Host 0: gateway 1

Host 2: Gateway 3

Host 1: Gateway 2

It's just that the roads are different, the roads are different, and they don't interfere with each other at all.

Because the default ACL has a last rule that is deny ip any any (extension) or deny any

Therefore, even if you only ban the CIDR block of the source to, all other traffic will still be blocked due to the default.

ACL is divided into Layer 2 and Layer 3, Layer 2 is MAC-based, Layer 3 is IP-based, and in general, Layer 2 switches do not support Layer 3 ACLs (but there are exceptions, for example, the Cisco 2960S-S series can also do Layer 3 ACLs).

There is a problem with the access list configuration, Cisco defaults to deny, so add one.

access-list 1 permit ip any any

IP-based ACLs can be used on the interfaces of Layer 3 switches

Reason: Below the one you wrote: access-list 1 deny also hides a rejection of all: deny any any any any solution:

Add an explicitly allowed ACL:

access-list 1 deny

access-list 1 permit any any

Because you don't have access-list 1 permit any any, you can't get out, and when you have a list, only the data in the list that clearly indicates whether you can pass it can be passed, and the rest will be dropped by deny.

Question 1: First of all, let's give me the answer! The range of 1 and 2 is the same, and you are not wrong!

Reason: We know that the access control list matching is based on the mask at the back, and we found that the masks of both are 16 bits, which is the first two digits of the exact matching IP, and then we see that the first two digits of the two IPs are, and all the results are the same! This one is the same as it! Because the back is an arbitrary match!

In order to verify the correctness of the above theory! I did the following experiment on a router with iOS 3640! This is enough to show the correctness of the above theory:

router(config)#access-list 1 permit

router(config)#access-list 2 permit

router#sh access-lists

standard ip access list 1

10 permit , wildcard bits

standard ip access list 2

10 permit , wildcard bits

I set up two access control lists on the router! That's what you said about 1 and 2, and then use the show command to view!

We found that everything was the same except for the access control list number! From this we can conclude that their effect is the same!

Question 2: The in and out directions are directly related to the data flow, and it has nothing to do with whether the interface is ether or serial! So the in and out on ethernet and serial are actually the inflow and outflow of data streams!

For the traffic you want to handle! For example, if this traffic is sent from another router to the S0 0 port of your current router, and you send it from your S0 1 port, then for you, S0 0 is the In direction, and S0 1 is the Out direction!

In the case is determined that the source address is an address in the VLAN, and when out is in the case of an IP address other than the current VLAN.

To give you an example, 18 and 19 are two different network segments, and the access list is added to the 18 network segment,-- which means that it can be accessed,-- x -- > means that it cannot be accessed.

ip access-l exte test_liu

deny ip host host

permit ip any any

inter vlan 18

ip access-g test_liu in

exit test: >

inter vlan 18

ip access-g test_liu out

exit test: >

ip access-l exte test_liu

deny ip host host

permit ip any any

inter vlan 18

ip access-g test_liu in

exit test: >

inter vlan 18

ip access-g test_liu out

exit test: >

ACL control stuffiness system is configured first Mr. effect,Haven't you already configured the ant Gao Xun forbidden mind to stop access to 227 in the front,How can you configure the back to allow access to 227?

Standard and Extended Standard ACLs use numbers between 1 99 and 1300 1999 as table numbers Extended ACLs use numbers between 100 199 and 2000 2699 as table numbers: Control traffic to the network to manage traffic in a unified manner, Allow and deny with standard ACL to single with service or protocol control, Allow and deny with Extended ACL.

An access control list is a list of instructions applied to a router interface that tells the router which packets can be received and which packets need to be rejected. Whether a packet is received or rejected can be determined by specific indications such as source address, destination address, port number, protocol, etc. With the flexibility to add access control lists, the ACL can be used as a powerful tool for network control to filter packets flowing into and out of the router interface.

After the access control list is established, the network traffic can be restricted, the network performance can be improved, and the communication traffic can be controlled, which is also the basic security means for network access. After an access control list is configured on a router's interfaces, you can perform security inspections on inbound interfaces, outbound interfaces, and packets relayed through the router.

When we want to block all traffic from a network, or allow all traffic from a particular network, or deny all traffic from a protocol suite, we can use standard access control lists to achieve this. Standard access control lists inspect the source address of routed packets, allowing or denying all traffic based on the IP address of the network, subnet, or host to egress through the router.

Extended access control lists check both the source and destination addresses of packets, as well as the specific protocol type, port number, and so on. Extended access control lists are more flexible and extensible, allowing traffic to pass through certain protocols and denying traffic using other protocols to the same address.

Table numbers are used in both standard and extended access control lists, and a string of letters or numbers is used in place of the preceding number in the named access control list. Named access control lists can be used to delete a specific control entry, which can be easily modified as we go.

When using named ACLs, the router's iOS version is required to be in the above version, and multiple ACLs cannot be named with the same name, and different types of ACLs cannot use the same name.