12—ACL讨论.pptVIP

* * * * The output from the show ip access-list command displays the contents of previously defined IP access lists. Note: ntp = Network Time Protocol. * Following these general principles helps ensure the access lists you create have the intended results: Top-down processing Organize your access list so that more specific references in a network or subnet appear before more general ones. Place more frequently occurring conditions before less frequent conditions. Implicit deny any Unless you end your access list with an explicit permit any, it will deny by default all traffic that fails to match any of the access list lines. New lines added to the end Subsequent additions are always added to the end of the access list. You cannot selectively add or remove lines. Undefined access list = permit any If you apply an access list with the access-group command to an interface before any access list lines have been created, the result will be permit any. The list is “live,” so if you enter only one line, it goes from a permit any to a “deny most” (because of the implicit deny any) as soon as you press ENTER. For this reason, create your access list before you apply it to an interface. * Use the access-list command to create an entry in a standard traffic filter list. ip access-group Command Description no access-list access-list number. Deapply the access list with the no ip access-group access-list-number command. 1300-1999 IP standard access list (expanded range) * Both standard and extended IP access lists use a wildcard mask. Like an IP address, a wildcard mask is a 32-bit quantity written in dotted-decimal format. Address bits corresponding to wildcard mask bits set to 1 are ignored in comparisons; address bits corresponding to wildcard mask bits set to 0 are used in comparisons. An alternative way to think of the wildcard mask is as follows: If a 0 bit appears in the mask, then the corresponding bit location in the access list address and the same l