Table of Contents

When you name access lists, it makes sense to name them well. I’ve seen many installations
of PIX firewalls where the inbound access list is named something like “out.”
Imagine troubleshooting this command:
access-group out in interface outside
If you’re not used to configuring ASA or PIX firewalls, that command might be difficult
to interpret. If the access list were instead named “Inbound,” the command would be
much more readable:
access-group Inbound in interface outside
The ability to quickly determine what a device is configured to do can save time during
an outage, which can literally save your job. I like to begin my access list names with
capital letters to help identify them in code. This is a personal preference that may or
may not suit your style—I’ve worked with people who complain when they have to
use the Shift key when typing.
Top-Down Processing
Access lists are processed from the top down, one line at a time. When a match is made,
processing stops. This is an important rule to remember when building and troubleshooting
access lists. A common mistake is to add a specific line to match something
that’s already been matched in a less specific line above it. Let’s look at an example
from a 3750 switch:
ip access-list extended GAD
permit tcp any 10.10.10.0 0.0.0.255 eq www
permit tcp any host 10.10.10.100 eq www
permit tcp any host 10.10.10.100 eq domain
In this example, the second permit line will never be matched, because the IP address
and protocol are matched in the previous line. Even so, in the event that the first line
doesn’t match, the second line will still be evaluated, wasting time and processing
power. This is a very common problem in enterprise networks. On larger firewalls,
where more than one person is administering the device, the problem can be severe. It
may also be hard to spot, because it doesn’t prevent protocols from working. This type
of problem is usually uncovered during a network audit.
Most-Used on Top
Access lists should be built in such a way that the lines that are matched the most are
at the beginning of the list. Recall that an ACL is processed until a match is made. Once
a match is made, the remainder of the ACL is not processed. If you’ve only worked on
routers with small ACLs, this may not seem like a big deal, but in real-world enterprise
firewalls, ACLs can be extensive. I’ve worked on firewalls where there were over 50,000
rules in place. How many of those entries do you suppose were valid
Designing Access Lists | 419