09.12.2012 Views

Understanding the network.pdf - Back to Home

Understanding the network.pdf - Back to Home

Understanding the network.pdf - Back to Home

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

When constructing access control lists, <strong>the</strong> order of <strong>the</strong> action statements is crucial.<br />

Traffic matches are made recursively, so ideally you want statements at <strong>the</strong> <strong>to</strong>p of<br />

<strong>the</strong> list <strong>to</strong> be specific and become increasingly general as <strong>the</strong> list progresses. In this<br />

same vein, place entries in descending order (most likely <strong>to</strong> least likely). The goal is<br />

<strong>to</strong> have packets processed as quickly as possible out of <strong>the</strong> ACL. Poorly placed<br />

statements or an excessively long ACL will produce undesirable results, ranging<br />

from restrictive or ineffective routing <strong>to</strong> degradation of overall performance.<br />

NOTE<br />

A slight caveat <strong>to</strong> this rule exists when constructing IP ACLs. The IOS reorders IP<br />

ACL entries based on <strong>the</strong>ir <strong>network</strong> address, using a low-<strong>to</strong>-high ordering scheme.<br />

For example, if you have an ACL that filters addresses using <strong>the</strong> IP <strong>network</strong><br />

addresses:<br />

10.30.100.0 /24<br />

172.116.45.0 /24<br />

192.168.34.0 /24<br />

The ACL will be ordered using entries from <strong>the</strong> 10.30.100.0 /24 <strong>network</strong> first and<br />

<strong>the</strong> 192.168.34.0 /24 last, regardless of <strong>the</strong> order in which <strong>the</strong>y are entered during<br />

<strong>the</strong> configuration. The same rule holds true for ACL entries created using only one IP<br />

address space. ACL entries for hosts with addresses from <strong>the</strong> beginning of <strong>the</strong><br />

address range will be closer <strong>to</strong> <strong>the</strong> <strong>to</strong>p of <strong>the</strong> ACL. So, if an ACL permits <strong>the</strong> hosts<br />

192.168.30.22<br />

192.168.30.200<br />

192.168.30.3<br />

192.168.30.14<br />

192.168.30.198<br />

<strong>the</strong> ACL will be ordered starting with 192.168.30.3 and ending with 192.168.30.200.<br />

Regardless of <strong>the</strong> order in which <strong>the</strong> actual entries are made, <strong>the</strong> router will reorder<br />

<strong>the</strong> addresses during <strong>the</strong> construction of <strong>the</strong> ACL.<br />

Originally, different types of access control lists were distinguished by <strong>the</strong> number<br />

associated with each list. Access control lists are created with <strong>the</strong> global<br />

configuration EXEC command . Each pro<strong>to</strong>col has a

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!