×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

ACL doubt

Unanswered Question
Apr 10th, 2006
User Badges:
  • Silver, 250 points or more

interface vlan 5

ip address 192.168.1.1 255.255.255.255

ip access-group 101 in

ip access-group 102 out


interface vlan 6

ip address 10.2.1.1 255.255.255.0


access-list 101 permit ip 192.168.1.0 255.255.255.0 10.2.1.0 255.255.255.0


access-list 102 permit 10.2.1.0 255.255.255.0 192.168.1.0 255.255.255.0


which means 101 says that vlan 5 will permit vlan 6 inside & 102 says that vlan 5 will reach vlan 6 out


can i use in this mannaer


access-list 101 10.2.1.0 0.0.0.255

access-list 102 192.168.1.0 0.0.0.255


is that the same?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Harold Ritter Mon, 04/10/2006 - 07:37
User Badges:
  • Cisco Employee,

I suppose you are referring to standard ACLs, in which case the ACL number has to be below 100 (1 through 99).


The standard ACL only checks against the source address, whereas the extended ACL (100 through 199)checks both the source and destination. Extnded ACL is a lot more powerful since it allows to specify the protocol, source and destination protocol ports, etc. etc.


Hope this helps,

Anand Narayana Mon, 04/10/2006 - 07:42
User Badges:
  • Silver, 250 points or more

thanks hritter, my doubts got cleared, also can i use "n" number of access-list in my router or does it hav eany limitation if i use Extended ACL or Standard ACL, already i have created ACL nearly 100 lines, so will it permit more than that also?

Harold Ritter Mon, 04/10/2006 - 10:59
User Badges:
  • Cisco Employee,

100 lines is quite conservative compared to what I have seen being used by some customers in the past.


Hope this helps,

Actions

This Discussion