ACL doubt

Anand Narayana · ‎04-10-2006

interface vlan 5

ip address 192.168.1.1 255.255.255.255

ip access-group 101 in

ip access-group 102 out

interface vlan 6

ip address 10.2.1.1 255.255.255.0

access-list 101 permit ip 192.168.1.0 255.255.255.0 10.2.1.0 255.255.255.0

access-list 102 permit 10.2.1.0 255.255.255.0 192.168.1.0 255.255.255.0

which means 101 says that vlan 5 will permit vlan 6 inside & 102 says that vlan 5 will reach vlan 6 out

can i use in this mannaer

access-list 101 10.2.1.0 0.0.0.255

access-list 102 192.168.1.0 0.0.0.255

is that the same?

Harold Ritter · ‎04-10-2006

I suppose you are referring to standard ACLs, in which case the ACL number has to be below 100 (1 through 99).

The standard ACL only checks against the source address, whereas the extended ACL (100 through 199)checks both the source and destination. Extnded ACL is a lot more powerful since it allows to specify the protocol, source and destination protocol ports, etc. etc.

Hope this helps,

Harold Ritter
Sr Technical Leader
CCIE 4168 (R&S, SP)
harold@cisco.com
México móvil: +52 1 55 8312 4915
Cisco México
Paseo de la Reforma 222
Piso 19
Cuauhtémoc, Juárez
Ciudad de México, 06600
México

Anand Narayana · ‎04-10-2006

thanks hritter, my doubts got cleared, also can i use "n" number of access-list in my router or does it hav eany limitation if i use Extended ACL or Standard ACL, already i have created ACL nearly 100 lines, so will it permit more than that also?

Harold Ritter · ‎04-10-2006

100 lines is quite conservative compared to what I have seen being used by some customers in the past.

Hope this helps,

Harold Ritter
Sr Technical Leader
CCIE 4168 (R&S, SP)
harold@cisco.com
México móvil: +52 1 55 8312 4915
Cisco México
Paseo de la Reforma 222
Piso 19
Cuauhtémoc, Juárez
Ciudad de México, 06600
México

Anand Narayana · ‎04-11-2006

Thanks for clearing my doubts hritter