Great Circle Associates Firewalls
(July 1996)
 

Indexed By Date: [Previous] [Next] Indexed By Thread: [Previous] [Next]

Subject: Re[2]: Newbie Cisco Access-List Question
From: "John M. Shaw" <jshaw @ dttus . com>
Date: Wed, 10 Jul 96 10:38:05 CST
To: firewalls @ GreatCircle . com

     
     Is is the same for "ip route":
     
     If I have 2 lines from my ISP hooked up to the serial lines on my 
     router :
     
     ip route 0.0.0.0 0.0.0.0 Serial0
     ip route 0.0.0.0 0.0.0.0 Serial1
     
     Will anything get sent over Serial1?
     Is there a way to somewhat balance the load between the 2 lines?

     TIA

     jshaw @
 dttus .
 com

______________________________ Reply Separator _________________________________
Subject: Re: Newbie Cisco Access-List Question
Author:  Warren Auld <wauld01 @
 mail .
 state .
 mo .
 us> at INTERNET-USA
Date:    7/10/96 10:08 AM


     
Hi,
     
Yes, order matters -- the entries in an access list are evaluated 
sequentially until a match is found at which point the packet is either 
sent on or rejected. In the example you gave below, all packets addressed 
to ports higher than 1023 will make it through and the second line will 
never have any effect. If you reverse the lines, traffic to port 2049 
would be denied while everything else above 1023 would get through.
     
Hope this helps....
     
      warren
     
      wauld01 @
 mail .
 state .
 mo .
 us
     
On Wed, 10 Jul 1996, John M. Shaw wrote:
     
>      
>      
>      Assuming 2 lines with same source, s-mask, dest, and d-mask: 
>      
>      access-list 101 permit tcp source s-mask dest d-mask gt 1023 
>      access-list 101 deny   tcp source s-mask dest d-mask eq 2049 
>      
>      Which one takes precedence?
>      Does the order matter?
>      
>      Any help would be greatly appreciated? 
> 
> 


Indexed By Date Previous: Re: Well Known Port Numbers
From: Mark Krause <mkrause @ UU . NET>
Next: Re: Well Known Port Numbers
From: peter @ baileynm . com (Peter da Silva)
Indexed By Thread Previous: Newbie Cisco Access-List Question
From: "John M. Shaw" <jshaw @ dttus . com>
Next: Re: Newbie Cisco Access-List Question
From: Paul Ferguson <pferguso @ cisco . com>

Google
 
Search Internet Search www.greatcircle.com