Access Lists - Implicit Deny?

[dkraut]

I'm trying to better understand the implicit deny at the end of access-lists on routers and how to best modify existing access lists. Using the example below. Lets say that I now want to allow Telnet from a specific IP (i.e., 149.54.11.5 ) to a specific IP (i.e., 172.16.1.10 )

access-list 101 deny tcp any any eq 161
access-list 101 deny tcp any any eq telnet
access-list 101 permit ip any any

Does that mean that If I simply entered the command >

access-list 101 permit tcp 149.54.11.5 172.16.1.10 eq Telnet

it would get appended after the >
access-list 101 deny tcp any any eq telnet
and subsequently not work?

Would that mean that to correctly "insert" this new line I would need to run the following command?

no access-list 101 permit ip any any
access-list 101 permit tcp 149.54.11.5 172.16.1.10 eq Telnet
access-list 101 permit ip any any

If this is correct, does that meant that immediately after I run >

no access-list 101 permit ip any any

all incoming traffic will be blocked until I re-enter >

access-list 101 permit ip any any

And to complete this I assume I would need to run an access-group command to bind the list to an interface?

Thanks!~

 

[Degg]

when you insert a new line, it will appear after the last line. so, your access-list 101 permit tcp 149.54.11.5 172.16.1.10 eq Telnet would appear after the permit ip any any statement. what I do is enter the new lines, then do a no permit ip any any followed by a permit ip any any. this removes it and reapplies it to the end of the acl.
yes, when you remove the permit ip any any command, all traffic is blocked if the acl is applied to an interface. if the acl is not applied anywhere, then you can do whatever you want and it wont affect traffic.

Degg
Network Administrator

 

[MTandSAV]

besides that you need to apply the ACL to an interface, you also need to specify whether its inbound our outbound ACL.

 

[commsguy]

a practice i ALWAYS follow is to remove the access list entirley and re-add it in the order i want it. By doing this every time, i avoid frustrating troubleshooting experiences later.

commsguy

http://www.convetech.com