01
Front
What is an IPv4 access control list (ACL)?
Back
An IPv4 ACL is an ordered set of rules a router or Layer 3 switch checks to permit or deny packets. It takes effect only after being applied to an interface or another ACL-using feature.
Free Online Flashcard Deck
1 Access Control Lists Free Online FlashCards
Study 1 Access Control Lists with 12 free online flashcards. Review key terms, definitions, and concepts with this interactive flashcard deck.
12 cards
02
Front
What does a standard ACL match?
Back
A standard ACL matches a packet’s source IPv4 address.
03
Front
What can an extended ACL match beyond source address?
Back
An extended ACL can match protocol, source and destination addresses, and TCP or UDP port numbers.
04
Front
What do 0 and 1 bits mean in an ACL wildcard mask?
Back
In a wildcard mask, each 0 bit must match the corresponding address bit; each 1 bit may vary.
05
Front
What do host and any mean in ACL address matching?
Back
host 192.0.2.25 matches one address, equivalently 192.0.2.25 0.0.0.0. The keyword any is equivalent to 0.0.0.0 255.255.255.255.
06
Front
How does an ACL choose which matching rule to apply?
Back
The device checks entries from top to bottom. The first matching entry determines the packet’s result; later entries are not checked.
07
Front
What happens when a packet matches no ACL entry?
Back
If no ACL entry matches, an implicit deny any at the end denies the packet.
08
Front
When are inbound and outbound ACLs checked?
Back
Inbound ACLs check packets as they arrive, before routing. Outbound ACLs check packets as they leave, after routing.
09
Front
In the example TCP ACL rule, what does eq 443 match?
Back
In an extended TCP rule, eq 80 or eq 443 matches the destination port when it follows the destination address.
10
Front
What should you verify when troubleshooting an ACL?
Back
Inspect rules, interface application, direction, and match counters with show access-lists, show ip access-lists, show ip interface, and show running-config. Test both permitted and denied traffic.
11
Front
What address range behavior does wildcard 0.0.0.255 represent?
Back
The wildcard mask 0.0.0.255 allows the final octet to vary, so the first three octets must match the specified address.
12
Front
How do you calculate a wildcard mask from a subnet mask?
Back
Subtract the subnet mask from 255.255.255.255 to calculate its wildcard mask.