ACL order...
Daniel333
Member Posts: 2,077 ■■■■■■□□□□
Hey, why is it that we want to keep more specific entries at the top of an ACL? I can't figure out a reason. Seems to me we would want the more general at the top...
-Daniel
Comments
-
Bl8ckr0uter
Inactive Imported Users Posts: 5,031 ■■■■■■■■□□
Hey, why is it that we want to keep more specific entries at the top of an ACL? I can't figure out a reason. Seems to me we would want the more general at the top...
Because the acls are read in order and compared in order. Plus since it is very router intensive, you want to get the packet action that you want as quickly as possible. -
dynamik
Banned Posts: 12,314 ■■■■■■■■□□
Plus, doesn't the first match get applied? If you're matching on the more general ones, you'll never get to the more specific ones. -
captobvious
Member Posts: 648
+1 takes me back to the old Basic days. Heck with number sequencing, it almost looks like a basic program. You have to think top-down when applying acl's.Plus, doesn't the first match get applied? If you're matching on the more general ones, you'll never get to the more specific ones. -
phoeneous
Go ping yourself... Member Posts: 2,333 ■■■■■■■□□□
Hey, why is it that we want to keep more specific entries at the top of an ACL? I can't figure out a reason. Seems to me we would want the more general at the top...
Think of it as a first match checklist. Are you this IP, using this protocol, on this port, going to this destination? Then deny everything else.