Extended access lists, just as standard access lists, are read from top to bottom. Therefore, when creating access lists, you want to create the more specific statements and the more frequently occurring conditions towards the top of the list and the more general statements towards the end. When a deny statement is encountered, all statements that follow in the list that apply to the same type of traffic on that interface are ignored.

There are two types of access lists, standard and extended. Extended access lists can be either named or numbered. Characteristics of named access lists include:

- Individual statements within the list can be deleted, rather than deleting the entire list as is required with numbered lists.
- Named lists must specify whether they are standard or extended. With numbered lists, this is indicated by the use of specific list number ranges.
- The ip access-list command is used for numbered lists rather than the access-list command as is used with numbered lists.

Standard access lists are applied as close to the destination as possible (outbound), and can only base their filtering criteria on the source IP address. The number used while creating an access list specifies the type of access list created. The range used for standard access lists is 1 to 99 and 1300 to 1999.

Extended access lists are applied as close to the source as possible (inbound), and can base their filtering criteria on the source or destination IP address, or on the specific protocol being used. The range used for extended access lists is 100 to 199 and 2000 to 2699.

Access lists express the set of rules that give added control for packets that enter inbound interfaces, packets that relay through the router or packets that exit outbound interfaces of the router. Access lists do not act on packets that originate from the router itself. Instead, access lists are statements that specify conditions on how the router will handle the traffic flowing through specified interfaces.

The other options are incorrect because access lists are always read from top to bottom.

Objective:
Infrastructure Services

Sub-Objective:
Configure, verify, and troubleshoot IPv4 standard numbered and named access list for routed interfaces

References: https://www.cisco.com/c/en/us/support/docs/security/ios-firewall/23602- confaccesslists.html#standacl

In what order are the lines of an access list read when an access list is applied to a router interface? (Choose all that apply.)

0 Discussions

Trending Exams