CCNA Cisco Certified Network Associate Study Guide - FTP Server

442 Chapter 9 � Managing Traffic with Access Lists
There are also some access list guidelines that should be followed when
creating and implementing access lists on a router:
Standard IP Access Lists
� You can only assign one access list per interface, per protocol, or per
direction. This means that if you are creating IP access lists, you can only
have one inbound access list and one outbound access list per interface.
� Organize your access lists so that the more specific tests are at the top
of the access list.
� Anytime a new list is added to the access list, it will be placed at the
bottom of the list.
� You cannot remove one line from an access list. If you try to do this,
you will remove the entire list. It is best to copy the access list to a text
editor before trying to edit the list. The only exception is when using
named access lists.
� Unless your access list ends with a permit any command, all packets
will be discarded if they do not meet any of the lists’ tests. Every list
should have at least one permit statement, or you might as well shut
the interface down.
� Create access lists and then apply them to an interface. Any access list
applied to an interface without an access list present will not filter traffic.
� Access lists are designed to filter traffic going through the router. They
will not filter traffic originated from the router.
� Place IP standard access lists as close to the destination as possible.
� Place IP extended access lists as close to the source as possible.
Standard IP access lists filter the network by using the source IP address in
an IP packet. You create a standard IP access list by using the access list numbers
1–99.
Here is an example of the access list numbers that you can use to filter
your network. The different protocols that you can use with access lists
depend on your IOS version.
RouterA(config)#access-list ?
IP standard access list