How does a router process an ACL, and how do you insert a line into one that is live in production?
Show the answer
Say this first
Top down, first match wins, and processing stops at that line. So specific lines go before general
ones. To insert a line I use sequence numbers: ip access-list extended NAME, then 15 permit ...
lands between 10 and 20. If I run out of gaps, ip access-list resequence NAME 10 10 renumbers the
list. For risky changes on a remote device I protect myself with a scheduled rollback first.
Go deeper
Inserting a line
R1# show ip access-lists BRANCH-IN
Extended IP access list BRANCH-IN
10 permit tcp 10.1.20.0 0.0.0.255 host 10.2.50.10 eq 443
20 deny ip 10.1.20.0 0.0.0.255 10.2.50.0 0.0.0.255
30 permit ip any any
R1# configure terminal
R1(config)# ip access-list extended BRANCH-IN
R1(config-ext-nacl)# 15 permit tcp host 10.1.20.5 10.2.50.0 0.0.0.255 eq 22
R1(config-ext-nacl)# end
R1# show ip access-lists BRANCH-IN
Extended IP access list BRANCH-IN
10 permit tcp 10.1.20.0 0.0.0.255 host 10.2.50.10 eq 443
15 permit tcp host 10.1.20.5 10.2.50.0 0.0.0.255 eq 22
20 deny ip 10.1.20.0 0.0.0.255 10.2.50.0 0.0.0.255
30 permit ip any anyA line added without a sequence number goes to the end, below any explicit deny, where it never matches.
Changing ACLs safely on a remote router
reload in 10before the change,reload cancelonce you know you can still reach the box.- Build the new policy as a new ACL name, then swap it with one
ip access-group NEW incommand, which replaces the old binding in one step. - Never delete and retype an ACL that is applied. Between the
noand the new lines, the interface either permits everything or, once the first line exists, denies everything else. - On Junos,
commit confirmed 5rolls back automatically unless you confirm.
Order of evaluation details
Switches evaluate ACLs in TCAM in parallel, but the result is the same as top down: the lowest sequence number that matches wins.
They will ask next
What does
establisheddo in an ACL line?It matches TCP segments with the ACK or RST flag set, which is a stateless way to allow return traffic for connections started from inside. It does not track sessions and does nothing for UDP.
How would you find which line is matching a flow?
Clear the counters with
clear ip access-list counters NAME, generate the traffic, and readshow ip access-lists NAME. Temporarylogon the suspected line confirms it.
Traps
- Putting
permit ip any anyabove a deny line. The deny never matches. - Adding a line without a sequence number and expecting it near the top.