ACL question

Quick question can someone shed little light on this one?  What is the difference in the 2 acl entries and are both of those entries needed? (IP's changed)

access-list 100 permit tcp any 192.168.0.0 0.0.255.255 gt 1023
access-list 100 permit ip any 192.168.0.0 0.0.0.255
JelonetAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

pseudocyberCommented:
The first one will permit any tcp traffic from 192.168.0.0/16 greater than port 1023 (high numbered ports).
The bottom one will permit any IP traffic from 192.168.0.0/24

Note, the two are different networks because of the masks.
0
localhostCommented:
> access-list 100 permit tcp any 192.168.0.0 0.0.255.255 gt 1023

Basically, this acl entry permits only tcp connection with port greater than 1023. Your wildcard mask entry of 0.0.255.255 means you permit network 192.168.* to match this ACL and hence, the packet will be accepted. For example:

IP: 192.168.x.x will be allowed to use any tcp applications with port greater than 1023

> access-list 100 permit ip any 192.168.0.0 0.0.0.255

Whereas for this ACL entry, it means you only permit network 192.168.0.x to access the network. For example:

IP: 192.168.0.1 - 192.168.0.255 will be allowed to access the network

but anything out of the network 192.168.0.x will not be allowed to access the network due to your wildcard mask 0.0.0.255 (which only checks the last octet of the IP address).

However, note that there is a implicit deny statement at the end of the access-list table.

Hope this helps :)
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
JelonetAuthor Commented:
Thank you for clearing that up.
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

pseudocyberCommented:
You're welcome. :)
0
pseudocyberCommented:
:(
0
localhostCommented:
No problem. Glad to be of assistance :)
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Networking

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.