ACL question

Posted on 2006-04-14
Last Modified: 2010-03-19
Quick question can someone shed little light on this one?  What is the difference in the 2 acl entries and are both of those entries needed? (IP's changed)

access-list 100 permit tcp any gt 1023
access-list 100 permit ip any
Question by:Jelonet
    LVL 27

    Assisted Solution

    The first one will permit any tcp traffic from greater than port 1023 (high numbered ports).
    The bottom one will permit any IP traffic from

    Note, the two are different networks because of the masks.
    LVL 1

    Accepted Solution

    > access-list 100 permit tcp any gt 1023

    Basically, this acl entry permits only tcp connection with port greater than 1023. Your wildcard mask entry of means you permit network 192.168.* to match this ACL and hence, the packet will be accepted. For example:

    IP: 192.168.x.x will be allowed to use any tcp applications with port greater than 1023

    > access-list 100 permit ip any

    Whereas for this ACL entry, it means you only permit network 192.168.0.x to access the network. For example:

    IP: - will be allowed to access the network

    but anything out of the network 192.168.0.x will not be allowed to access the network due to your wildcard mask (which only checks the last octet of the IP address).

    However, note that there is a implicit deny statement at the end of the access-list table.

    Hope this helps :)

    Author Comment

    Thank you for clearing that up.
    LVL 27

    Expert Comment

    You're welcome. :)
    LVL 27

    Expert Comment

    LVL 1

    Expert Comment

    No problem. Glad to be of assistance :)

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    New My Cloud Pro Series - organize everything!

    With space to keep virtually everything, the My Cloud Pro Series offers your team the network storage to edit, save and share production files from anywhere with an internet connection. Compatible with both Mac and PC, you're able to protect your content regardless of OS.

    Suggested Solutions

    What is IRC? IRC (Internet Relay Chat) is a form of communication between multiple users. It is available freely to anyone with inernet access. IRC is a great way to communicate with others e.g. There is an IRC channel for Ubuntu Linux, which is fo…
    If your business is like most, chances are you still need to maintain a fax infrastructure for your staff. It’s hard to believe that a communication technology that was thriving in the mid-80s could still be an essential part of your team’s modern I…
    Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
    After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

    758 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    11 Experts available now in Live!

    Get 1:1 Help Now