On (2010-07-08 11:25 +0300), John Kougoulos wrote: > switch#show access-list 40 > Standard IP access list 40 > 10 permit 192.168.2.10 > 15 permit 192.168.2.9 > 20 deny 192.168.2.0, wildcard bits 0.0.0.255
> switch(config-std-nacl)#25 permit 192.168.2.99 > Standard IP access list 40 > 25 permit 192.168.2.99 > 10 permit 192.168.2.10 > 15 permit 192.168.2.9 > 20 deny 192.168.2.0, wildcard bits 0.0.0.255 This is documented[0], quite surprising though. Consider even this: xyzzy(config)#ip access-list standard CATURDAY xyzzy(config-std-nacl)#permit host 1.2.3.4 xyzzy(config-std-nacl)#deny any xyzzy(config-std-nacl)#permit host 42.42.42.42 Will '42.42.42.42' be allowed by this ACL? Yes, because standard ACLs are ordered by descending order of IP addresses, not by SEQ numbers. Luckily new IOS like 12.2SRD and 12.4(24)T will complain on above scenario and won't allow you to add 42.42.42.42. I would still recommend using solely extended ACL if at all possible. [0] http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a00800a5b9a.shtml#ts (few lines above the anchor) -- ++ytti _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
