Router – Access Control List in Firewall and Router

aclfirewallrouter

1)
Why do we need to specifically deny ip xxxxx xxxxxxx, when at the end of every ACL statement, WHEN there is a default "deny any any" statement?

Meaning we just permit only what we need and let the default "deny any any" take care of the rest instead of stating permit xxxx and deny xxxxx along with the default "deny any any".

2) What is the difference between ACL in Router and Firewall ASA?

3) Does permit [IP] cover TCP/UDP?

Best Answer

1) Why do we need to specifically deny ip xxxxx xxxxxxx, when at the end of every ACL statement, there is a default "deny any any" statement?

You don't "need to."
Some reasons for doing so are it gives you hit counts when you type "show access-list x," and you can add the logging command (deny ip any any log).

2) What is the difference between ACL in Router and Firewall ASA?

The biggest difference is that routers use wildcard masks, while ASAs use normal masks.

3) Does permit [IP] cover TCP/UDP?

Yes, along with ICMP, ESP, OSPF and others.

Related Topic