Access Control Lists
Packet filtering logic, direction, ordering, stateful versus stateless behavior and safe validation.
What this topic solves
Packet filtering logic, direction, ordering, stateful versus stateless behavior and safe validation.
Follow state and packet path
Define source, destination, direction, state and policy explicitly. Validate counters and logs; a correct rule in the wrong place is ineffective.
Input → classification/state → decision → table → next-hop/output → countersDesign before configuration
- Define the failure domain and expected convergence behavior.
- Document addressing, identifiers, timers, MTU and policy boundaries.
- Prefer explicit, observable state over assumptions.
- Plan rollback and out-of-band access before risky changes.
Commands and verification
Command syntax varies by platform and software release. The examples below come from the existing portal content and must be validated against the target platform documentation before production use.
Rede: 10.20.30.0/24
Máscara: 255.255.255.0
Wildcard: 0.0.0.255
host 10.20.30.10 = 10.20.30.10 0.0.0.0
any = 0.0.0.0 255.255.255.255
ip access-list extended USUARIOS-WEB
permit tcp 10.20.0.0 0.0.255.255 any eq 443
permit udp 10.20.0.0 0.0.255.255 any eq 53
deny ip any any log
interface GigabitEthernet0/0
ip access-group USUARIOS-WEB in
show access-lists
show ip interface
show run | section access-listEvidence-driven workflow
- Define source, destination, time window and exact symptom.
- Establish the expected healthy state and compare it with the observed state.
- Inspect counters, tables, logs and packet captures before resets.
- Test one hypothesis at a time and prefer reversible changes.
- Repeat the original test after correction and check side effects.
Standards and RFCs applicable to the technology
Use the current standard/RFC and the documentation for the exact software release being operated. Vendor syntax is an implementation detail; protocol behavior should be understood independently.
Prove the behavior in a controlled topology
Build the smallest topology that reproduces the mechanism, capture control and data traffic, introduce one deliberate failure and diagnose it before applying the fix.