Cisco Certified Expert

ACL Caveats Cont

Statement	Caveat
Modifying numbered ACLs	Adding new statements may require that a new ACL be created (Cisco IOS Release 12.2 and earlier).
Special packets	If filtering router-generated packets is part of the security policy, they must be acted upon by inbound ACLs on adjacent routers or through other router filter mechanisms using ACLs.
Extended ACL placement	Always consider placing extended ACLs on routers as close as possible to the source being filtered.
Standard ACL placement	Always place standard ACLs as close to the destination as possible.

■ Modifying ACLs: Always append new statements added to an existing ACL to the bottom of the ACL. Because of the inherent top-down statement evaluation order of ACLs, these new entries may render the ACL unusable. When a new statement does render the ACL unusable, you must create a new ACL with the correct statement ordering. Delete the old ACL and assign the new ACL to the router interface.

■ Special packets: Router-generated packets, such as routing table updates, are not subject to outbound ACL statements on the source router. If your security policy requires filtering these types of packets, inbound ACLs on adjacent routers or other router filter mechanisms using ACLs must do the filtering task.

■ Extended ACL placement: If you use extended ACLs on routers too far from the source that you need to filter, packets flowing to other routers and interfaces may be adversely affected. Always consider placing extended ACLs on routers as close as possible to the source that you are filtering.

■ Standard ACL placement: Because standard ACLs filter packets based on the source address, placing these ACLs too close to the source can adversely affect packets destined to other destinations. Always place standard ACLs as close to the destination as possible.

© 2006 Cisco Systems, Inc. Cisco IOS Firewall Configuration 4-73

0 0