ACL Technology

effect ：

Identify and filter packets
for example ：
requirement 192.168.1.192-255 Cannot access 192.168.2.218-255
Then you can set 10 deny ip 192.168.1.192( Source ip) 0.0.0.63( wildcard ) 192.168.2.218( Purpose ip) 0.0.0.37( wildcard )
How to find wildcards ?
192 Into 11000000, Wildcards take the opposite value 00111111 So for 63, The wildcard is 32 position , by 0 This one cannot change , by 1 This one can be changed

standard acl And expansion acl Adopt serial number writing method , Don't suggest , Because modifying the rules in the table requires rewriting the entire table

Recommended name acl, It can be modified according to the serial number acl surface


Port number corresponding to common protocols
If the purpose ip by dns The server ip So use udp agreement The port number is 53
Normal communication (ping) Use ip agreement No port number
Cisco refuses by default, so , It means that if there is no match , This will be rejected by default ip
Change to allow by default
10 permit any any