1

Is the global rule and the implicit deny following it looked at, even if no explicit interface ACL is configured on the interface?

They say:

If you configure a global access rule, then the implicit deny comes after the global rule is processed. See the following order of operations:

  1. Interface access rule.

  2. Global access rule.

  3. Implicit deny.

What if 1. does not exist and only 2. exists?

Improve this question

2 Answers 2

Reset to default
3

If you don't have an Interface ACL applied, than only the Global ACL and the Implicit Deny at the end of it will be considered.

#3 always exists (so long as either #1 or #2 are applied to an interface). You don't have to configure the Implicit Deny (that would make it an explicit deny).

Improve this answer
5
  • 1
    In other words, there must not be any interface rule nor global ACL configured if you want the interface security levels to be used. Ok. Too bad you still have to configure an explicit deny if you want it logged.
    – Marki
    Jan 10, 2015 at 23:07
  • 1
    Not necessarily. You can use show asp drop to view hitcounts on ACL dropped packets, and/or you can log message 106023 to view what gets dropped by your ACL.
    – Eddie
    Jan 11, 2015 at 0:37
  • 1
    You say #3 always exists, well no, if #1 and #2 do not exist for both inbound and outbound interfaces, i.e. there is no ACL at all, then the security levels are taken into consideration. So sometimes, it's an implicit accept, sometimes an implicit deny.
    – Marki
    Jan 11, 2015 at 14:25
  • Correct. If no ACL's are applied, then it falls back to Security Levels to determine if traffic will pass between interfaces. I've edited my original answer to be less vague about this part.
    – Eddie
    Jan 11, 2015 at 14:28
  • I've taken the liberty to edit your answer to include a table (maybe it appears only after review). Text can be so ambiguous. Wish Cisco had a table like this in their docs to clear all confusion.
    – Marki
    Jan 11, 2015 at 14:44
0

it will not exit always when you put the command of access-list then the such as (access-list extended) then the implicit rule will exit if there is deny until unless not permit interesting traffic every thing will be deny

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.