How are permit and deny in access lists and route maps evaluated?

Question

I've found a couple of links (easier explanation, more detailed one) that attempt to explain the concept of access lists and route maps. If I understood correctly, their behaviour largely depends on where and how access lists and route maps are used.

However I can't grasp the concept of permit/deny options.

The route map statements can also be marked with a deny. If the statement is marked as a deny, the packets meeting the match criteria are sent back through the normal forwarding channels (in other words, destination-based routing is performed). Only if the statement is marked as permit and the packets meet the match criteria are all the set clauses applied. If the statement is marked as permit and the packets do not meet the match criteria, then those packets are also forwarded through the normal routing channel.

Okay, that makes sense. But what about this:

Router(config)# access-list 1 permit 10.1.1.0 0.0.0.255
Router(config)# route-map MYMAP permit 10
Router(config-route-map)# match ip address 1
Router(config-route-map)# set ip next-hop 192.168.1.1 

There is permit in 1st and 3rd line. If the ip address matched 10.1.1.0 0.0.0.255, then its next hop is set to 192.168.1.1. Fine.

What if I set it to permit, deny respectively? Or deny, permit? Or deny, deny? What would happen in such cases? I'm guessing, that the result after setting both to deny would be the same as setting both to permit.

Answer 1

You need to remember that always will be an implicit DENY into every access-list. On the same way, if you put a deny statement onyour route-map, something like this:

xx#ip access-list 10 permit some_ip

xx#route-map TO_EXPLAIN deny 10
xx(config-route-map)#match ip access-list 10
xx(config-route-map)#set ip next-hop xyz

With this, the route map will never will do nothing 'cause the deny statement. If you want that a route map try to match something, your statement need to be a permit on some way.

Answer 2

Access Lists specify particular traffic.

Policy-Based Routing is a feature for overriding the routing table / forwarding mechanism for all traffic matching an access list.

A couple of key points:

1. You specify PBR on the incoming interface.
2. Packets that are generated by the router (such as ping) are not normally policy-routed.
3. Logical and / or concepts including subnet masking and wildcard masking are applicable.

see cisco.com: Configuring Policy-Based Routing