Is Access-group the old command of the Access-list for old routers? or they're just complete each other because when I do an Access-list I need to go to the port and use Access-group.
Or they are just separated commands complete each others?
Add a comment
|
1 Answer
Proceeding from the assumption that you are talking about Cisco gear, it is basically as you said, they complete each other. Neither an access-list nor an access-group on its own will have any effect.
In fact, you configure an access-list first, which contains the rules permitting or denying the traffic. You can match on things like source and destination address, layer 4 protocol and layer 4 port information (source and destination port as applicable). You however cannot specify where this policy should be applied.
This is where the access-group comes in. Using the access-group, you can apply a previously defined access-list to an interface and further configure the direction of traffic that should be filtered.
Consider the following example:
access-list 100 permit tcp 10.0.0.0 0.0.0.255 host 192.168.178.2 eq 443
interface GigabitEthernet 0/0
ip access-group 100 in
Note that each access-list has an implicit deny ip any any at the end, which means that every traffic not permitted explicitly before will be dropped. To change that behaviour, you can put the following line at the end of the access-list:
access-list 100 permit ip any any
This applies the access list to Interface Gi 0/0 in the inbound direction, which means that the traffic is filtered when it enters the router using the specified interface.
