So i'm configuring a basic network and I need to create a couple of Extended ACLs. Now my question is, does this ACE permit any TCP connection to the following subnet?

permit tcp

Basically, what i'm trying to achieve is that I want the subnet to permit any tcp to the subnet. Is it correct? OR should I switch to a standard ACL?

Thanks, Matthew

  • That's correct. Is there a reason why you think it's not?
    – Jesse P.
    Feb 21 '19 at 15:44
  • 1
    You need to apply the ACL to an interface, too, if you've not done that part. You can apply it on either the source or destination side, depending on the direction you want to apply the ACL in (as traffic leaves the source, or as traffic enters the destination).
    – Jesse P.
    Feb 21 '19 at 15:46
  • If you need help applying the ACL to an interface, you will need to provide a sanitized configuration of your device and tell us which side/direction you want to apply it in.
    – Jesse P.
    Feb 21 '19 at 16:14
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Dec 21 '20 at 17:29

permit tcp allows (any) TCP segments to travel from to

Depending on which interfaces you apply this ACE and which directions the packets travel you might also need to permit the opposite direction (esp. when applying to a VLAN and not a physical port/LAG trunk) - ACLs are stateless unlike many firewall rules which imply traffic in the opposite direction.

Also, note that ACLs have an implied deny ip any any as their last ACE. If the permission above isn't the only traffic you want to permit (UDP? ICMP? ...) you'd need to add more ACEs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy