Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I found this line in among many other ACL lines in my PIX. It looks different than the rest of them. It's at the end of the rest of the ACL lines, including being after access-list acl-out deny ip any any.

access-list 110 permit ip

What does it do, and what are each of the parts? The rest of my ACL lines end with something like any eq 1234.

Thanks in advance!

share|improve this question
up vote 6 down vote accepted

It's allowing all IP traffic from the subnet to the subnet. It's probably being used as a match list on a VPN tunnel or to prevent NAT on tunneled traffic.

The number, 110, is just an arbitrary number to identify the access list. "Permit" indicates that it will permit the traffic (as opposed to deny). "IP" indicates to match the IP protocol (as opposed to a protocol number, or TCP, UDP, ICMP, etc). The and identify the source network. The and identify the destination network.

For more in depth info, have a look at:

share|improve this answer
A stellar answer. Thank you! – eleven81 Jun 3 '09 at 18:53

You should look at the rest of the config to see if there is a rule such as VPN or NAT referencing ACL 110

doing a:

sh run | i 110

will give you all the lines thave have 110 - i realize there is the posibility of fluff from ip address ect, but it shouldn't be too much.

share|improve this answer

It allows IP traffic in general from to

The eq 1234 in the other rules specify ports, but there are no ports in IP. To match a port, you have to specify TCP or UDP in the rule.

share|improve this answer

That ACL is to allow all the traffic from one subnet to the other one on the same line.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.