Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

here is my access lists which are not applied to any interface yet.

Extended IP access list REMOTE_DESKTOP_DENY
    10 deny tcp any eq 3389 host eq 3389
Extended IP access list REMOTE_DESKTOP_PEMIT
    10 permit tcp host eq 3389 host eq 3389

i have two question, 1. is there any conflicts will apply to same interface? 2. how to add one more ip to REMOTE_DESKTOP_PEMIT of permit host?


share|improve this question
It's a very basic question - you need to do a minimal effort to answer it yourself. – DukeLion May 21 '12 at 5:12
  1. Only one ACL can be applied on an interface in a given direction. If you want both of these policies applied at once then put them both in the same ACL.

  2. If you simply add a rule to an ACL - for example

    ip access-list extended REMOTE_DESKTOP_DENY
    permit ip tcp host bla.bla.bla.bla .... 

    .. then this entry will show up with an index of 20. If you want to insert an entry between 10 and 20 you can manually specify an index number (i.e. 15 permit tcp ....).

  3. Don't forget that there's an implicit deny at the end of these ACL's - meaning that any traffic that isn't explicitly permitted will be dropped. Good practice is to add an entry either explicitly denying all traffic - i.e. deny ip any any (possibly including a log statement) or permitting traffic that isn't otherwise denied (permit ip any any).

  4. Don't forget that if you want to apply ACL's in both directions that you'll need to account for return traffic. There are also other traffic types that range from helpful to critical - ICMP unreachables, for example, have often mistakenly been blocked, which can break things like MTU discovery.

This document is for an older version of IOS but it all still applies.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.