PlantUML DiagramACL Placement Decision
A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
Numbered ACLs are a legacy convenience. Named ACLs are the modern standard. The only reason to use numbered ACLs today is if you're managing an old config where they're already in place. For anything new, use named ACLs — you can delete individual entries, insert rules mid-list, and read the config without memorizing number ranges.
| Feature | Numbered | Named |
|---|---|---|
| Syntax | `access-list 100 permit ...` | `ip access-list extended NAME` |
| Edit individual lines | Very difficult | Yes — with sequence numbers |
| Read config | Must memorize number ranges | Name says it all |
| Reorder entries | Delete and recreate ACL | Resequence with `resequence` command |
| Modern recommendation | Legacy | Standard |
! Create a named extended ACLR1(config)# ip access-list extended WEB_TO_DBR1(config-ext-nacl)# permit tcp 10.10.20.0 0.0.0.255 host 10.10.99.10 eq 3306R1(config-ext-nacl)# permit tcp 10.10.20.0 0.0.0.255 host 10.10.99.10 eq 5432R1(config-ext-nacl)# deny ip any any logR1(config-ext-nacl)# exit! Add a rule in the middle using sequence numbersR1(config)# ip access-list extended WEB_TO_DBR1(config-ext-nacl)# 15 permit tcp 10.10.20.0 0.0.0.255 host 10.10.99.10 eq 6379R1(config-ext-nacl)# exit! Delete a specific lineR1(config)# ip access-list extended WEB_TO_DBR1(config-ext-nacl)# no 20R1(config-ext-nacl)# exit
Sequence numbers make all the difference. Every entry has a number (10, 20, 30... by default in increments of 10). To insert between existing entries, use a number between — `15` inserts after `10` and before `20`. To delete a specific entry, reference its number. This is impossible with numbered ACLs without full recreation.
The gaps of 10 are intentional — they leave room for insertion. If you find yourself needing to insert more than 9 rules between two entries, use `resequence` to renumber everything with more space. `ip access-list resequence WEB_TO_DB 100 100` renumbers starting at 100 with step 100 — plenty of room.
! Renumber ACL entries with wider gapsR1(config)# ip access-list resequence WEB_TO_DB 10 10! Or a wider gapR1(config)# ip access-list resequence WEB_TO_DB 100 100! VerifyR1# show ip access-lists WEB_TO_DB
Two rules, applied consistently. Standard ACLs match only source, so placing them near the source risks blocking unintended traffic. Extended ACLs are specific, so placing them near the source drops bad traffic early without harming other flows. Memorize the pairing: standard→destination, extended→source.
You need to add a new permit rule to an existing ACL in the middle of the list, between existing entries at positions 30 and 40. What's the correct approach?
Select the safest next action.
Finish the lesson once you have worked through the material. This awards ★ 40 XP.
Select each vulnerable line, then classify the finding.
Findings
Review target: 11 lines · 1 expected finding