. The hit counts indicate that this ACL was not built optimally. To build it better, take the above output, and sort it by hitcnt, with the largest number first. The results look like this: access-list Inbound permit tcp any host web1.gad.net eq WWW (hitcnt=42942) access-list Inbound permit udp any host web1.gad.net eq domain (hitcnt=22600) access-list Inbound permit udp any host web2.gad.net eq domain (hitcnt=10029) access-list Inbound permit tcp any host web1.gad.net eq smtp (hitcnt=4308) access-list Inbound permit tcp any host web1.gad.net eq ssh (hitcnt=162) access-list Inbound permit tcp any host web1.gad.net eq imap4 (hitcnt=100) access-list Inbound permit tcp any host web2.gad.net eq smtp (hitcnt=2) access-list Inbound permit tcp any host lab.gad.net eq 8080 (hitcnt=1) access-list Inbound permit tcp any host lab.gad.net eq telnet (hitcnt=0) access-list Inbound permit tcp any host web2.gad.net eq imap4 (hitcnt=0) This is an optimal design for this admittedly small access list. The entries with the most hits are now at the top of the list, and those with the fewest are at the bottom. Beware of assumptions. You may think that SMTP should be high on your list because your firewall is protecting a mail server, but if you look at the preceding output, you'll see that DNS shows far more con- nections than SMTP. Check to see what's actually running on your network, and configure accordingly. The problem with this approach can be a loss of readability. In this case, the original ACL is much easier to read and understand than the redesigned version. The sec- ond, more efficient ACL has an entry for web2 in the middle of all the entries for web1. This is easy to miss, and can make troubleshooting harder. Only you, as the administrator, can make the call as to the benefits or drawbacks of the current ACL design. In smaller ACLs, you may want to make some concessions to readability, but in the case of a 17-page access list, you'll find that putting the heavily hit lines at the top will have a significant impact on the 