e much more readable: access-group Inbound in interface outside The ability to quickly determine what a device is configured to do can save time dur- ing an outage, which can literally save your job. I like to begin my access list names with capital letters to aid in identifying them in code. This is a personal preference that may or may not suit your style-I've worked with people who complain when they have to use the Shift key. Top-Down Processing Access lists are processed from the top down, one line at a time. When a match is made, processing stops. This is an important rule to remember when building and troubleshooting access lists. A common mistake is to add a specific line to match something that's already been matched in a less-specific line above it: access-list 101 permit tcp any 10.10.10.0 0.0.0.255 eq WWW access-list 101 permit tcp any host 10.10.10.100 eq WWW access-list 101 permit tcp any host 10.10.10.100 eq domain Chapter 23: Access Lists In this example, the second line will never be matched because the IP address and protocol are matched in the first line. Even so, in the event that the first line doesn't match, the second line will still be evaluated, wasting time and processing power. This is a very commonly seen problem in enterprise networks. On larger firewalls, where more than one person is administering the device, the problem can be severe. It may also be hard to spot because it doesn't prevent protocols from working. This type of problem is usually uncovered during a network audit. Most-Used on Top Access lists should be built in such a way that the lines that are matched the most are at the beginning of the list. Recall that an ACL is processed until a match is made. Once a match is made, the remainder of the ACL is not processed. If you've only worked on routers with small ACLs, this may not seem like a big deal, but in real- world enterprise firewalls, ACLs can be extensive. (I've worked on PIX firewalls where the ACLs were up to 17 printed pages long!) Here's an actual example from 