ccess lists, but dialer maps do not. ASA and PIX firewalls only support named access lists. That is, even if you create an access list named 10 on an ASA, it will be considered a named access list rather than a standard (numbered) access list. Nexus switches do not support numbered access lists. Chapter 25: Access Lists When you name access lists, it makes sense to name them well. I've seen many instal- lations of PIX firewalls where the inbound access list is named something like "out." Imagine troubleshooting this command: access-group out in interface outside If you're not used to configuring ASA or PIX firewalls, that command might be difficult to interpret. If the access list were instead named "Inbound," the command would be much more readable: access-group Inbound in interface outside The ability to quickly determine what a device is configured to do can save time during an outage, which can literally save your job. I like to begin my access list names with capital letters to help identify them in code. This is a personal preference that may or may not suit your style-I've worked with people who complain when they have to use the Shift key when typing. Top-Down Processing Access lists are processed from the top down, one line at a time. When a match is made, processing stops. This is an important rule to remember when building and trouble- shooting access lists. A common mistake is to add a specific line to match something that's already been matched in a less specific line above it. Let's look at an example from a 3750 switch: ip access-list extended GAD permit tcp any 10.10.10.0 0.0.0.255 eq WWW permit tcp any host 10.10.10.100 eq WWW permit tcp any host 10.10.10.100 eq domain In this example, the second permit line will never be matched, because the IP address and protocol are matched in the previous line. Even so, in the event that the first doesn't match, the second line will still be evaluated, wasting time and processing power. This is a very common problem in enterprise networks. On larger firewall