a PIX firewall. When my team built this small access list, we just added each line as we thought of it. This is a relatively common approach in the real world. We came up with a list of servers (web1, lab, web2), then listed each protocol to be allowed: access-list Inbound permit tcp any host web1.gad.net eq WWW access-list Inbound permit tcp any host web1.gad.net eq ssh access-list Inbound permit udp any host web1.gad.net eq domain access-list Inbound permit tcp any host web1.gad.net eq smtp access-list Inbound permit tcp any host web1.gad.net eq imap4 access-list Inbound permit tcp any host lab.gad.net eq telnet access-list Inbound permit tcp any host lab.gad.net eq 8080 access-list Inbound permit udp any host web2.gad.net eq domain access-list Inbound permit tcp any host web2.gad.net eq smtp access-list Inbound permit tcp any host web2.gad.net eq imap4 After letting the network run for a few days, we were able to see how our access list had fared by executing the show access-list command: PIX# sho access-list access-list cached ACL log flows: total 0, denied 0 (deny-flow-max 1024) alert-interval 300 access-list Inbound; 15 elements access-list Inbound permit tcp any host web1.gad.net eq WWW (hitcnt=42942) access-list Inbound permit tcp any host web1.gad.net eq ssh (hitcnt=162) access-list Inbound permit udp any host web1.gad.net eq domain (hitcnt=22600) access-list Inbound permit tcp any host web1.gad.net eq smtp (hitcnt=4308) access-list Inbound permit tcp any host web1.gad.net eq imap4 (hitcnt=100) access-list Inbound permit tcp any host lab.gad.net eq telnet (hitcnt=0) Designing Access Lists access-list Inbound permit tcp any host lab.gad.net eq 8080 (hitcnt=1) access-list Inbound permit udp any host web2.gad.net eq domain (hitcnt=10029) access-list Inbound permit tcp any host web2.gad.net eq smtp (hitcnt=2) access-list Inbound permit tcp any host web2.gad.net eq imap4 (hitcnt=0) Look carefully at the hitcnt entries at the ends of the lines. They show how many times each of the lines in the ACL has been hit