t Inbound permit tcp any host web1.gad.net eq ssh (hitcnt=162) access-list Inbound permit udp any host web1.gad.net eq domain (hitcnt=22600) access-list Inbound permit tcp any host web1.gad.net eq smtp (hitcnt=4308) access-list Inbound permit tcp any host web1.gad.net eq imap4 (hitcnt=100) access-list Inbound permit tcp any host lab.gad.net eq telnet (hitcnt=0) access-list Inbound permit tcp any host lab.gad.net eq 8080 (hitcnt=1) access-list Inbound permit udp any host web2.gad.net eq domain (hitcnt=10029) access-list Inbound permit tcp any host web2.gad.net eq smtp (hitcnt=2) access-list Inbound permit tcp any host web2.gad.net eq imap4 (hitcnt=0) Look carefully at the hitcnt entries at the ends of the lines. They show how many times each line in the ACL has been hit. The hit counts indicate that this ACL was not built optimally. To build it better, take the preceding output and sort it by hitcnt, with the largest number first. The results look like this: access-list Inbound permit tcp any host web1.gad.net eq WWW (hitcnt=42942) access-list Inbound permit udp any host web1.gad.net eq domain (hitcnt=22600) access-list Inbound permit udp any host web2.gad.net eq domain (hitcnt=10029) access-list Inbound permit tcp any host web1.gad.net eq smtp (hitcnt=4308) access-list Inbound permit tcp any host web1.gad.net eq ssh (hitcnt=162) access-list Inbound permit tcp any host web1.gad.net eq imap4 (hitcnt=100) access-list Inbound permit tcp any host web2.gad.net eq smtp (hitcnt=2) access-list Inbound permit tcp any host lab.gad.net eq 8080 (hitcnt=1) access-list Inbound permit tcp any host lab.gad.net eq telnet (hitcnt=0) access-list Inbound permit tcp any host web2.gad.net eq imap4 (hitcnt=0) This is an optimal design for this admittedly small access list. The entries with the most hits are now at the top of the list, and those with the fewest are at the bottom. Chapter 25: Access Lists Beware of assumptions. You may think that SMTP should be high on your list because your firewall is protecting a mail server, but if yo