s, where more than one person is administering the device, the problem can be severe. It may also be hard to spot, because it doesn't prevent protocols from working. This type of problem is usually uncovered during a network audit. Most-Used on Top Access lists should be built in such a way that the lines that are matched the most are at the beginning of the list. Recall that an ACL is processed until a match is made. Once a match is made, the remainder of the ACL is not processed. If you've only worked on routers with small ACLs, this may not seem like a big deal, but in real-world enterprise firewalls, ACLs can be extensive. I've worked on firewalls where there were over 50,000 rules in place. How many of those entries do you suppose were valid? Designing Access Lists Here's an actual example from a PIX firewall. When my team built this small access list, we just added each line as we thought of it. This is a relatively common approach in the real world. We came up with a list of servers (web1, lab, web2), then listed each protocol to be allowed: access-list Inbound permit tcp any host web1.gad.net eq WWW access-list Inbound permit tcp any host web1.gad.net eq ssh access-list Inbound permit udp any host web1.gad.net eq domain access-list Inbound permit tcp any host web1.gad.net eq smtp access-list Inbound permit tcp any host web1.gad.net eq imap4 access-list Inbound permit tcp any host lab.gad.net eq telnet access-list Inbound permit tcp any host lab.gad.net eq 8080 access-list Inbound permit udp any host web2.gad.net eq domain access-list Inbound permit tcp any host web2.gad.net eq smtp access-list Inbound permit tcp any host web2.gad.net eq imap4 After letting the network run for a few days, we were able to see how our access list had fared by executing the show access-list command: PIX#sho access-list access-list cached ACL log flows: total 0, denied 0 (deny-flow-max 1024) alert-interval 300 access-list Inbound; 15 elements access-list Inbound permit tcp any host web1.gad.net eq WWW (hitcnt=42942) access-lis