I'm puzzled because I can ssh into this router from 192.168.1.10, but not from 192.168.30.3 (as per acl 6). No interface mentions any of these access lists so am I correct in assuming these are global access lists, applied to all interfaces?
If so, in what order?
Are there several deny in the list that render certain rules useless or one single deny any any at the very end?
if I make a an access-list 3 permit any , will that allow me to ssh into this router from anywhere within the 192.168.0.0 network?
What would happen if I specified a specific ACL for one of the interfaces? would the remaining rules still apply?
Here is the sanitized output of show access-list:
Standard IP access list 5
10 permit 144.1.1.1 (10000 matches)
20 permit 155.1.1.1 (10000 matches)
40 deny any (100000 matches)
Standard IP access list 6
10 permit 192.168.0.0, wildcard bits 0.0.255.255 (100000 matches)
20 deny any (10 matches)
Standard IP access list 7
10 permit 192.168.1.0, wildcard bits 0.0.0.255
Extended IP access list 122
10 permit ip host 5.5.5.5 any
20 permit ip host 6.6.6.6 any
70 deny ip any any log (1000 matches)
Extended IP access list snooplion1_acl
10 permit ip 4.2.1.0 0.0.0.7 10.1.1.0 0.0.0.255 log (1000 matches)
20 permit ip 4.2.1.0 0.0.0.7 10.1.2.0 0.0.0.255 log
Extended IP access list snooplion2_acl
10 permit ip host 4.2.1.2 host 4.4.1.1 log (100000 matches)
20 permit ip host 4.2.1.3 host 4.4.1.1 log (100000 matches)
Extended IP access list snooplion3_acl
10 permit ip 4.2.1.0 0.0.0.7 host 4.4.4.4 log (100000 matches)
Extended IP access list snooplion4_acl
10 permit ip 4.2.1.0 0.0.0.7 192.168.2.0 0.0.0.255 log (100000 matches)
20 permit ip 4.2.1.0 0.0.0.7 192.168.3.0 0.0.0.255 log (100000 matches)
Extended IP access list snooplion5_acl
10 permit ip 4.2.1.0 0.0.0.7 4.3.3.80 0.0.0.15 log
Extended IP access list snooplion6_acl
10 permit ip 4.2.1.0 0.0.0.7 4.3.3.80 0.0.0.15 log (10 matches)
If no interface (or vty) mentions these ACL's then they are not applied. There's no such thing as a globally applied ACL in IOS - particularly given that an ACL can mean very different things in different contexts (i.e. route-maps, QoS and packet filtering can all use the same structure).