網路原理(一) RSE6 Section 7.1

Access list (ACL)
存取控制串列（Access Control List，ACL），又稱訪問控制表，是使用以存取控制矩陣為基礎的存取控制表，每一個（檔案系統內的）物件對應一個串列主體。 存取控制串列描述用戶或系統行程對每個物件的存取控制權限。

Packet filtering
Packet filtering controls access to a network by analyzing the incoming and outgoing packets and forwarding them or discarding them based on given criteria. 

Access control entries (ACEs)
An ACL is a sequential list of permit or deny statements, known as access control entries (ACEs).

Standard ACLs
Standard ACLs only filter at Layer 3.

Extended ACLs
Extended ACLs filter at Layer 3 and Layer 4. 

Inbound ACLs
Incoming packets are processed before they are routed to the outbound interface. An inbound ACL is efficient because it saves the overhead of routing lookups if the packet is discarded. 

Outbound ACLs
Incoming packets are routed to the outbound interface, and then they are processed through the outbound ACL. 

Wildcard masking
IPv4 ACEs include the use of wildcard masks. A wildcard mask is a string of 32 binary digits used by the router to determine which bits of the address to examine for a match. 

Wildcard mask bit 0
Match the corresponding bit value in the address. 

Wildcard mask bit 1
Ignore the corresponding bit value in the address.

====以下command=====

access-list

access-list-number

permit ip_address wildcard_mask

host

any