Content

| 6.2 |  | Troubleshooting Transport Layer Issues on the Router |
| 6.2.3 |  | Optimizing access list operation |

Routers handling a lot of traffic and multiple access lists can introduce significant latency into network communications. In order to minimize the impact that access lists have on network latency, network engineers should optimize existing access lists. The concept is quite simple, although the actual implementation can be a little more complex.

Using the show ip access-list command, network administrators can gather information on which access list elements are being heavily used and which ones are not. Using this information, they can then re-write the access list such that the most heavily used elements are nearest the top. Figures and show this process for a simple access list.

While this can be achieved fairly easily in simple access lists, using the approach on more complex access lists can be a bit more difficult. Consider an access list which must permit hosts 1-5 and 7-20 access to remote web servers, but block access to that remote service for hosts 6 and 21-31. Obviously, changing the order of the access list elements in this access list without regard to the overall reason of the order would ‘break’ the access list.

In order to optimize complex access lists, the network administrator must identify groups of access list elements by purpose or intention. These groups can then be ordered such that the most heavily-used group of elements is nearest the top.