🚀 go-pugleaf

I have been trying to understand the appletalk distribute-list command on a
router running 8.3(3). I thought I had it worked out but...

The router has 6 ports. I set up an access-list 601
access-list 601 permit 205
access-list 601 permit 206
access-list 601 permit 210
access-list 601 permit 211
...
access-list 601 permit 229
access-list 601 permit 230
and have set up some of the interface
!
interface Ethernet 2
ip address 130.216.33.1 255.255.255.0
ip broadcast-address 130.216.33.255
appletalk cable-range 205-205 205.84
appletalk zone CS-GRAD-2
appletalk distribute-list 601 out
!
interface Ethernet 3
ip address 130.216.34.1 255.255.255.0
ip broadcast-address 130.216.34.255
appletalk cable-range 200-200 200.168
appletalk zone CS-Staff
!
interface Ethernet 4
ip address 130.216.35.1 255.255.255.0
ip broadcast-address 130.216.35.255
appletalk cable-range 210-210 210.36
appletalk zone CS.UGL_1
appletalk distribute-list 601 out
!
interface 2 has net 206 off of it via a KFP IV running 8.01 software
interface 3 has net 201 off of it via a KFP IV running 8.01 software
interface 4 has nets 211 - 229 (with some gaps) connected again through KFP IV's.

I believed I should be able to see from interface 3 CS-Staff into CS.UGL_1 and
into CS-GRAD-2 but not the other way.
This is almost true. I can't see CS-Staff from CS.UGL_1 or CS-GRAD-2. I can
see the directly connected Mac's on CS.UGL_1 and CS-GRAD-2 but not the ones
connected to it via the KFP IV's.

Is this what I should expect? I had hoped to be able to see all of the
CS.UGL_1 and CS-GRAD-2 zones from CS-Staff.

If I add
access-list 601 permit 200
then I can see all of the CS.UGL_1 and CS-GRAD-2 zones from CS-Staff, but they
can also see CS-Staff.
-- 

Rob Burrowes                   rob@cs.aukuni.ac.nz.
System Admin
Computer Science Dept., Auckland University, Private Bag, Auckland, New Zealand