Patent ID: 8040895

Claim:
A method comprising: looking up a forwarding information base (FIB) for a direction dependent path related to an access control entry (ACE) in an access control list (ACL), wherein, if the ACL is an ingress ACL, the direction dependent path is a reverse path to a source network, and wherein, if the ACL is an egress ACL, the direction dependent path is a reverse path to a destination network; if the ACL is an ingress ACL: identifying the ACE as a candidate for removal from the ACL if the reverse path to the source network does not exist, if the reverse path to the source network exists, identifying the ACE as a candidate for removal if a destination address is not specified in the ACE, and if the reverse path to the source network exists and the destination address is specified in the ACE, looking up the FIB for a forward path to a destination network corresponding to the destination address specified in the ACE, and identifying the ACE as a candidate for removal from the ACL if the forward path to the destination network does not exist; if the ACL is an egress ACL: identifying the ACE as a candidate for removal from the ACL if the reverse path to the destination network does not exist, if the reverse path to the destination network exists, identifying the ACE as a candidate for removal if a source address is not specified in the ACE, and if the reverse path to the destination network exists and the source address is specified in the ACE, looking up the FIB for a forward path to the source network corresponding to the source address specified in the ACE, and identifying the ACE as a candidate for removal from the ACL if the forward path to the source network does not exist; and if the ACE is identified as a candidate for removal, generating, for presentation to a user, a warning message that describes the ACE and enables the user to approve removal of the ACE.