CCNA2 TEL III CHAPTER 7

CCNA2 TEL III CHAPTER 7

1. What is an ACL?

   • An ACL is a series of IOS commands that control whether a router forwards or drops packets based on information found in the packet header. ACLs are among the most commonly used features of Cisco IOS software.
     • Packet Filtering
       • An ACL is a sequential list of permit or deny statements, known as access control entries (ACEs). ACEs are also commonly called ACL statements. When network traffic passes through an interface configured with an ACL, the router compares the information within the packet against each ACE, in sequential order, to determine if the packet matches one of the ACEs. This process is called packet filtering.

2. ACL Operation

   • ACLs define the set of rules that give added control for packets that enter inbound interfaces, packets that relay through the router, and packets that exit outbound interfaces of the router. ACLs do not act on packets that originate from the router itself.

3. Introducing ACL Wildcard Masking

   • IPv4 ACEs include the use of wildcard masks. A wildcard mask is a string of 32 binary digits used by the router to determine which bits of the address to examine for a match. As with subnet masks, the numbers 1 and 0 in the wildcard mask identify how to treat the corresponding IPv4 address bits. However, in a wildcard mask, these bits are used for different purposes and follow different rules.

4. Calculating the Wildcard Mask

   • Calculating wildcard masks can be challenging. One shortcut method is to subtract the subnet mask from 255.255.255.255.

5. Wildcard Mask Keywords

   • Working with decimal representations of binary wildcard mask bits can be tedious. To simplify this task, the keywords host and any help identify the most common uses of wildcard masking. These keywords eliminate entering wildcard masks when identifying a specific host or an entire network. These keywords also make it easier to read an ACL by providing visual clues as to the source or destination of the criteria. The host keyword substitutes for the 0.0.0.0 mask. This mask states that all IPv4 address bits must match to filter just one host address. The any option substitutes for the IPv4 address and 255.255.255.255 mask. This mask says to ignore the entire IPv4 address or to accept any addresses

6. Wildcard Mask Keyword Examples

7. General Guidelines for Creating ACLs

   • Writing ACLs can be a complex task. For every interface there may be multiple policies needed to manage the type of traffic allowed to enter or exit that interface. The router in the figure has two interfaces configured for IPv4 and IPv6. If we needed ACLs for both protocols, on both interfaces and in both directions, this would require eight separate ACLs. Each interface would have four ACLs; two ACLs for IPv4 and two ACLs for IPv6. For each protocol, one ACL is for inbound traffic and one for outbound traffic.

8. ACL Best Practices

9. Where to Place ACLs

10. Standard ACL Placement

11. Numbered Standard IPv4 ACL Syntax

12. Applying Standard IPv4 ACLs to Interfaces

13. Numbered Standard IPv4 ACL Examples

14. Named Standard IPv4 ACL Syntax

15. Method 1 - Use a Text Editor

    • Method 2 - Use Sequence Numbers
      • Editing Standard Named ACLs

16. Verifying ACLs

17. ACL Statistics

18. The access-class Command

19. Verifying the VTY Port is Secured

20. The Implicit Deny Any

21. The Order of ACEs in an ACL

22. Cisco IOS Reorders Standard ACLs

23. Routing Processes and ACLs

24. FTP Denied

    • FTP Denied Scenario It was recently reported that viruses are on the rise within your small- to medium-sized business network. Your network administrator has been tracking network performance and has determined that one particular host is constantly downloading files from a remote FTP server. This host just may be the virus source perpetuating throughout the network! Use Packet Tracer to complete this activity. Write a named ACL to deny the host access to the FTP server. Apply the ACL to the most effective interface on the router. To complete the physical topology, you must use: One PC host station Two switches One Cisco 1941 series Integrated Services Router One server Using the Packet Tracer text tool, record the ACL you prepared. Validate that the ACL works to deny access to the FTP server by trying to access the FTP server’s address. Observe what happens while in simulation mode.

25. Summary

    • By default a router does not filter traffic. Traffic that enters the router is routed solely based on information within the routing table. Packet filtering controls access to a network by analyzing the incoming and outgoing packets and passing or dropping them based on criteria such as the source IP address, destination IP addresses, and the protocol carried within the packet. A packet-filtering router uses rules to determine whether to permit or deny traffic. A router can also perform packet filtering at Layer 4, the transport layer. An ACL is a sequential list of permit or deny statements. The last statement of an ACL is always an implicit deny which blocks all traffic. To prevent the implied deny any statement at the end of the ACL from blocking all traffic, the permit any statement can be added. When network traffic passes through an interface configured with an ACL, the router compares the information within the packet against each entry, in sequential order, to determine whet

Bilder und Dateien der Mindmap