ACL review

Guide to NAT

• ip default-gateway 10.100.200.1
• ip route 0.0.0.0 0.0.0.0 10.100.200.1
• domain-name baist.ca
• ip access-list extended NAT
• permit ip 10.0.2.0 0.0.0.255 any
• ip nat pool NatPool 10.100.201.2 10.100.201.2 prefix-length 23
• ip nat inside source list NAT pool NatPool overload
• int fa0/1
• ip address 10.100.201.2 255.255.254.0
• ip nat outside
• int fa0/0
• ip address 10.0.2.1 255.255.255.0
• ip nat inside

Reflexive ACLs

• ip access-list extended Inside2Internet
• permit tcp any any eq www relect web_traffic
• permit tcp any any eq 443 reflect web_traffic
• permit udp any any eq domain reflect web_traffic
• permit tcp any any range ftp-data ftp reflect ftp_traffic
• permit icmp any any echo reflect icmp_traffic
• ip access-list extended Internet2Inside
• evaluate web_traffic
• evaluate ftp_traffic
• evaluate icmp_traffic
• deny tcp any host x.x.x.x
• interface Fa0/1
• ip access-group Internet2Inside in
• ip access-group Inside2Internet out

Specific ACLs

• time-range DenyInternetSales
• periodic daily 8:00 to 16:00
• ip access-list extended InsideAccess
• deny tcp 10.0.2.16 0.0.0.15 any eq www time-range DenyInternetSales
• deny tcp 10.0.2.16 0.0.0.15 any eq 443 time-range DenyInternetSales
• deny tcp 10.0.2.80 0.0.0.15 any eq www time-range DenyInternetSales
• deny tcp 10.0.2.80 0.0.0.15 any eq 443 time-range DenyInternetSales
• permit ip any any