Flashcards
ACL's
Cards in this deck (51)
- 1T or F: ACL's are Permit or Deny statements that allow the router to filter trafficTrue
- 2ACL Types: IP Standard Access List =?0-99
- 3ACL Types: IP Extended Access List =?100-199
- 4ACL Types: IP Standard Access List, Expanded Range =?1300-1999
- 5ACL Types: IP Extended Access List, Expanded Range =?2000 - 2699
- 6Which ACL type can filter by specified protocol type or port numbers?Extended IP Access List
- 7What are the main 4 rules when creating access lists?1) ACL must be created in global config mode
2) ACL's are read from top to bottom [implicit deny at the bottom]
3) ACL's are applied to interface or line
4) There can only be 1 ACL per direction, per protocol, per interface - 8T or F: ACL's must have at least one permit statement due to the implicit denyTRUE
- 9In what mode is the ACL's applied?in the specific mode
(applied to the interface or line) - 10What are ACL's called when applied to interfaces and what 2 sides are there?called groups
and
either incoming or outgoing from the routers point of view
EX:
router(config-if)# ip access-group 100 in - 11What are ACL's called when applied to VTY lines?class
ex:
router(config-line)# ip access-class 100 in - 12T or F: multiple ACL's for interfaces are only allowed for differing protocols. other wise there can only be one ACL per direction, per protocol, per interface. meaning only one inbound and outbound IP ACL on an interfaceTrue
- 13What is the proper syntax for creating an ACL in global config?access-list # action SIP WC log
example
access-list 1 permit 30.0.0.0 0.255.255.255 - 14What are the 2 approaches when creating ACL's?Black list- deny list (then Permit)
White list= permit everything - 15This is used to determine which bits in the IPV4 addresses used in the ACL are significantWildcard masks
- 16True or false: the 0's in the wild card mask are significant and the 1's are deemed insignificant.True
- 17Wildcard mask: what does this identify? 192.168.10.1 0.0.0.0a single IP address
- 18Wildcard mask: what does this identify? 192.168.10.1 0.0.0.255identifies an entire class
- 19Wildcard mask: what does this identify? host 192.168.10.1single ip address
- 20Wildcard mask: what does this identify? any255.255.255.255
all ip addresses - 21This type of ACL filters solely by the packet's source address information.IP Standard ACL
access-list 1 deny 200.0.0.0 0.0.0.63 log
access-list 1 permit any - 22What is the syntax for an Extended ACL?Access-list 100 [action] [protocol] [sip/netID] [qualifier] [tip/netid] [qualifier]
- 23T or F: The main purpose to use an extended ACL is to permit or deny L3 and L4 protocols.YUP!
- 24As a general rule, standard ACL's should be placed closest to the ______destination
(inbound for efficiency) - 25As a general rule, extended ACL's should be placed closest to the ______source
- 26Name some qualifiers you can use in extended ACL'seq
neq
range
lt
gt - 27This allows you to reference an ACL by a descriptive name instead of by number while also providing a convenient way to build lists.Name ACL
(NACL) - 28What is the proper syntax to create a NACL?ip access-list [standard | extended] name
- 29T or F: In NACL's Names cannot contain spaces or punctuation and must begin with an alphabetic character.True
- 30Wildcard Mask method 1 =?true broadcast - mask used
255.255.255.255
-255.255.255.192
-----------------------------
0.0.0.63 - 31Wildcard Mask method 2 =?net B/C - Net ID
200.100.50.127
-200.100.50.64
---------------------------
0.0.0.63 - 32Wildcard Mask method 3 =?block size - 1
200.100.50.0 /26
block size = 64 in 4th octet (64-1=63)
0.0.0.63 - 33For efficiency, access list should be applied going in which direction whenever possible?inbound
- 34What are access list referred to as when applying to the VTY line?access-class
- 35What is the loopback address range with CIDR?127.0.0.1/8
127.255.255.254/8 - 36this is used to filter inbound traffic while allowing return TCP sessions by looking for ACK or RST bits.Established Line
- 37What is the primary reason for using the established line?to prevent a syn attack
- 38What is the syntax for an established line?access-list 100 permit tcp any any established
- 39T or F: Active FTP cannot use the established line because of the way it communicates.True
- 40this type of ACL allows packets to be filtered based on upper-layered session information.Reflective ACL
- 41T or F: Reflective ACL's can only be utilized with extended IP ACL's and must be named.True
- 42Are reflective ACL's dynamically created.True
- 43What do reflective ACL's keep track of as trusted hosts go out?SIP & TIP
and
SPORT & TPORT - 44Reflective ACL's ________outbound traffic and _______ inbound trafficreflect outbound
evaluate inbound - 45reflective entries will expire after how many seconds?300 seconds
- 46Global time out (GTV) affects which 4 protocols?IP
ICMP
UDP
TCP - 47Which protocol in reflective ACL's has additional measures to clear the dynamically created ACL and what are they?TCP
2 Fin
1 RST (reset) - 48T or F: reflective ACL's do not work with certain applications where port numbers change during the session.True
EX:
Active FTP (unless passive is used) - 49What is the syntax to create handstamper?ip access-list extended handtamper
permit ip any any reflect clipboard - 50What syntax is used to create Bouncer?ip access-list extended bouncer
evaluate clipboard - 51What statement must be placed to allow ICMP (ping) from a hypertext terminal when reflective ACL's are implemented?permit icmp any any echo-reply
Information
- Description
- college Enterprise Networking (Access Control Lists) Flashcards on ACL's, created by jeriel.juarbe2031 on 17/09/2014.
- Created by
- jeriel.juarbe2031
- Views
- 23
- Rating