CCNA 3 - Capitulo 5.1

CCNA 3 - Capitulo 5.1

1. ACLs FOR IPV4 CONFIGURATION

   • MODIFY IPV4 ACLs STANDARD
     • ACL STATISTICS
       • R1# SHOW ACCESS-LISTS
         • STATISTICS FOR EACH STATEMENT THAT HAS BEEN MATCHED
       • NOTES : IMPLIED DANY NOT DISPLAY ANY STATISTICS , TO TRACK HOW MANY IMPLICIT
         • YOU MUST MANUALLY CONFIGURE THE DENY ANY COMMAND AT THE END OF ACL
       • R1#CLEAR THE ACL STATISTICS
         • CLEAR-LIST COUNTERS
     • TWO METHODS TO MODIFY AN ACL
       • TEXT EDITOR
         • IF AN ERROR OCCURS, HOW DO I CORRECT IT?
           • 1. COPY THE ACL FROM THE RUNNING CONFIGURATION AND
             • PAST IT INTO THE TEXT EDITOR.
           • 2. MAKE THE NECESSARY EDITS CHANGES.
           • 3. REMOVE THE PREVIOUSLY CONFIGURED ACL ON THE ROUTER OTHERWISE
             • CAUTION : PASTING THE EDITED ACL COMMANDS WILL ONLY APPEND (I.E., ADD) TO THE EXISTING ACL ACCES ON THE ROUTER.
           • 4. COPY AND PASTE THE EDITED ACL BACK TO THE ROUTER.
       • SEQUENCE NUMBERS
         • ACL ACE CAN ALSO BE DELETED OR ADDED USING THE ACL SEQUENCE NUMBERS
         • SEQUENCE NUMBER ARE AUTOMATICALLY ASSIGNED WHEN AN ACE IS ENTERED
           • THE ORDER OF ACES MATTERS BECAUSE ACCESS CONTROL LISTS ARE PROCESSED TOP-DOWN, AND THE FIRST MATCHING ENTRY DETERMINES THE ACTION TAKEN
         • HOW TO EDIT STANDARD NUMBER ?
           • R1(CONFIG)#IP ACCESS-LIST STANDARD 1
           • R1(CONFIG-STD-NACL)# NO 10
             • MUS BE DELETED FIRST WITH THE
           • R1(CONFIG-STD-NACL)# 10 DENY HOST 192.168.10.10
         • HOW TO EDIT STANDARD NAMED ?
           • R1(CONFIG)#IP ACCESS-LIST STANDARD NO-ACCESS
           • R1(CONFIG-STD-NACL)# 15 DENY 192.168.10.5
   • SECURE VTY PORTS WITH A STANDARD IPV4 ACL
     • TWO STEPS TO SECURE REMOTE ADMINISTRATIVE ACCES VTY LINES
       • 1. CREATE AN ACL TO IDENTIFY WHICH HOSTS
         • SHOULD BE ALLOWED REMOTE ACCESS
           • FOLLOWING COMMAND APPLY ACL TO THE VLY LINES ?
             • R1(CONFIG-LINE)# ACCES-CLASS { ACCESS-LIST-NUMBER | ACCESS-LIST-NAME } {IN | OUT }
               • IN - DEFAULT USED
                 • FILTER INCOMIMG VTY TRAFFIC
               • OUT - RARELY APPLIED
                 • FILTER OUTGOING VTY TRAFFIC
       • 2. APPLY THE ACL
         • INCOMING TRAFFIC THE VTY LINES
     • IDENTICAL RESTRICTIONS
       • ALL THE VTY LINES
     • SECURE VY Y- ACCESS EXAMPLE
       • 2 ) DEFINED PARAMETERS ACL VTY
         • R1(CONFIG-STD-NACL)#PERMIT 192.168.10.0
         • R1(CONFIG-STD-NACL)#DENY ANY
       • 1) CREATE USERNAME , ACL STANDARD AND REMARK
         • R1(CONFIG)#IP ACCESS-LIST STANDARD ADMIN-HOST
         • R1(CONFIG-STD-NACL)#REMARK THIS ACL SECURES INCOMIMG VTY LINES
         • R1(CONFIG)#USERNAME ADMIN SECRET CLASS
       • 3 ) CREATE VTY AND ASSIGN ACL
         • R1(CONFIG)# LINE VTY 0 4
           • R1(CONFIG-LINE)ACCESS-CLASS ADMIN-HOST IN
           • R1(CONFIG-LINE)#LOGIN LOCAL
           • R1(CONFIG-LINE)#TRANSPORT INPUT SSH
     • BY DEFAULT ACL FILTER INCOMIMG OR OUTGONG TRAFFIC ON AN INTERFACE
       • HOWEVER , AN ACL CAN ALSO BE USED TO SECURE REMOTE ADMINISTRATIVE ACCESS USING VTY LINES
     • BOTH NAMED AND NUMEBERED CAN BE APPLIED TO VTY LINES