CCNA 3 - Capitulo 5

CCNA 3 - Capitulo 5

1. ACLs FOR IPV4 CONFIGURATION

   • CONFIGURE STANDARD IPV4 - ACLs
     • NUMBERED STANDARD IPV4
       • EXAMPLE STANDARD IPv4 ACL
         • 1 - REMARK
           • R1(CONFIG)# ACCESS-LIST 10 REMARK ACE PERMITS ONLY HOSTS 192.168.10.10 TO THE INTERNET
         • 2 - HOST SPECIFIC NETWORK OR RANGE
           • R1(CONFIG)# ACCESS-LIST 10 PERMIT HOST 192.168.10.10
           • R1(CONFIG)# ACCESS-LIST 10 PERMIT 192.168.20.0 0.0.0.255
         • 3 - APPLY ACL 10 OUTBOUND ON SERIAL 0/1/0 INTERFACE
           • R1(CONFIG)# INTERFACE SERIAL 0/1/0
           • R1(CONFIG-IF)# IP ACCESS-GROUP 10 OUT
         • 4 - HOW DO I VIEW THE SETTINGS?
           • R1# SHOW RUN | SECTION ACCESS-LIST
           • R1# SHOW IP INT SERIAL 0/1/0 | INCLUDE ACCESS LIST
       • NUMBER STANDARD IPv4 ACL SYNTAX
         • R1(CONFIG)#ACCESS-LIST ACCESS-LIST NUMBER { DENY | PERMIT | REMARK TEXT } SOURCE [SOURCE-WILDCARD] [LOG]
           • NOTE : COMMAND NO ACCESS LIST REMOVE A ACL
           • ACCESS-LIST NUMBER
             • DECIMAL NUMBER OF ACL
             • RANGE STANDARD IS 1 TO 99 OR 1300 TO 1999
           • DENY
             • DENIS IF CONDITION IS MATCHED
           • PERMIT
             • PERMIT IF CONDITION IS MATCHED
           • REMARK TEXT
             • DOCUMENTATION PURPOSES
               • OPTIONAL ; 100 CHARACTERS
             • SHOW ACCESS-LISTS DOES NOT DISPLAY
           • SOURCE
             • IDENTIFIES THE SOURCE NETWORK OR HOST TO FILTER
               • ANY KEYWORD - ALL NETWORKS
               • HOST KEYWORD SPECIFIC IP ADDRESS
           • SOURCE WILDCARD
             • OPTIONAL 32-bit WILDCARD APPLIED TO THE SOURCE
             • IS OMITTED , A DEFAULT 0.0.0.0 IS ASSUMED
           • LOG
             • OPTIONAL ; SENDS AN INFORMATIONAL MESSADE IF ACE IS MATCHED
             • ONLY BE IMPLEMENTED FOR TSHOOT OR SECURITY REASONS
             • GENERATED FOR THE FIRST MATHED PACKET
     • NAMED STANDARD IPV4
       • NAMED STANDARD IPv4 ACL SYNTAX
         • R1(CONFIG)#IP ACCESS-LIST STANDARD PERMIT-ACCESS ACCESS-LIST NAME
           • ENTRY CONFIGURATION MODE , YOUR CAN CONFIGURE THE ACL ACEs R1(CONFIG-STD-NACL)#
       • EXAMPLE STANDARD IPv4 ACL
         • 1 - REMARK
           • R1(CONFIG-STD-NACL)#REMARK ACE PERMITS HOSTS 192.168.10.10
           • R1(CONFIG)# IP ACCESS-LIST STANDARD PERMIT-ACCESS
         • 2 - HOST SPECIFIC NETWORK OR RANGE
           • R1(CONFIG-STD-NACL)#PERMIT HOST 192.168.10.0
             • ONLY HOST 192.168.10.10 IS PERMITTING
           • R1(CONFIG-STD-NACL)# PERMIT 192.168.20.0 0.0.0.255
             • ALL HOSTS LAN 20 IS PERMITTED
         • 3 - APPLY ACL 10 OUTBOUND ON SERIAL 0/1/0 INTERFACE
           • R1(CONFIG)#INTERFACE SERIAL 0/1/0
           • R1(CONFIG)# IP ACCESS-GROUP PERMIT-ACCESS OUT
         • 4 - HOW DO I VIEW THE SETTINGS?
           • R1# SHOW RUN | SECTION ACCESS-LIST
           • R1# SHOW IP INT SERIAL 0/1/0 | INCLUDE ACCESS LIST
       • NOTE : COMMAND NO IP ACCESS LIST REMOVE A ACL NAMED
     • HOW TO CREATE AN ACL ?
       • SUGGESTED CONFUGURING ACL
         • USE TEXT EDITOR AND WRITE
           • POLICY TO BE IMPLEMENTED
         • ADD THE IOS CONFIGURATION COMMANDS
           • ACCOMPLISH TASKS
         • INCLUDE REMARKS
           • DOCUMENT THE ACL
         • COPY AND PAST
           • COMMANDS ON THE DEVICE
         • ALWAYS THROUGLY TEST AN
           • ACL ENSURE CORRETLY APPLIES
       • NOTE : ACL MUST BE PLANNED
     • ARE CASE SENSITIVE
     • HOW TO APPLY A STANDARD IPv4 ACL ?
       • AFTER STANDARD ACL IS CREATED , IT MUST BE LINKED INTERFACE OR FEATURE
       • R1(CONFIG-IF)#IP ACCESS-GROUP {ACCESS-LIST-NUMBER} | ACCESS-LIST-NAME} {IN | OUT}
         • NOTE : USE NO IP ACCESS-GROUP IN INTERFACE CONFIGURATION AND NO ACCESS-LIST GLOBAL MDE