GoConqr has a new look! Let us know what you think.

Sign up free

Flashcards

E2_9 ACL

John Dedios CCNA CCNA Spanish 88 cards

E2_9 ACL

Cards in this deck (88)

  1. 1An ACL is a series of IOS commands that control whether a router forwards or drops packets based on information found in the packet header. In addition to either permitting or denying traffic, ACLs can be used for selecting types of traffic to be analyzed, forwarded, or processed in other ways. For example, ACLs can be used to classify traffic to enable priority processing.An ACL is a series of IOS commands that control whether a router forwards or drops packets based on information found in the packet heade...
  2. 2When configured, ACLs perform the following tasks: 1. Limit network traffic to increase network performance. For example, if corporate policy does not allow video traffic on the network, ACLs that block video traffic could be configured and applied. This would greatly reduce the network load and increase network performance. 2. Provide traffic flow control. ACLs can restrict the delivery of routing updates. If updates are not required because of network conditions, bandwidth is preserved.3. Provide a basic level of security for network access. ACLs can allow one host to access a part of the network and prevent another host from accessing the same area.
    4. Filter traffic based on traffic type. For example, an ACL can permit email traffic, but block all Telnet traffic.
    5. Screen hosts to permit or deny access to network services. ACLs can permit or deny a user to access file types, such as FTP or HTTP.
  3. 3TCP Communication When a client requests data from a web server, IP manages the communication between the PC (source) and the server (destination). TCP manages the communication between the web browser (application) and the network server software. When you send an email, look at a webpage, or download a file, TCP is responsible for breaking data down into segments for IP before they are sent. TCP also manages assembling the data from the segments when they arrive. The TCP process is very much like a conversation in which two nodes on a network agree to pass data between one another.TCP provides a connection-oriented, reliable, byte stream service. Connection-oriented means that the two applications must establish a TCP connection prior to exchanging data.
    TCP is a full-duplex protocol, meaning that each TCP connection supports a pair of byte streams, each stream flowing in one direction.
    TCP includes a flow-control mechanism for each byte stream that allows the receiver to limit how much data the sender can transmit. TCP also implements a congestion-control mechanism.
  4. 4TCP Communication TCP segments are marked with flags that denote their purpose: a SYN starts (synchronizes) the session; an ACK is an acknowledgment that an expected segment was received, and a FIN finishes the session. A SYN/ACK acknowledges that the transfer is synchronized. TCP data segments include the higher level protocol needed to direct the application data to the correct application.TCP Communication TCP segments are marked with flags that denote their purpose: a SYN starts (synchronizes) the session; an ACK is an ack...
  5. 5—
  6. 6—
  7. 7—
  8. 8Packet filtering, sometimes called static packet filtering, controls access to a network by analyzing the incoming and outgoing packets and passing or dropping them based on given criteria, such as the: source IP address, destination IP addresses, and the protocol carried within the packet.To evaluate network traffic, the ACL extracts the following information from the Layer 3 packet header:
    Source IP address
    Destination IP address
    ICMP message type
    The ACL can also extract upper layer information from the Layer 4 header, including:
    TCP/UDP source port
    TCP/UDP destination port
  9. 9An ACL is a sequential list of permit or deny statements, known as access control entries (ACEs). ACEs are also commonly called ACL statements. ACEs can be created to filter traffic based on certain criteria such as: the source address, destination address, the protocol, and port numbers.When network traffic passes through an interface configured with an ACL, the router compares the information within the packet against each ACE, in sequential order, to determine if the packet matches one of the statements. If a match is found, the packet is processed accordingly. In this way, ACLs can be configured to control access to a network or subnet.
  10. 10Packet Filtering Example "Permit web access to users from network A but deny all other services to network A users. Deny HTTP access to users from network B, but permit network B users to have all other access." * If the packet is a TCP SYN from Network A using Port 80, it is allowed to pass. All other access is denied to those users. * If the packet is a TCP SYN from Network B using Port 80, it is blocked. However, all other access is permitted.Packet Filtering Example "Permit web access to users from network A but deny all other services to network A users. Deny HTTP access to u...
  11. 11ACL Operation Inbound ACLs - Incoming packets are processed before they are routed to the outbound interface. An inbound ACL is efficient because it saves the overhead of routing lookups if the packet is discarded. If the packet is permitted by the tests, it is then processed for routing. Inbound *** ACLs are best used to filter packets when the network attached to an inbound interface is the only source of the packets needed to be examined.Outbound ACLs - Incoming packets are routed to the outbound interface, and then they are processed through the outbound ACL.
    *** Outbound ACLs are best used when the same filter will be applied to packets coming from multiple inbound interfaces before exiting the same outbound interface.
  12. 12ACLs define the set of rules that give added control for packets that enter inbound interfaces, packets that relay through the router, and packets that exit outbound interfaces of the router. ACLs do not act on packets that originate from the router itself. ** The last statement of an ACL is always an implicit deny. This statement is automatically inserted at the end of each ACL even though it is not physically present. The implicit deny blocks all traffic. Because of this implicit deny, an ACL that does not have at least one permit statement will block all traffic.ACLs define the set of rules that give added control for packets that enter inbound interfaces, packets that relay through the router, an...
  13. 13Standard ACLs can be used to permit or deny traffic only from source IPv4 addresses. The destination of the packet and the ports involved are not evaluated. The example in Figure 1 allows all traffic from the 192.168.30.0/24 network. Because of the implied "deny any" at the end, all other traffic is blocked with this ACL. Standard ACLs are created in global configuration mode.Standard ACLs can be used to permit or deny traffic only from source IPv4 addresses. The destination of the packet and the ports involved...
  14. 14In Figure 2, ACL 103 permits traffic originating from any address on the 192.168.30.0/24 network to any IPv4 network if the destination host port is 80 (HTTP)In Figure 2, ACL 103 permits traffic originating from any address on the 192.168.30.0/24 network to any IPv4 network if the destination h...
  15. 15—
  16. 16. Wildcard masks use the following rules to match binary 1s and 0s: * Wildcard mask bit 0 - Match the corresponding bit value in the address. * Wildcard mask bit 1 - Ignore the corresponding bit value in the address.. Wildcard masks use the following rules to match binary 1s and 0s: * Wildcard mask bit 0 - Match the corresponding bit value in the addr...
  17. 17In example 1, the first two octets and first four bits of the third octet must match exactly. The last four bits in the third octet and the last octet can be any valid number. This results in a mask that checks for the range of networks 192.168.16.0 to 192.168.31.0.In example 1, the first two octets and first four bits of the third octet must match exactly. The last four bits in the third octet and t...
  18. 18Example 2 shows a wildcard mask that matches the first two octets, and the least significant bit in the third octet. The last octet and the first seven bits in the third octet can be any valid number. The result is a mask that would permit or deny all hosts from odd subnets from the 192.168.0.0 major networkExample 2 shows a wildcard mask that matches the first two octets, and the least significant bit in the third octet. The last octet and t...
  19. 19Calculating the Wildcard Mask Assume you wanted to match only networks 192.168.10.0 and 192.168.11.0. Again, you take the 255.255.255.255 and subtract the regular subnet mask which in this case would be 255.255.254.0. The result is 0.0.1.255.You could accomplish the same result with statements like the two shown below:
    R1(config)# access-list 10 permit 192.168.10.0
    R1(config)# access-list 10 permit 192.168.11.0
    It is far more efficient to configure the wildcard mask in the following way:
    R1(config)# access-list 10 permit 192.168.10.0 0.0.1.255
  20. 20Wildcard Bit Mask Keywords Working with decimal representations of binary wildcard mask bits can be tedious. To simplify this task, the keywords host and any help identify the most common uses of wildcard masking. These keywords eliminate entering wildcard masks when identifying a specific host or an entire network. These keywords also make it easier to read an ACL by providing visual clues as to the source or destination of the criteria.The host keyword substitutes for the 0.0.0.0 mask. This mask states that all IPv4 address bits must match or only one host is matched.
    The any option substitutes for the IP address and 255.255.255.255 mask. This mask says to ignore the entire IPv4 address or to accept any addresses.
  21. 21The host keyword substitutes for the 0.0.0.0 mask. This mask states that all IPv4 address bits must match or only one host is matched. The any option substitutes for the IP address and 255.255.255.255 mask. This mask says to ignore the entire IPv4 address or to accept any addresses.The host keyword substitutes for the 0.0.0.0 mask. This mask states that all IPv4 address bits must match or only one host is matched. Th...
  22. 22—
  23. 23General Guidelines for Creating ACLs ** Note: ACLs do not have to be configured in both directions. Use ACLs in firewall routers positioned between your internal network and an external network such as the Internet. * Use ACLs on a router positioned between two parts of your network to control traffic entering or exiting a specific part of your internal network.* Configure ACLs on border routers, that is, routers situated at the edges of your networks. This provides a very basic buffer from the outside network, or between a less controlled area of your own network and a more sensitive area of your network.
    * Configure ACLs for each network protocol configured on the border router interfaces.
  24. 24General Guidelines for Creating ACLs A general rule for applying ACLs on a router can be recalled by remembering the three Ps. You can configure one ACL per protocol, per direction, per interface: * One ACL per protocol - To control traffic flow on an interface, an ACL must be defined for each protocol enabled on the interface.* One ACL per direction - ACLs control traffic in one direction at a time on an interface. Two separate ACLs must be created to control inbound and outbound traffic.
    * One ACL per interfacec - ACLs control traffic for an interface, for example, GigabitEthernet 0/0.
  25. 25—
  26. 26—
  27. 27Where to Place ACLs The two basic rules are: *** Extended ACLs - Locate extended ACLs as close as possible to the source of the traffic to be filtered. This way, undesirable traffic is denied close to the source network without crossing the network infrastructure. *** Standard ACLs - Because standard ACLs do not specify destination addresses, place them as close to the destination as possible. Placing a standard ACL at the source of the traffic will effectively prevent that traffic from reaching any other networks through the interface where the ACL is applied.Where to Place ACLs The two basic rules are: *** Extended ACLs - Locate extended ACLs as close as possible to the source of the traffic t...
  28. 28Placement of the ACL and therefore the type of ACL used may also depend on: * The extent of the network administrator’s control - Placement of the ACL can depend on whether or not the network administrator has control of both the source and destination networks. * Bandwidth of the networks involved - Filtering unwanted traffic at the source prevents transmission of the traffic before it consumes bandwidth on the path to a destination. This is especially important in low bandwidth networks.* Ease of configuration - If a network administrator wants to deny traffic coming from several networks, one option is to use a single standard ACL on the router closest to the destination. The disadvantage is that traffic from these networks will use bandwidth unnecessarily.
    An extended ACL could be used on each router where the traffic originated. This will save bandwidth by filtering the traffic at the source but requires creating extended ACLs on multiple routers.
  29. 29Standard ACL Placement Ej: the administrator wants to prevent traffic originating in the 192.168.10.0/24 network from reaching the 192.168.30.0/24 network. * R3 S0/0/1 interface - Because the intent of the ACL is to filter traffic destined only for 192.168.30.0/24, a standard ACL should not be applied to this interface.Standard ACL Placement Ej: the administrator wants to prevent traffic originating in the 192.168.10.0/24 network from reaching the 192.16...
  30. 30Extended ACL Placement Ej: R1 S0/0/0 interface (outbound) - The disadvantage of placing the extended ACL on this interface is that all traffic exiting S0/0/0 must be processed by the ACL including packets from 192.168.10.0/24.Extended ACL Placement Ej: R1 S0/0/0 interface (outbound) - The disadvantage of placing the extended ACL on this interface is that all tr...
  31. 31Entering Criteria Statements When traffic enters the router, the traffic is compared to all ACEs in the order that the entries occur in the ACL. The router continues to process the ACEs until it finds a match. The router will process the packet based on the first match found and no other ACEs will be examined. EJ: applying either ACL 1 or ACL 2 to the S0/0/0 interface of R1 in the outbound direction will have the same effect. Network 192.168.10.0 will be permitted to access the networks reachable through S0/0/0 while 192.168.11.0 will not be allowed to access those networks.Entering Criteria Statements When traffic enters the router, the traffic is compared to all ACEs in the order that the entries occur in t...
  32. 32Standard ACL Logic access-list 2 deny 192.168.10.10 access-list 2 permit 192.168.10.0 0.0.0.255 access-list 2 deny 192.168.0.0 0.0.255.255 access-list 2 permit 192.0.0.0 0.255.255.255 If packets are permitted, they are routed through the router to an output interface. If packets are denied, they are dropped at the incoming interfaceStandard ACL Logic access-list 2 deny 192.168.10.10 access-list 2 permit 192.168.10.0 0.0.0.255 access-list 2 deny 192.168.0.0 0.0.255.25...
  33. 33Configuring a Standard ACL The full syntax of the standard ACL command is as follows: Router(config)# access-list "access-list-number" { deny | permit | remark } "source" [ source-wildcard ][ log ]The "access-list" global configuration command defines a standard ACL with a number in the range of 1 through 99. Cisco IOS Software Release 12.0.1 extended these numbers by allowing 1300 to 1999 to be used for standard ACLs.
    This allows for a maximum of 798 possible standard ACLs. These additional numbers are referred to as expanded IP ACLs.
  34. 34—
  35. 35Configuring Standard ACLs The "remark" keyword is used for documentation and makes access lists a great deal easier to understand. Each remark is limited to 100 characters.Configuring Standard ACLs The "remark" keyword is used for documentation and makes access lists a great deal easier to understand. Each r...
  36. 36Internal Logic The IOS internal logic for standard access lists rejects the second statement and returns an error message because it is a subset of the previous statement. Notice in the figure that the router automatically assigns sequence num 10 as the sequence number assigned to the first statement entered in this example.Internal Logic The IOS internal logic for standard access lists rejects the second statement and returns an error message because it is a...
  37. 37Applying Standard ACLs to Interfaces Router(config-if)# ip access-group { access-list-number | access-list-name } { in | out } Ej: This ACL allows only traffic from source network 192.168.10.0 to be forwarded out of interface S0/0/0. Traffic from networks other than 192.168.10.0 is blocked.Applying Standard ACLs to Interfaces Router(config-if)# ip access-group { access-list-number | access-list-name } { in | out } Ej: This A...
  38. 38Applying Standard ACLs Ej: The third line is new and permits all other hosts. This means that all hosts from the 192.168.10.0/24 network will be permitted except for PC1 which was denied in the previous statement.Applying Standard ACLs Ej: The third line is new and permits all other hosts. This means that all hosts from the 192.168.10.0/24 network ...
  39. 39—
  40. 40Creating Named Standard ACLs Note: Numbered ACLs use the global configuration command "access-list" whereas named IPv4 ACLs use the "ip access-list" command. Ej: commands used to configure a standard named ACL on router R1, interface G0/0 that denies host 192.168.11.10 access to the 192.168.10.0 network. The ACL is named NO_ACCESS.Creating Named Standard ACLs Note: Numbered ACLs use the global configuration command "access-list" whereas named IPv4 ACLs use the "ip a...
  41. 41—
  42. 42Editing Numbered ACLs Step 3. In global configuration mode, remove the access list using the no access-list 1 command. Otherwise, the new statements would be appended to the existing ACL. Then paste the new ACL into the configuration of the router.It should be mentioned that when using the no access-list command, different IOS software releases act differently. If the ACL that has been deleted is still applied to an interface, some IOS versions act as if no ACL is protecting your network while others deny all traffic.
    For this reason it is good practice to remove the reference to the access list from the interface before modifying the access list.
  43. 43—
  44. 44Editing Standard Numbered ACLs Method 2: Using the Sequence Number Editing Standard Numbered ACLs Step 1. Display the current ACL using the show access-lists 1 command. Step 2. Enter the ip access-lists standard command that is used to configure named ACLs. The ACL number, 1, is used as the name.First the misconfigured statement needs to be deleted using the no 10 command with 10 referring to the sequence number. Next, a new sequence number 10 statement is added using the command, 10 deny host 192.168.10.10.
    Note: Statements cannot be overwritten using the same sequence number as an existing statement. The current statement must be deleted first, and then the new one can be added.
  45. 45—
  46. 46Editing Standard Named ACLs By referring to the statement sequence numbers, individual statements can easily be inserted or deleted. This method can also be used to edit standard named ACLs. Ej: To add a statement to deny another workstation requires inserting a numbered line. In the example, the workstation with the IPv4 address 192.168.11.11 is being added using a new sequence number of 15.Editing Standard Named ACLs By referring to the statement sequence numbers, individual statements can easily be inserted or deleted. This...
  47. 47Verifying ACLs Ej: the "show ip interface" command is used to verify the ACL on the interface. The output from this command includes the number or name of the access list and the direction in which the ACL was applied.Verifying ACLs Ej: the "show ip interface" command is used to verify the ACL on the interface. The output from this command includes the ...
  48. 48Verifying ACLs Ej: issuing the show access-lists command on router R1. To view an individual access list use the show access-lists command followed by the access list number or name. The NO_ACCESS statements may look strange. Notice that sequence number 15 is displayed prior to sequence number 10. This is a result of the router internal processVerifying ACLs Ej: issuing the show access-lists command on router R1. To view an individual access list use the show access-lists comman...
  49. 49ACL Statistics Once the ACL has been applied to an interface and some testing has occurred, the "show access-lists" command will show statistics for each statement that has been matched.ACL Statistics Once the ACL has been applied to an interface and some testing has occurred, the "show access-lists" command will show sta...
  50. 50ACL Statistics Both permit and deny statements will track statistics for matches; however, recall that every ACL has an implied deny any as the last statement. This statement will not appear in the show access-lists command, therefore, statistics for that statement will not appearTo view statistics for the implied deny any statement, the statement can be configured manually and will appear in the output.
    Extreme caution should be taken when manually configuring the deny any statement, as it will match all traffic. If this statement is not configured as the last statement in the ACL, it could cause unexpected results.
  51. 51ACL Statistics During testing of an ACL, the counters can be cleared using the "clear access-list counters" command. This command can be used alone or with the number or name of a specific ACLACL Statistics During testing of an ACL, the counters can be cleared using the "clear access-list counters" command. This command can be ...
  52. 52Standard ACL Sequence Numbers Ej: The "show running-config" command is used to verify the ACL configuration. Notice that the statements are listed in a different order than they were entered. We will use the "show access-lists" command to understand the logic behind this.Standard ACL Sequence Numbers Ej: The "show running-config" command is used to verify the ACL configuration. Notice that the statements a...
  53. 53Standard ACL Sequence Numbers The order in which the standard ACEs are listed is the sequence used by the IOS to process the list. Notice that the statements are grouped into two sections, host statements followed by range statements. The sequence number indicates the order that the statement was entered, not the order the statement will be processed. The host statements are listed first but not necessarily in the order that they were entered. The IOS puts host statements in an order using a special hashing function. The resulting order optimizes the search for a host ACL entry.Standard ACL Sequence Numbers The order in which the standard ACEs are listed is the sequence used by the IOS to process the list. Notice...
  54. 54Standard ACL Sequence Numbers The range statements are displayed after the host statements. These statements are listed in the order in which they were entered. After saving the running-configuration the router is reloaded (rebooted), the "show access-lists" command displays the ACL in the same order, however the statements have been renumbered. The sequence numbers are now in numerical order. Note: The hashing function is only applied to host statements in an IPv4 standard access list. The algorithm is not used for IPv4 extended ACLs or IPv6 ACLs. This is because extended and IPv6 ACLs filter on more than just a single source address.Standard ACL Sequence Numbers The range statements are displayed after the host statements. These statements are listed in the order in w...
  55. 55Using an ACL to Control VTY Access You can control which administrative workstation or network manages your router with an ACL and an "access-class" statement configured on your VTY lines. You can also use this technique with SSH to further improve administrative access security. The "access-class" command configured in line configuration mode restricts incoming and outgoing connections between a particular VTY (into a Cisco device) and the addresses in an access list.Using an ACL to Control VTY Access You can control which administrative workstation or network manages your router with an ACL and an "ac...
  56. 56Configuring a Standard ACL to Secure a VTY Port Standard and extended access lists apply to packets that travel through a router. They are not designed to block packets that originate within the router. An outbound Telnet extended ACL does not prevent router-initiated Telnet sessions, by default.Filtering Telnet or SSH traffic is typically considered an extended IP ACL function because it filters a higher level protocol. However, because the access-class command is used to filter incoming or outgoing Telnet/SSH sessions by source address, a standard ACL can be used.
    The command syntax of the access-class command is:
    Router(config-line)# access-class "access-list-number" { in [ vrf-also ] | out }
  57. 57Extended ACLs For more precise traffic-filtering control, extended IPv4 ACLs can be created. Extended ACLs are numbered 100 to 199 and 2000 to 2699, providing a total of 799 possible extended numbered ACLs. Extended ACLs can also be namedACLs provide a greater degree of control. As shown in the figure, like standard ACLs, extended ACLs check source addresses of packets, but they also check the destination address, protocols, and port numbers (or services).
  58. 58Extended ACLs Ej: an administrator specifies a TCP or UDP port number by placing it at the end of the extended ACL statement. Logical operations can be used, such as: ** equal (eq), not equal (neq), greater than (gt), and less than (lt).Extended ACLs Ej: an administrator specifies a TCP or UDP port number by placing it at the end of the extended ACL statement. Logical ope...
  59. 59Extended ACLs Ej: display a list of port numbers and keywords that can be used when building an ACL using the command: R1(config)# access-list 101 permit tcp any any eq ?Extended ACLs Ej: display a list of port numbers and keywords that can be used when building an ACL using the command: R1(config)# access...
  60. 60—
  61. 61Configuring Extended ACLs The procedural steps for configuring extended ACLs are the same as for standard ACLs. The extended ACL is first configured, and then it is activated on an interface.Note: The internal logic applied to the ordering of standard ACL statement does not apply to extended ACLs.
    ** The order in which the statements are entered during configuration is the order they are displayed and processed.
  62. 62Configuring Extended ACLs Ej: the network administrator has configured ACLs to restrict network access to allow website browsing only from the LAN attached to interface G0/0 to any external network The nature of HTTP requires that traffic flow back into the network from websites accessed from internal clients. The network administrator wants to restrict that return traffic to HTTP exchanges from requested websites, while denying all other traffic. ACL 104 does that by blocking all incoming traffic, except for previously established connections. The permit statement in ACL 104 allows inbound traffic using the "established" parameter.Configuring Extended ACLs Ej: the network administrator has configured ACLs to restrict network access to allow website browsing only fro...
  63. 63Configuring Extended ACLs The "established" parameter allows only responses to traffic that originates from the 192.168.10.0/24 network to return to that network. A match occurs if the returning TCP segment has the ACK or reset (RST) bits set, which indicates that the packet belongs to an existing connection. Without the established parameter in the ACL statement, clients could send traffic to a web server, but not receive traffic returning from the web server.Configuring Extended ACLs The "established" parameter allows only responses to traffic that originates from the 192.168.10.0/24 network t...
  64. 64Applying Extended ACLs to Interfaces Ej: Web request traffic from users on the 192.168.10.0/24 LAN is inbound to the G0/0 interface. Return traffic from established connections to users on the LAN is outbound from the G0/0 interface. The example applies the ACL to the G0/0 interface in both directions. The inbound ACL, 103, checks for the type of traffic. The outbound ACL, 104, checks for return traffic from established connections. This will restrict 192.168.10.0 Internet access to allow only website browsing.Applying Extended ACLs to Interfaces Ej: Web request traffic from users on the 192.168.10.0/24 LAN is inbound to the G0/0 interface. Retu...
  65. 65Filtering Traffic with Extended ACLs Ej: denies FTP traffic from subnet 192.168.11.0 that is going to subnet 192.168.10.0, but permits all other traffic. Note the use of wildcard masks and the explicit deny any statement. Remember that FTP uses TCP ports 20 and 21; therefore the ACL requires both port name keywords ftp and ftp-data or eq 20 and eq 21 to deny FTP. To prevent the implied deny any statement at the end of the ACL from blocking all traffic, the permit ip any any statement is added. Without at least one permit statement in an ACL, all traffic on the interface where that ACL was applied would be dropped.Filtering Traffic with Extended ACLs Ej: denies FTP traffic from subnet 192.168.11.0 that is going to subnet 192.168.10.0, but permits al...
  66. 66Filtering Traffic with Extended ACLs Ej: denies Telnet traffic from any source to the 192.168.11.0/24 LAN, but allows all other IP traffic. Because traffic destined for the 192.168.11.0/24 LAN is outbound on interface G0/1, the ACL would be applied to G0/1 using the out keyword. Note the use of the "any" keywords in the permit statement. This permit statement is added to ensure that no other traffic is blocked.Filtering Traffic with Extended ACLs Ej: denies Telnet traffic from any source to the 192.168.11.0/24 LAN, but allows all other IP traffi...
  67. 67Creating Named Extended ACLs Step 1. From global configuration mode, use the: (ip access-list extended "name") command to define a name for the extended ACL.Creating Named Extended ACLs Step 1. From global configuration mode, use the: (ip access-list extended "name") command to define a name f...
  68. 68Verifying Extended ACLs Unlike standard ACLs, extended ACLs do not implement the same internal logic and hashing function. The output and sequence numbers displayed in the "show access-lists" command output is the order in which the statements were entered. Host entries are not automatically listed prior to range entries. The show ip interface command is used to verify the ACL on the interface and the direction in which it was applied.Verifying Extended ACLs Unlike standard ACLs, extended ACLs do not implement the same internal logic and hashing function. The output and...
  69. 69Editing Extended ACLs * Method 1 Text editor - Using this method, the ACL is copied and pasted into the text editor where the changes are made. * Method 2 Sequence numbers - Sequence numbers can be used to delete or insert an ACL statementEditing Extended ACLs * Method 1 Text editor - Using this method, the ACL is copied and pasted into the text editor where the changes are...
  70. 70Inbound ACL Logic At the end of every ACL is a statement is an implicit deny any statement. This statement is not shown in output. This final implied statement applied to all packets for which conditions did not test true. This final test condition matches all other packets and results in a "deny" action. Instead of proceeding into or out of an interface, the router drops all of these remaining packets. This final statement is often referred to as the "implicit deny any statement" or the "deny all traffic" statement.Inbound ACL Logic At the end of every ACL is a statement is an implicit deny any statement. This statement is not shown in output. This f...
  71. 71Outbound ACL Logic Before a packet is forwarded to an outbound interface, the router checks the routing table to see if the packet is routable. If the packet is not routable, it is dropped and is not tested against the ACEs. Next, the router checks to see whether the outbound interface is grouped to an ACL. If the outbound interface is not grouped to an ACL, the packet can be sent to the output buffer. For outbound lists, "permit" means to send the packet to the output buffer, and "deny" means to discard the packet.Outbound ACL Logic Before a packet is forwarded to an outbound interface, the router checks the routing table to see if the packet is rou...
  72. 72ACL and Routing and ACL Processes On a Router As a frame enters an interface, the router checks to see whether the destination Layer 2 address matches its interface Layer 2 address, or whether the frame is a broadcast frame. If the frame address is accepted, the frame information is stripped off and the router checks for an ACL on the inbound interface. If an ACL exists, the packet is tested against the statements in the list. If the packet matches a statement, the packet is either permitted or denied. If the packet is accepted, it is then checked against routing table entries to determine the destination interface.If a routing table entry exists for the destination, the packet is then switched to the outgoing interface, otherwise the packet is dropped.
    Next, the router checks whether the outgoing interface has an ACL. If an ACL exists, the packet is tested against the statements in the list.
    If the packet matches a statement, it is either permitted or denied.
    If there is no ACL or the packet is permitted, the packet is encapsulated in the new Layer 2 protocol and forwarded out the interface to the next device
  73. 73Troubleshooting Common ACL Errors - Example 1 Ej: host 192.168.10.10 has no connectivity with 192.168.30.12. Look at the order of the ACEs. Host 192.168.10.10 has no connectivity with 192.168.30.12 because of the order of rule 10 in the access list. Because the router processes ACLs from the top down, statement 10 denies host 192.168.10.10, so statement 20 can never be matched. Statements 10 and 20 should be reversed. The last line allows all other non-TCP traffic that falls under IP (ICMP, UDP, etc.).Troubleshooting Common ACL Errors - Example 1 Ej: host 192.168.10.10 has no connectivity with 192.168.30.12. Look at the order of the ACE...
  74. 74Troubleshooting Common ACL Errors - Example 2 Ej: the 192.168.10.0/24 network cannot use TFTP to connect to the 192.168.30.0/24 network. because TFTP uses the transport protocol UDP. Statement 30 in access list 120 allows all other TCP traffic. However, because TFTP uses UDP instead of TCP, it is implicitly denied. * Statement 30 should be ip any any.Troubleshooting Common ACL Errors - Example 2 Ej: the 192.168.10.0/24 network cannot use TFTP to connect to the 192.168.30.0/24 network. ...
  75. 75Troubleshooting Common ACL Errors - Example 3 Ej: the 192.168.11.0/24 network can use Telnet to connect to 192.168.30.0/24, but according to company policy, this connection should not be allowed. because the Telnet port number in statement 10 of access list 130 is listed in the wrong position in the ACL statement. Statement 10 currently denies any source packet with a port number that is equal to Telnet. To deny Telnet traffic inbound on G0/1, deny the destination port number that is equal to Telnet, for example: deny tcp any any eq telnet.Troubleshooting Common ACL Errors - Example 3 Ej: the 192.168.11.0/24 network can use Telnet to connect to 192.168.30.0/24, but according...
  76. 76Troubleshooting Common ACL Errors - Example 5 Ej: host 192.168.30.12 can use Telnet to connect to 192.168.31.12, but according to the security policy, this connection should not be allowed. . Statement 10 denies any source address to connect to host 192.168.31.12 using telnet. However, this filter should be applied outbound on G0/1 to filter correctly.Troubleshooting Common ACL Errors - Example 5 Ej: host 192.168.30.12 can use Telnet to connect to 192.168.31.12, but according to the sec...
  77. 77Type of IPv6 ACLs In IPv4 there are two types of ACLs, standard and extended. Both types of ACLs can be either numbered or named ACLs. With IPv6, there is only one type of ACL, which is equivalent to an IPv4 extended named ACL. There are no numbered ACLs in IPv6. An IPv4 ACL and an IPv6 ACL cannot share the same name.Type of IPv6 ACLs In IPv4 there are two types of ACLs, standard and extended. Both types of ACLs can be either numbered or named ACLs. Wi...
  78. 78Comparing IPv4 and IPv6 ACLs Although IPv4 and IPv6 ACLs are very similar, there are three significant differences between them. 1. Applying an IPv6 ACL The first difference is the command used to apply an IPv6 ACL to an interface. IPv4 uses the command "ip access-group" to apply an IPv4 ACL to an IPv4 interface.IPv6 uses the "ipv6 traffic-filter" command to perform the same function for IPv6 interfaces.
    2, No Wildcard Masks
    Unlike IPv4 ACLs, IPv6 ACLs do not use wildcard masks. Instead, the prefix-length is used to indicate how much of an IPv6 source or destination address should be matched.
  79. 79Comparing IPv4 and IPv6 ACLs Additional Default Statements IPv6 includes a similar deny ipv6 any any statement at the end of each IPv6 ACL. The difference is IPv6 also includes two other implicit statements by default: permit icmp any any nd-na permit icmp any any nd-ns These two statements allow the router to participate in the IPv6 equivalent of ARP for IPv4 IPv6 uses ICMP Neighbor Discovery (ND) messages to accomplish the same thing. ND uses Neighbor Solicitation (NS) and Neighbor Advertisement (NA) messages.Comparing IPv4 and IPv6 ACLs Additional Default Statements IPv6 includes a similar deny ipv6 any any statement at the end of each IPv6 AC...
  80. 80Configuring IPv6 ACLs EJ: The first statement names the IPv6 access list NO-R3-LAN-ACCESS. Similar to IPv4 named ACLs, capitalizing IPv6 ACL names is not required, but makes them stand out when viewing the running-config output. The second statement denies all IPv6 packets from the 2001:DB8:CAFE:30::/64 destined for any IPv6 network. The third statement allows all other IPv6 packets.Configuring IPv6 ACLs EJ: The first statement names the IPv6 access list NO-R3-LAN-ACCESS. Similar to IPv4 named ACLs, capitalizing IPv6 ...
  81. 81—
  82. 82Applying an IPv6 ACL to an Interface Router(config-if)# ipv6 traffic-filter "access-list-name" { in | out } Note: IPv4 and IPv6 both use the access-class command to apply an access list to VTY ports.Applying an IPv6 ACL to an Interface Router(config-if)# ipv6 traffic-filter "access-list-name" { in | out } Note: IPv4 and IPv6 both use ...
  83. 83IPv6 ACL Examples - Deny FTP EJ: router R1 is configured with an IPv6 access list to deny FTP traffic to 2001:DB8:CAFE:11::/64. Ports for both FTP data (port 20) and FTP control (port 21) need to be blocked.IPv6 ACL Examples - Deny FTP EJ: router R1 is configured with an IPv6 access list to deny FTP traffic to 2001:DB8:CAFE:11::/64. Ports for...
  84. 84IPv6 ACL Examples - Restricted Access EJ: an IPv6 ACL is configured to give the LAN on R3 limited access to the LANs on R1.IPv6 ACL Examples - Restricted Access EJ: an IPv6 ACL is configured to give the LAN on R3 limited access to the LANs on R1.
  85. 85Verifying IPv6 ACLs Ej: shows the output of the "show ipv6 interface" command. The output confirms that RESTRICTED-ACCESS ACL is configured inbound on the G0/0 interface.Verifying IPv6 ACLs Ej: shows the output of the "show ipv6 interface" command. The output confirms that RESTRICTED-ACCESS ACL is configur...
  86. 86Verifying IPv6 ACLs Ej: the show access-lists command displays all access lists on the router including both IPv4 and IPv6 ACLs. Notice that with IPv6 ACLs the sequence numbers occur at the end of the statement and not the beginning as with IPv4 access lists. Although the statements appear in the order they were entered, they are not always incremented by 10. This is because the remark statements that were entered use a sequence number but are not displayed in the output of the show access-lists command. Similar to extended ACLs for IPv4, IPv6 access lists are displayed and processed in the order the statements are entered. Remember,Verifying IPv6 ACLs Ej: the show access-lists command displays all access lists on the router including both IPv4 and IPv6 ACLs. Notice t...
  87. 87Verifying IPv6 ACLs Ej: the output from the "show running-config" command includes all of the ACEs and remark statements. Remark statements can come before or after permit or deny statements but should be consistent in their placement.Verifying IPv6 ACLs Ej: the output from the "show running-config" command includes all of the ACEs and remark statements. Remark statemen...
  88. 88—

Information

Description
CCNA CCNA Flashcards on E2_9 ACL, created by John Dedios on 18/04/2016.
Created by
John Dedios
Views
3
Tags
acl
Rating

Feedback

What is it about?

What do you think of the new look?

How do you like it?