Cisco CCNA ACL Part II

Transcription

1 Cisco CCNA ACL Part II Cisco CCNA Access List Applications This slide illustrates common uses for IP access lists. While this chapter focuses on IP access lists, the concept of access lists as mechanisms to control traffic in a network applies to all protocols. An improved security solution is the lock-and-key access feature, which is available only with IP extended access lists. Lock-and-key access allows you to set up dynamic access lists that grant access per user to a specific source/destination host through a user authentication process. You can allow user access through a firewall dynamically, without compromising security restrictions. Access lists can be used to permit or deny packets moving through the router, permit or deny Telnet (VTY) access to or from a router, and create dial-on-demand interesting traffic that triggers dialing to a remote location. Cisco CCNA Wildcards Review

2 Wildcards are used with access lists to specify an individual host, a network, or a certain range of a network or networks. To understand a wildcard, you need to understand what a block size is; they re used to specify a range of addresses. Some of the different block sizes available are 64, 32, 16, 8, and 4. Wildcards are essentially opposite of a subnet mask where a 0 in the bit position specifies an exact match while a 1 in the bit position specifies a wildcard. For example, a mask of specifies the first three octet must match exactly while the last octet can be any value between 0 and 255. Cisco CCNA Wildcard Masks

3 This is a review of wildcard masks, as first discussed when configuring OSPF. You really need to know these!! /27 or matches a last octet value between 32 and /30 or matches a last octet value between 4 and /26 or matches a last octet value between 128 and /28 or matches a last octet value between 32 and /29 or matches a last octet value between 8 and /20 or matches a third octet value between 16 and 31 and the last octet can be between 0 and 255. Cisco CCNA Access List Command Overview

4 There are two steps required when implementing IP ACLs. First the ACL needs to be created which is done is global configuration mode. Secondly, the newly created ACL needs to be applied to an interface. The ACL can be applied to packets entering the router (in) or exiting the router (out). ACLs are created utilizing the access-list command while they are applied utilizing the ip access-group command. The example demonstrates a basic standard access-list. Each of the three test statements accomplish the same thing. It is showing three different ways to specify a host entry. Cisco CCNA Wildcard Example 1

5 This example will deny host on network /24 ( ) from exiting interface fa0/1. Note that it denies those addresses from exiting interface fa0/1 due to the ip access-group command being applied as out. Cisco CCNA Wildcard Example 2

6 This example stops only host /32 from existing interface fa0/1. A host address is specified with a wildcard mask of which if you remember from previous slides a 0 in a bit position means match exactly. Since a wildcard of has a 0 in all 32 bit positions, all 32 bit must match exactly, hence it specifies a host address. Cisco CCNA Wildcard Example 3

7 This example will deny anyone on subnet /26 ( ) from exiting interface fa0/1. The wildcard mask specified in the example, specifies the first three octets must match exactly while the last 6 bits in the fourth octet can be anything which means is can be in the range Cisco CCNA Wildcard Question

8 Answer: access-list 10 permit Since in the third octet, 16, 17, 18, and 19 can be summarized into one address it can be written as Note, this can only be accomplished it the addresses are contiguous and start on subnet boundaries. Cisco CCNA Applying Access lists to a VTY Line

9 When you apply an access to the VTY lines, you don t need to specify the telnet protocol since access to the VTY implies terminal access. You also don t need to specify a destination address, since it really doesn t matter which interface address the user used as a target for the telnet session. You really only need to control where the user is coming from their source IP address. Hence, limiting vty access is accomplished utilizing standard IP access lists. They are applied to vty lines with an access-class command versus an ip access-group command utilized when applying ACLs to an interface. An example follows on the next slide. Cisco CCNA Virtual Terminal Access Example

10 The above example permits only hosts in network to connect to the router s VTY lines. Hence remote access is limited to only addresses in the range The range is specified by the wildcard mask of See more at: II.html#sthash.oLO8SRgu.dpuf