Skip to content
Class Notes

CCNA 200-301 Portable Command Guide 5th Edition 22

Manage traffic using ACLs: Learn to create, apply, and verify standard, extended, named, and IPv6 ACLs. Includes tips, keywords, sequence numbers, and configuration examples.

Preview 5 of 15 pages

See the first 5 pages exactly as they appear in the document.

  1. Page 1
    Read page 1 as text

    CHAPTER 21 Managing Traffic Using Access Control Lists (ACLs) This chapter provides information and commands concerning the following topics: D Access list numbers n Using wildcard masks n ACL keywords □ Creating standard ACLs D Applying standard ACLs to an interface D Verifying ACLs □ Removing ACLs u Creating extended ACLs u Applying extended ACLs to an interface u The established keyword □ The log keyword □ Creating named ACLs n Using sequence numbers in named ACLs n Removing specific lines in named ACLs using sequence numbers n Sequence number tips n Including comments about entries in ACLs D Restricting virtual terminal access □ Tips for configuring ACLs U IPv6 ACLs u Verifying IPv6 ACLs u Configuration examples: IPv4 ACLs u Configuration examples: IPv6 ACLs Access List Numbers Although many different protocols can use access control lists (ACLs), the CCNA 200-301 certification exam is concerned only with IPv4 ACLs. The following chart shows some of the other protocols that can use ACLs. 1-99 or 1300-1999 Standard IPv4 100-199 or 2000-2699 Extended IPv4 NOTE: IPv6 ACLs do not use numbers; IPv6 ACLs are configured using names only. Technet24

  2. Page 2
    Read page 2 as text

    198 Using Wildcard Masks Using Wildcard Masks When applied to an IP address, a wildcard mask identifies which addresses get matched to be applied to the permit or deny argument in an ACL statement. A wildcard mask can identify a single host, a range of hosts, a complete network or subnetwork, or even all possible addresses. There are two rules when working with wildcard masks: u A 0 (zero) in a wildcard mask means to check the corresponding bit in the address for an exact match. n A 1 (one) in a wildcard mask means to ignore the corresponding bit in the address—can be either 1 or 0. In the examples, this is shown as x. Example 1: 172.16.0.0 0.0.255.255 172.16.0.0 = 10101100.00010000.00000000.00000000 0.0.255.255 = 00000000.00000000.11111111.11111111 Result = 10101100.00010000. xxxxxxxxxxxxxxxx 172.16.x.x (Anything between 172.16.0.0 and 172.16.255.255 matches the example statement) TIP: An octet of all 0s means that the octet has to match exactly to the address. An octet of all 1s means that the octet can be ignored. Example 2: 172.16.8.0 0.0.7.255 172.16.8.0 = 10101100.00010000.00001000.00000000 0.0.7.255 = 00000000.00000000.00000111.11111111 Result = 10101100.00010000.OOOOlxxxxxxxxxxx 00001 XXX = 00001000 to 00001 111 = 8-15 xxxxxxxiw 00000000 to 11111111 = 0-255 Anything between 172.16.8.0 and 172.16.15.255 matches the example statement ACL Keywords any Used in place of 0.0.0.0 255.255.255.255, matches any address that it is compared against host Used in place of 0.0.0.0 in the wildcard mask, matches only one specific address Creating Standard ACLs NOTE: Standard ACLs are the oldest type of ACL. They date back as early as Cisco IOS Release 8.3. Standard ACLs control traffic by comparing the source of the IP pack- ets to the addresses configured in the ACL.

  3. Page 3
    Read page 3 as text

    Applying Standard ACLs to an Interface 199 NOTE: Each line in an ACL is called an access control entry (ACE). Many ACEs grouped together form a single ACL. Router(config)# access-list 10 permit 172.16.0.0 0.0.255.255 Read this line to say, "All packets with a source IP address of 172.16.x.x will be matched by the statement, and the packet will be exited from processing the rest of the ACL" access-list = ACL command 10 = Arbitrary number between 1 and 99, or 1300 and 1 999, designating this as a standard IP ACL permit = Packets that match this statement will be allowed to continue 172.16.0.0 = Source IP address to be compared to 0.0.255.255 = Wildcard mask Router( config)# access-list 10 deny host 172.17.0.1 Read this line to say, "All packets with a source IP address of 172.17.0.1 will be dropped and discarded" access-list ACL command 10 Number between 1 and 99, or 1300 and 1999, designating this as a standard IP ACL deny Packets that match this statement will be dropped and discarded host Keyword 172.17.0.1 Specific host address Router( config)# access-list 10 permit any Read this line to say, "All packets with any source IP address will be matched by the statement, and the packet will be exited from processing the rest of the ACL" access-list ACL command 10 Number between 1 and 99, or 1300 and 1999, designating this as a standard IP ACL permit Packets that match this statement will be allowed to continue any Keyword to mean all IP addresses TIP: An implicit deny statement is assumed into every ACL. You cannot see it, but it states "deny everything not already matched by an ACE in the list." This is always the last line of any ACL. If you want to defeat this implicit deny , put a permit any statement in your standard ACLs or a permit ip any any in your extended ACLs as the last line. Applying Standard ACLs to an Interface Router(config)# interface gigabitethemet 0/0 Moves to interface configuration mode Router(config-if)# ip access-group 10 out Takes all ACEs that are defined as being part of group 10 and applies them in an outbound manner. Packets leaving the router through interface gigabitethemet 0/0 will be checked Technet24

  4. Page 4
    Read page 4 as text

    200 Applying Standard ACLs to an Interface TIP: Access lists can be applied in either an inbound direction (keyword in) or an outbound direction (keyword out). Best practice is to have ACLs applied in an outbound direction. TIP: Not sure in which direction to apply an ACL? Look at the flow of packets. Do you want to filter packets as they are going in a router's interface from an external source? Use the keyword in for this ACL. Do you want to filter packets before they go out of the router's interface toward another device? Use the keyword out for this ACL. TIP: Apply a standard ACL as close as possible to the destination network or device. You do not want packets with the same source IP address to be filtered out early and prevented from reaching a legitimate destination. Verifying ACLs Router# show ip interface Router# show access-lists Router# show access-list access-list-number Router# show access-list name Router# show run Displays any ACLs applied to that interface Displays the contents of all ACLs on the router Displays the contents of the ACL by the number specified Displays the contents of the ACL by the name specified Displays all ACLs and interface assignments Removing ACLs Router(config)# no access-list 10 Removes all ACEs in ACL number 10 Creating Extended ACLs NOTE: Extended ACLs were also introduced in Cisco IOS Release 8.3. Extended ACLs control traffic by comparing the source and destination of the IP packets to the addresses configured in the ACL. Extended ACLs can also filter packets using protocol/port numbers for a more granular filter. Router(config)# access-list 11 0 pennit tcp 172.16.0.0 0.0.0.255 Read this line to say, "HTTP packets with a source IP address of 172.16.0.x will be matched by the statement, and the packet will be exited from processing the rest of the ACL" 192.168.100.0 0.0.0.255 eq 80 access-list = ACL command 110 = Number between 100 and 199, or 2000 and 2699, designating this as an extended IP ACL permit = Packets that match this statement will be allowed to continue tcp = Protocol must be TCP 172.16.0.0 = Source IP address to be compared to 0.0.0.255 = Wildcard mask for the source IP address

  5. Page 5
    Read page 5 as text

    The established Keyword 201 192.168.100.0 = Destination IP address to be compared to 0.0.0.255 = Wildcard mask for the destination IP address eq = Operand; means "equal to" 80 = Port 80, indicating HTTP traffic Read this line to say, "Telnet packets with any source IP address will be dropped if they are addressed to specific host 192.168.100.7" access-list = ACL command Router(config)# access-list 110 deny tcp any 192.168.100.7 0.0.0.0 eq 23 110 = Number between 100 and 199, or 2000 and 2699, designating this as an extended IP ACL deny = Packets that match this statement will be dropped and discarded tcp = Protocol must be TCP protocol any = Any source IP address 192.168.100.7 = Destination IP address to be compared to 0.0.0.0 = Wildcard mask; address must match exactly eq = Operand, means "equal to" 23 = Port 23, indicating Telnet traffic Applying Extended ACLs to an Interface Moves to interface configuration mode and takes all access list lines that are defined as being part of group 110 and applies them in an inbound manner. Packets going in gigabitethemet 0/0 will be checked Router(config)# interface gigabitethemet 0/0 Router(config-if)# ip access-group 110 in TIP: Access lists can be applied in either an inbound direction (keyword in) or an outbound direction (keyword out ). Best practice for extended ACLs is to apply them in an inbound manner. TIP: Only one access list can be applied per interface, per direction, per protocol. TIP: Apply an extended ACL as close as possible to the source network or device. This ensures that packets that are intended to be dropped are not allowed to travel. The established Keyword The established keyword is an optional keyword that is used with the TCP protocol only. It indicates an established connection. A match occurs only if the TCP segment has the ACK or RST control bits set. Router(config)# access-list 110 permit tcp 172.16.0.0 0.0.0.255 eq 80 192.168.100.0 0.0.0.255 established Indicates an established connection Technet24

10 more pages in the full document

Unlock it once and it stays in your library, ready to chat with or turn into flashcards.

Unlock the full document

More Information Technology study materials

See all

Study this document with CramX

Once it is in your library, every tool can work from it.