CCNA Complete Guide 2nd Edition.pdf - Cisco Learning Home

Chapter 19
IP Access Control Lists
- Access control list (ACL) is an effective and important network security feature. With the ability
to classify inbound and outbound packets going through the router or switch interfaces, Access
lists are able to define rules that allow or deny certain type of packets flowing through a network.
Ex: Employees in Department A, Building A are not allowed to access Server B in Building B;
Everyone is denied the access to Server C except Department B.
- ACLs are categorized as Standard (simpler logic) and Extended (more complex logic) ACLs.
- ACLs can permit and deny packets based on L3 (IP address) and L4 (port number) information.
Standard IP Access Lists
1
172.16.1.2
Access denied
to ServerA
2
172.16.2.2
3 4
172.16.2.3 172.16.2.4
Figure 19-1: Network Setup for Access Control List
- Figure 19-1 shows a sample scenario that demonstrates the usage of ACLs – deny the access of
PC2 to ServerA. It shows the packet flow for PC2 to access ServerA would typically go through
a switch, RT2, RT3, another switch, and finally ServerA. In order to block the packets sent by
PC2 to arrive at ServerA, the best place to apply ACL filtering logic would be on RT2 or RT3.
Figure 19-2 shows the internal processing in RT3 when a packet enters it through S0/1 and exits
through Fa1/0.
Inbound
ACL
Fa1/0
Fa1/0
Figure 19-2: Internal Processing in RT3
135
RT1
S0/0
RT2
S0/0
Routing
Logic
S0/1
S0/0
S0/1
RT3
S0/1
Fa1/0
Outbound
ACL
ServerA
172.16.3.2
S0/1 Permit
Permit Fa1/0
Deny
Discard
Deny
Copyright © 2008 Yap Chin Hoong
yapchinhoong@hotmail.com