CCNA Complete Guide 2nd Edition.pdf - Cisco Learning Home

Chapter 20
IP Access Control Lists Lab
- Remember that access lists use excessive router processing resources. Hence always implement
access lists as short as possible, as effective as possible, and as efficient as possible.
Standard IP Access Lists Configuration
1
172.16.1.2
Access denied
to ServerA
2
172.16.2.2
3 4
Fa1/0
Fa1/0
172.16.2.3 172.16.2.4
Figure 20-1: Network Setup for Access Control List
- Standard IP ACLs filter packets by examining only the source IP address in a packet. Standard
ACLs are created with the access-list number 1-99 or 1300-1999 (expanded range), inclusively.
There is no difference between a number to another.
- IP ACLs configuration commands:
Command Description
access-list {access-list-num} {deny | permit} Global configuration command used to
[host] {source-addr} [source-wildcard]
add an entry into a standard access list.
access-list {access-list-num} remark {text} Global configuration command used to
add a comment for an access list.
ip access-group {access-list-num} {in | out} Interface subcommand used to apply an
access list on an interface.
access-class {access-list-num} {in | out} Line subcommand used to apply an
access list on VTY remote access lines.
no access-list {access-list-num} Global configuration command used to
remove an access list entirely.
- TO-DO: Implement standard ACLs to deny the access of PC2 to ServerA.
- Standard ACLs should be placed as near to the destination as possible, as standard ACLs often
discard packets that are allowed to forward (or pass) when they are placed close to the source.
Ex: If an inbound ACL is placed on RT2’s Fa1/0, PC2 will never go further than RT2! Hence the
best place to deploy the ACL is on RT3’s Fa1/0 with an outbound standard ACL.
- Another reason is security loopholes might exist when a link between routers fails – packets that
pass through another new path might no longer be passing through the ACL-secured interface.
139
RT1
S0/0
RT2
S0/0
S0/1
S0/0
S0/1
RT3
S0/1
Fa1/0
ServerA
172.16.3.2
Copyright © 2008 Yap Chin Hoong
yapchinhoong@hotmail.com