CCNA Complete Guide 2nd Edition.pdf - Cisco Learning Home

- Standard IP Access Lists configuration on RT3:
RT3(config)#access-list 10 remark *** Deny PC2 – ServerA ***
RT3(config)#access-list 10 deny 172.16.2.2
RT3(config)#access-list 10 permit any
RT3(config)#int fa1/0
RT3(config-if)#ip access-group 10 out
RT3(config-if)#^Z
RT3#
- The following 2 standard access list statements are identical:
access-list 10 permit any
access-list 10 permit 0.0.0.0 255.255.255.255
- The log parameter can be specified at the end of an access list to sends a message to the console
(and logging facilities) every time the access list is matched.
- Note: Whenever there is a deny statement in an ACL, remember to create an explicit permit
statement to allow valid traffic to pass through (all ACLs have an implicit deny statement).
Extended IP Access Lists Configuration
- An extended access list statement can be used to examine multiple portions of a packet header,
and all parameters must be matched in order to match a particular packet to the ACL statement.
This feature makes extended ACLs much more complex and powerful than standard ACLs.
- Extended ACLs are created with the access-list number 100-199 or 2000-2699 (expanded
range), inclusively.
- TO-DO: Implement extended ACLs to achieve the following security policies:
i) Deny PC2 access to ServerA’s web server.
ii) Deny PC1 access to hosts on RT2 Ethernet.
iii) Allow PC3, a NMS, access to ServerA’s SNMP service.
iv) All other combinations are allowed.
- Extended IP Access Lists configuration on RT2:
RT2(config)#access-list 110 deny tcp host 172.16.2.2 host 172.16.3.2 eq www
RT2(config)#access-list 110 deny ip 172.16.2.0 0.0.0.255 host 172.16.1.2
RT2(config)#access-list 110 permit udp host 172.16.2.3 host 172.16.3.2 eq snmp
RT2(config)#access-list 110 permit ip any any
RT2(config)#int fa1/0
RT2(config-if)#ip access-group 110 in
- Extended ACLs should be placed as close to the source as possible to ensure that the matched
packets are discarded as soon as possible to preserve network bandwidth.
- The second line of configuration which denying packets flow from RT2 Ethernet subnet to PC1
effectively stops the communication between them, which is how the 2nd requirement is met.
Else the extended ACL will be placed at RT1 Fa1/0 (as close to the source as possible).
140
Copyright © 2008 Yap Chin Hoong
yapchinhoong@hotmail.com