Learning by Doing: CISCO Certified Network ... - SCN Research

Paper Lab: Access Control Lists
Objective:
To learn the fundamentals of writing standard, extended, and named Access Control List
statements.
Background:
An access control lists (ACL) is a sequential collection of statements that control access
to or from a network or subnet. The ACL statements are processed in the order in which
they appear. There really is nothing magical about them…we just need to use them
carefully and understand the logic of ACL’s. ACL’s consume large amounts of resources
since every single packet coming and going is compared against every single ACL
statement. In this respect we want to use them sparingly. Large amounts of ACL
statements are best left to firewall and security devices…if you use lots of ACL
statements you are actually turning your router into a firewall device. Creating and
implementing ACL’s is a two step process:
1. create the ACL
2. apply the ACL to an interface
You can write ACL’s for a variety of conditions and scenario’s. You will learn about 3
of the basic ACL’s: Standard, Extended, and Named. Two of the other ACL’s you will
learn about in CCNP school are Dynamic (a.k.a “Lock and Key”) and Reflexive. A
standard ACL controls access using an IP address or range of addresses. An extended
ACL controls access to specific ports for IP addresses. A named ACL uses a name
instead of a number to do the same thing as standard or extended ACL’s
We have some very simple rules to follow when creating ACL’s on your router.
We have already discussed the first:
1. ACL’s are sequentially processed
2. ACL’s are compared until a match is made…if no match is made then the
packets are dropped and not processed.
3. There is an implicit “deny” statement at the end of every permit statement,
BUT no implicit “permit” statement for every deny…watch out!
4. Place standard ACL’s as close to the destination as possible. For now use
“out” with standard ACL’s on the interface (more on this later).
5. Place extended ACL’s as close to the source as possible. (The S’s do not
go together) For now use “in” with extended ACL’s on the interface.
Access Control Lists are also numbered. We have different numbers for our different
purposes, protocols, and types of ACL’s. Let’s look at those numbers now:
337