Learning by Doing: CISCO Certified Network ... - SCN Research

Now we just need to do the second step: apply it to an interface. Since this is a standard
ACL we want to apply it as close to the destination as possible using “out.” If we look at
our diagram we can see that the Ethernet interface 0/0 is the closest to the destination
network.
Router(config)#interface e0/0
Router(config-if)#ip access-group 1 out
Extended ACL’s
An extended ACL controls access to specific ports for IP addresses. Here we are doing
basically the same thing but restricting access for something specific like ftp access,
telnet access, or even icmp access. Using our lab diagram again let’s write an ACL for
the EGR network to have no (deny) telnet access to the HR network:
(1) Create the ACL:
a. Router(config)#access-list 100 deny tcp 192.168.30.0 0.0.0.255 any eq 23
b. Router(config)#access-list 100 permit ip any any
(2) Apply the ACL to an interface:
a. Router(config)int e0/2
b. Router(config-if)#ip access-group 100 in
Using our lab diagram again let’s write an ACL for the EGR network to have no (deny)
ability to ping (icmp) to the HR network:
(1) Create the ACL:
a. Router(config)#access-list 100 deny icmp 192.168.30.0 0.0.0.255
b. Router(config)#access-list 100 permit icmp any any
(2) Apply the ACL to an interface:
a. Router(config)int e0/2
b. Router(config-if)#ip access-group 100 in
Named ACL’s
A named ACL uses a name instead of a number to do the same thing as standard or
extended ACL’s. Let’s write a named ACL to for hosts on the sales network to be denied
access to the HR server, but allow them access to the marketing network and the WWW.
Notice the changes in the prompt.
(1) Create the ACL:
a. Router(config)#ip access-list standard no_salesHR
b. Router(config-std-nacl)#deny 192.168.40.0 0.0.0.255
c. Router(config-std-nacl)#permit ip any
(2) Apply the ACL to an interface:
a. Router(config)#interface e0/0
b. Router(config-if)#ip access-group no_salesHR out
339