Learning by Doing: CISCO Certified Network ... - SCN Research

7. Even though that ACL works let’s remove that ACL and make a better one using
reflexive ACL’s. This one will not only keep people out of the inside network but
will not “imprison” the inside network. We will set it up to be able to use icmp to
and from the inside network but anything outside of the network will not be able
to ping into it (destination net unreachable).
BrFW(config)#ip access-list extended filterincoming
BrFW(config)#permit icmp 10.0.0.0 0.255.255.255 any reflect internaltraffic
BrFW(config)#deny icmp any any
BrFW(config)#evaluate internaltraffic
BrFW(config)#ip access-list extended filteroutgoing
BrFW(config)#permit icmp 10.0.0.0 0.255.255.255 any reflect internaltraffic
BrFW(config)#evaluate internaltraffic
Then we need to apply them to the interface:
BrFW(config)#int e0/0
BrFW(config-if)#ip access-group filterincoming in
BrFW(config-if)# ip access-group filteroutgoing out
What we are doing here is creating two named ACL’s (filterincoming and
filteroutgoing). Then we select which icmp addresses will be allowed (with
wildcard mask) and then, in the same command, turn it into a reflexive ACL with
the reflect command. Last in that command we create a temporary placeholder
called “internaltraffic” which will hold our source information for the duration of
the timer. When the packets come back we ask it to be evaluated with the
information in our temporary placeholder “internaltraffic.” Finally, the reflexive
ACL is applied to an interface. Notice how we used both in and out for our
extended part…I told you earlier there are many uses of ACL’s and you would
start learning more later.
8. Test ping again. Workstation B and C should be able to ping each other but not to
A. Workstation A should now be able to ping everything.
Supplemental Lab or Challenge Activity:
1. Go out to CISCO and do some research on the features of the PIX firewall.
2. One problem with PIX firewall is they only work with IP. No IPX, Apple,
XNS, etc. How could you get around that sort of problem?
3. What are dynamic access control lists? How could I use them here?
So What Have I Learned Here?
In this lab you have learned the basics of firewall technology. As you progress in your
studies you will learn more about techniques related to firewalls and security including
content based access control, dynamic access control lists (lock and key), and AAA.
361