Sybex - CCNA 2.0 Study Guide (640-507).pdf - Cifo

Access Lists 447
On the Acme router, the following standard IP access list is applied:
Acme#config t
Acme(config)#access-list 10 deny 172.16.40.0 0.0.0.255
Acme(config)#access-list 10 permit any
It is very important to understand that the any command is the same thing
as saying this:
Acme(config)#access-list 10 permit 0.0.0.0 255.255.255.255
At this point, the access list is denying the Sales LAN and allowing everyone
else. But where should this access list be placed? If you place it as an incoming
access list on E2, you might as well shut down the Ethernet interface because
all of the Sales LAN devices are denied access to all networks attached to the
router. The best place to put this router is the E0 interface as an outbound list.
Acme(config)#int e0
Acme(config-if)#ip access-group 10 out
This completely stops network 172.16.40.0 from getting out Ethernet 0,
but it can still access the Marketing LAN and the Internet.
Controlling VTY (Telnet) Access
You will have a difficult time trying to stop users from telnetting into a
router because any active port on a router is fair game for VTY access. However,
you can use a standard IP access list to control access by placing the
access list on the VTY lines themselves.
To perform this function:
1. Create a standard IP access list that permits only the host or hosts you
want to be able to telnet into the routers.
2. Apply the access list to the VTY line with the access-class command.
Here is an example of allowing only host 172.16.10.3 to telnet into a router:
RouterA(config)#access-list 50 permit 172.16.10.3
RouterA(config)#line vty 0 4
RouterA(config-line)#access-class 50 in
Because of the implied deny any at the end of the list, the access list stops
any host from telnetting into the router except the host 172.16.10.3.