Data Communications Networking Devices - 4th Ed.pdf

7.4 SECURITY DEVICES ___________________________________________________________ 797entry to the top of the access list, or pre®x the two access list entries with thefollowing entry:access-list deny 198.*.*.*, 80Reversing access list entries would result in the following access list:access-list deny *.*.*.*, 80access-list permit 198.*.*.*, *Now the ®rst entry would deny all HTTP inbound traf®c while the second entrywould allow all traf®c from network 198; however, since HTTP was previouslybarred, the second entry would only enable non-HTTP traf®c from network 198.The use of three entries in the access list would result in the following list:access-list deny 198.*.*.*, 80access-list permit 198.*.*.*, *access-list deny *.*.*.*, 80Now the ®rst entry speci®cally denies HTTP access from network 198 while thesecond entry allows all traf®c from network 198 other than HTTP that waspreviously barred. The third entry denies HTTP from all other network locations.It should be noted that depending upon whether the general access default ispermit or deny, you may at worst be required to modify your access list or at besthave extraneous statements in your access list. For example, if your router's defaultis to deny all packets unless speci®cally permitted and you want to allow all packetsfrom network 198 to include HTTP, you would only need one access list entry.That entry would be:access-list permit 198.*.*.*, *Extended access listsRecognizing that routers can have multiple LAN interfaces, a logical extension ofan access list is to apply list entries to speci®c ports. Thus, a second generic accesslist format is shown below:access-list fpermit j denyg port-out, source address, portHere the port-out entry is a numeric which identi®es a LAN interface.To illustrate the application of this extended access list, let's assume a router isused to interconnect two LANs to the Internet as illustrated in Figure 7.41. Let'sfurther assume that the Token-Ring network provides connectivity to an internalcorporate network while the Ethernet LAN contains a public access Web server.Thus, one possible extended access list might be as follows:access-list permit 1, *.*.*.*, 80access-list permit 2, *.*.*.*, 25