BROCADE IP PRIMER

Security: Access Control Lists (ACL)octet is “4.” When the 15th bit is a value of one, the second octet is “6.” Therefore,this one line (“10.4.1.0 0.2.0.255”) will represent all of the addresses inboth networks.But what if you have four different networks? Let's use 10.4.1.0/24, 10.5.1.0/24, 10.6.1.0/24, and 10.7.1.0/24. Well, take a look at the previous example.We would just need to represent more wildcard bits to the second octet, right?Did you come up with “10.4.1.0 0.3.0.255?” If you did, great! That's the rightanswer! If not, don't worry. There are certainly no rules stating that you mustcome up with the most efficient rule. You could still represent all four networkswith four separate lines (e.g., “10.4.1.0 0.0.0.255,” “10.5.1.0 0.0.0.255,”etc.). You may find that the flexibility of the wildcard mask may make your lifeeasier. And either way, it always helps to know what your options are.Numbered Access ListsIn the early days of ACLs, each list was defined by giving it a number. Seemssimple enough, right? But we also had to distinguish if this was an ACL for, say,IP, IPX, DECnet, XNS, AppleTalk, etc. How would the router be able to tell themapart?To solve this problem, each type was given a numeric range. A few includedStandard IP (1-99), Extended IP (100-199), Standard IPX (800-899), AppleTalk(600-699), and so on. Each type of network ACL would receive a documentedrange of 100 numbers (except for Standard IP, which is stuck with 99).This system worked fine for many years, but it has recently become much lesspractical. For instance, so many of these other networking protocols arebecoming less popular (some are no longer supported on modern equipment).TCP/IP is here to stay. This means that, for many customers, there are a lot ofwasted ACL numbers. Even if you're only using IP, you are still restricted to therange of 1-99 for Standard IP and 100-199 for Extended IP. Then, there's themore obvious question: what if we need to define more than 100 ACLs on oneswitch? Using numbered ACLs, you're out of luck.Numbered ACLs are still used today. On modern switches, support for protocolsother than IP have been removed. If you are configuring numbered ACLs,you have a choice between Standard IP (1-99) and Extended IP (100-199).That's it.Now, what's all this about “Standard IP” and “Extended IP?” What are they?What's the difference between them? Well, let's talk about that.Standard IP Access ListsA Standard IP access list will permit or deny traffic according to the source IPaddress of the traffic. For example, let's say you had two networks: 10.1.1.0/24 and 10.2.2.0/24. Let's say that 10.2.2.0/24 was the Accounting network,so you wanted to severely limit anyone from communicating to that network(for security's sake). You could create a Standard IP access list that denies trafficcoming from 10.1.1.0/24.Brocade IP Primer 291