BROCADE IP PRIMER

Console49F Link 50F1 3 5 7 9 11 13 15 17 19 21 23 25 27 29 31 33 35 37 39 41 43 45 47Power1F 2F 3F 4F2 4 6 8 10 12 14 16 18 20 22 24 26 28 30 32 34 36 38 40 42 44 46 48Console49F Link 50F1 3 5 7 9 11 13 15 17 19 21 23 25 27 29 31 33 35 37 39 41 43 45 47Power1F 2F 3F 4F2 4 6 8 10 12 14 16 18 20 22 24 26 28 30 32 34 36 38 40 42 44 46 48Chapter 14: Security, Redundancy and Moree110.1.1.1/24e310.2.2.1/2410.1.1.0/24 10.2.2.0/24Access-list 1 deny 10.1.1.0 0:0:0:255Standard IP ACLAs defined, this ACL will actually do more than you intended. At the end ofevery ACL is an implicit “deny any.” This means that if traffic isn't explicitly permitted,it's denied (guilty until proven innocent). This ACL is not only denyingtraffic from 10.1.1.0/24, but it's denying traffic from everywhere! Let's try todefine the ACL again, so that it will deny just 10.1.1.0/24, but allow everythingelse.e110.1.1.1/24e310.2.2.1/2410.1.1.0/24 10.2.2.0/24Access-list 1 deny 10.1.1.0 0.0.0.255Access-list 1 permit anyAccess-list 1 deny anyStandard IP ACLACLs are read from top to bottom. If a packet doesn't match the first line, itgoes on to the next. If it doesn't match any lines, it will fall under the implicit“deny any,” and be dropped. In this case, if the packet is coming from10.1.1.0/24, the first line will match it, and deny it. If it is coming from anyother address, it will not match the first line, but will match the second line(“permit any”), and will be allowed through. The “any” keyword actually translatesto the address and wildcard mask of “0.0.0.0 255.255.255.255.” Thewildcard mask is all 1's. This means that any of the bits can change. You mightfind it easier to remember and use the word “any,” but you can certainly use“0.0.0.0 255.255.255.255” as well. They mean the same thing.Extended IP Access ListsBut what if you want to restrict access using more criteria than just the sourceIP address? What if you actually want to permit a range of IP addresses, butonly for, say, HTTP (TCP 80) traffic? Or what if you want to permit a range of IPaddresses, but only if they are bound for a specific destination IP address?This is why we have Extended IP access lists.Standard IP access lists will match traffic only on the source IP address of thepacket. Extended IP access lists will match traffic based on source IP address,destination IP address, and protocol. With that, let's go back to our example.Let's say we want the 10.1.1.0/24 network to be able to reach the 10.2.2.0/24network, but only if they're communicating using TCP 80 (HTTP) to the webserver (say, 10.2.2.10).292 Brocade IP Primer