442 Chapter 12: IP Access Control List Security

ACL 101 looks a lot like ACL 101 from Example 12-6, but this time, the ACL does not bother checking for the criteria to match Larry’s traffic, because Larry’s traffic will never enter R3’s Ethernet 0 interface. Because the ACL has been placed on R3, near Bob, it watches for packets Bob sends that enter its Ethernet0 interface. Because of the ACL, Bob’s FTP traffic to 172.16.1.0/24 is denied, with all other traffic entering R3’s E0 interface making it into the network. Example 12-7 does not show any logic for stopping Larry’s traffic.

Extended IP Access Lists: Example 2

Example 12-8, based on the network shown in Figure 12-6, shows another example of how to use extended IP access lists. This example uses the same criteria and network topology as the second standard IP ACL example, as repeated here:

■Sam is not allowed access to Bugs or Daffy.

■Hosts on the Seville Ethernet are not allowed access to hosts on the Yosemite Ethernet.

■All other combinations are allowed.

Figure 12-6 Network Diagram for Extended Access List Example 2

Bugs Daffy

10.1.1.110.1.1.2

Subnet 10.1.1.0