Foundation Summary

450 Chapter 12: IP Access Control List Security

The logic that Cisco IOS software uses with a multiple-entry ACL can be summarized as follows:

1.The matching parameters of the access-list statement are compared to the packet.

2.If a match is made, the action defined in this access-list statement (permit or deny) is performed.

3.If a match is not made in Step 2, repeat Steps 1 and 2 using each successive statement in the ACL until a match is made.

4.If no match is made with an entry in the access list, the deny action is performed.

Table 12-9 summarizes the different fields that can be matched with an extended IP ACL, as compared with standard IP ACLs.

Foundation Summary 451

Table 12-10 lists several sample access-list commands, with several options configured and some explanations.

Table 12-10 Extended access-list Commands and Logic Explanations

Figure 12-8 and Example 12-11 demonstrate a sample configuration of a numbered extended IP ACL. In this case, Bob is denied access to all FTP servers on R1’s Ethernet, and Larry is denied access to Server1’s web server.

452 Chapter 12: IP Access Control List Security

Figure 12-8 Network Diagram for Extended Access List

172.16.1.102

Jimmy Jerry

172.16.3.8 172.16.3.9

Example 12-11 R1’s Extended Access List

interface Serial0

ip address 172.16.12.1 255.255.255.0 ip access-group 101 in

interface Serial1

ip address 172.16.13.1 255.255.255.0 ip access-group 101 in

access-list 101 remark Stop Bob to FTP servers, and Larry to Server1 web access-list 101 deny tcp host 172.16.3.10 172.16.1.0 0.0.0.255 eq ftp access-list 101 deny tcp host 172.16.2.10 host 172.16.1.100 eq http access-list 101 permit ip any any

Cisco makes the following general recommendations, as mentioned in the ICND course:

■Create your ACLs using a text editor outside the router, and copy and paste the configurations into the router.

■Place extended ACLs as close to the source of the packet as possible to discard the packets quickly.

■Place standard ACLs as close to the destination of the packet as possible, because standard ACLs often discard packets that you do not want discarded when placed close to the source.

■Place more-specific statements early in the ACL.

■Disable ACLs from their interfaces (using the no ip access-group command) before making changes to the ACL.

454 Chapter 12: IP Access Control List Security

Figure 12-9 Network Diagram for Questions 10 Through 12

Andy Opie

180.3.5.13180.3.5.14

Example 12-12 Access List at Mayberry

access-list 44 permit 180.3.5.13 0.0.0.0

!

interface serial 0

ip access-group 44 out

9.Describe the types of packets that this filter discards, and specify at what point they are discarded.

10.Does the access list shown in Example 12-12 stop packets from getting to web server Governor? Why or why not?

Q&A 455

11.Referring to Figure 12-9, create and enable access lists so that access to web server Governor is allowed from hosts at any site and so that no other access to hosts in Raleigh is allowed.

12.Name all the items that a standard IP access list can examine to make a match.

13.Name all the items that an extended IP access list can examine to make a match.

14.True or false: When you use extended IP access lists to restrict vty access, the matching logic is a best match of the list rather than a first match in the list.

15.In a standard numbered IP access list with three statements, a no version of the first statement is issued in configuration mode. Immediately following, another access list configuration command is added for the same access list. How many statements are in the list now, and in what position is the newly added statement?

16.In a standard named IP access list with three statements, a no version of the first statement is issued in configuration mode. Immediately following, another access list configuration command is added for the same access list. How many statements are in the list now, and in what position is the newly added statement?

17.Name all the items that a named standard IP access list can examine to make a match.

18.Configure a named IP access list that stops packets from subnet 134.141.7.0 255.255.255.0 from exiting serial 0 on a router. Allow all other packets.

19.Configure a named IP access list that allows only packets from subnet 193.7.6.0 255.255.255.0, going to hosts in network 128.1.0.0 and using a web server in 128.1.0.0, to enter serial 0 on a router.

20.List the types of IP access lists (numbered standard, numbered extended, named standard, named extended) that can be enabled to prevent Telnet access into a router. What commands would be used to enable this function, assuming that access-list 2 was already configured to match the right packets?

21.What command lists the IP extended access lists enabled on serial 1 without showing other interfaces?

22.Name all the items that a named extended IP access list can examine to make a match.