C H A P T E R12

IP Access Control List Security

Network security is one of the hottest topics in networking today. Although security has always been important, the evolution of the Internet has created more security exposures. In years past, most companies were not permanently connected to a global network—a network through which others could attempt to illegally access their networks. Today, because most companies connect to the Internet, many companies receive significant income through their network-based facilities—facts that increase the exposure and increase the impact when security is breached.

Cisco routers can be used as part of a good overall security strategy. The most important tool in Cisco IOS software used as part of that strategy are Access Control Lists (ACLs). ACLs define rules that can be used to prevent some packets from flowing through the network. Whether you simply prevent anyone not in the accounting department from accessing the payroll server, or whether you are trying to stop Internet hackers from bringing your e-commerce web server to its knees, IOS ACLs can be a key security tool that is part of a larger security strategy.

If you’re studying for the ICND exam, this chapter is the last chapter before you begin the review process. If you’re using both this book and CCNA INTRO Exam Certification Guide to get your CCNA certification by passing just one exam (the CCNA exam), after finishing this chapter you should go back to CCNA INTRO Exam Certification Guide and read Chapter 16, “Final Preparation.” As always, refer to the Introduction in this book for a suggested reading plan if you’re using both books to study for the combined exam.

“Do I Know This Already?” Quiz

The purpose of the “Do I Know This Already?” quiz is to help you decide if you need to read the entire chapter. If you intend to read the entire chapter, you do not necessarily need to answer these questions now.

The eight-question quiz, derived from the major sections in the “Foundation Topics” section, helps you determine how to spend your limited study time.

424 Chapter 12: IP Access Control List Security

Table 12-1 outlines the major topics discussed in this chapter and the “Do I Know This Already?” quiz questions that correspond to those topics.

Table 12-1 “Do I Know This Already?” Foundation Topics Section-to-Question Mapping

CAUTION The goal of self-assessment is to gauge your mastery of the topics in this chapter. If you don’t know the answer to a question or you’re only partially sure of the answer, you should mark this question as wrong for purposes of the self-assessment. Giving yourself credit for an answer you guess correctly skews your self-assessment results and might give you a false sense of security.

1.Barney is a host with IP address 10.1.1.1 in subnet 10.1.1.0/24. Which of the following are things that a standard IP ACL could be configured to do?

a.Match the exact source IP address

b.Match IP addresses 10.1.1.1 through 10.1.1.4 with one access-list command without matching other IP addresses

c.Match all IP addresses in Barney’s subnet with one access-list command without matching other IP addresses

d.Match only the packet’s destination IP address

2.Which of the following fields cannot be compared based on an extended IP ACL?

a.Protocol

b.Source IP address

c.Destination IP address

d.TOS byte

e.URL

f.Filename for FTP transfers

g.All of the above

h.None of the above

“Do I Know This Already?” Quiz 425

3.Which of the following fields can be compared using a named IP ACL but not a numbered extended IP ACL?

a.Protocol

b.Source IP address

c.Destination IP address

d.TOS byte

e.URL

f.Filename for FTP transfers

g.All of the above

h.None of the above

4.Which of the following wildcard masks is most useful for matching all IP packets in subnet 10.1.128.0, mask 255.255.255.0?

a.0.0.0.0

b.0.0.0.31

c.0.0.0.240

d.0.0.0.255

e.0.0.15.0

f.0.0.248.255

g.0.0.255.255

h.0.255.255.255

i.255.255.255.255

5.Which of the following wildcard masks is most useful for matching all IP packets in subnet 10.1.128.0, mask 255.255.240.0?

a.0.0.0.0

b.0.0.0.31

c.0.0.0.240

d.0.0.0.255

e.0.0.15.255

f.0.0.248.255

g.0.0.255.255

h.0.255.255.255

i.255.255.255.255

426Chapter 12: IP Access Control List Security

6.Which of the following access-list commands permits traffic that matches packets going to a web server from 10.1.1.1 for all web servers whose IP addresses begin with 172.16.5?

a.access-list 101 permit tcp host 10.1.1.1 172.16.5.0 0.0.0.255 eq www

b.access-list 1951 permit ip host 10.1.1.1 172.16.5.0 0.0.0.255 eq www

c.access-list 2523 permit ip host 10.1.1.1 eq www 172.16.5.0 0.0.0.255

d.access-list 2523 permit tcp host 10.1.1.1 eq www 172.16.5.0 0.0.0.255

e.access-list 2523 permit tcp host 10.1.1.1 172.16.5.0 0.0.0.255 eq www

7.Which of the following access-list commands permits traffic that matches packets going to a web client from all web servers whose IP addresses begin with 172.16.5?

a.access-list 101 permit tcp host 10.1.1.1 172.16.5.0 0.0.0.255 eq www

b.access-list 1951 permit ip host 10.1.1.1 172.16.5.0 0.0.0.255 eq www

c.access-list 2523 permit tcp any eq www 172.16.5.0 0.0.0.255

d.access-list 2523 permit tcp 172.16.5.0 0.0.0.255 eq www 172.16.5.0 0.0.0.255

e.access-list 2523 permit tcp 172.16.5.0 0.0.0.255 eq www any

8.What general guideline should be followed when placing IP ACLs, at least according to the ICND course on which CCNA is based?

a.Perform all filtering on output if at all possible.

b.Put more-general statements early in the ACL.

c.Filter packets as close to the source as possible.

d.Order the ACL commands based on the source IP addresses, lowest to highest, to improve performance.

The answers to the “Do I Know This Already?” quiz appear in Appendix A. The suggested choices for your next step are as follows:

■6 or less overall score—Read the entire chapter. This includes the “Foundation Topics,” “Foundation Summary,” and “Q&A” sections.

■7 or 8 overall score—If you want more review on these topics, skip to the “Foundation Summary” section and then go to the “Q&A” section. Otherwise, move to the next chapter.