1. Day 4
Security ( ACL ) , Standard Access Lists , Extended Access Lists, Named ACLs
Network Address Translation (NAT), Static NAT , Dynamic NAT , PAT (Overloading)
LAB Configuration

2. Access Control Lists Access Control lists - Standard 1-99 ,1300-1999
- Extended ,
Standard access list (1-99)
Config#access-list _______ ______ ______ ______ Ex
Config#access-list 1 deny
Config#access-list 1 permit any
Config#interface S0
Config#ip access-group 1 in
(SA)
(wildcard)
(access number)
(permit,deny)

3. Access Control Lists Standard access list (1-99)
#show ip interface S0 เพื่อตรวจสอบว่า access-list ถูก set ไว้หรือไม่
Ex Block telnet
Config#access-list 2 deny
Config#access-list 2 permit any
Config#line vty 0 4
(config-line)#access-class 2 in

4. Access Control Lists Extended access list (100-199)
config#access-list __________ _________ ___________ ____ ______
_____ ________ __________ _________ Ex
Config#access-list 101 deny tcp eq 23
Config#access-list 101 permit ip any any
config#interface S0
config-if#ip access-group 101 in SA
wildcard
(access number)
(permit,deny)
(protocol tcp,udp,icmp) DA
wildcard
Eq,Neq,lt,gt
Port number

5. Access Control Lists Name access list Config#ip access-list _______
Ex Standdard
config#ip access-list standard Internet
config# permit
config#permit
config#interface e0
config-if#ip access-group internet in
Standard
Extended
Name
Ex Extended
config#ip access-list extended BlockVirus2
config#deny tcp any any eq 135
Config#deny tcp any any eq 4899
Config#permit ip any any
config#interface S0
config-if#ip access-group BlockVirus2 in

6. Well-Known Port ECHO Server ---> TCP/7 DISCARD Server ---> TCP/9
DAYTIME Server > TCP/13
CHARGET Server ---> TCP/19
FTP Server ---> TCP/21
SSH Server ---> TCP/22
Telnet Server ---> TCP/23
SMTP Server ---> TCP/25
DNS Server ---> TCP/53 and UDP/53
DHCP Server ---> UDP/68
Web Server ---> TCP/80 (HTTP)
Secure Web Server ---> TCP/443 (HTTPS)
POP3 Server ---> TCP/110
IMAP Server ---> TCP/143
SNMP Server ---> UDP/161
LDAP Server ---> TCP/389
Web Proxy Server ---> TCP/3128 or TCP/8080
The Well Known Ports are those from 0 through 1023.

7. Network AddressTranslation
NAT
Static
dynamic
Overloading
Config#ip nat inside source static
Config#interface e0
Config-if#ip nat inside
#debug ip nat เพื่อตรวจสอบดูว่ามีการทำ nat static หรือไม่
Config#interface S0
Config-if#ip nat outside

8. ตัวอย่าง routerB#debug ip nat
00:28:33: NAT: s= > , d= [1276]
00:28:33: NAT*: s= , d= > [1276]
00:28:34: NAT*: s= > , d= [1277]
00:28:34: NAT*: s= , d= > [1277]
00:28:35: NAT*: s= > , d= [1279]
00:28:35: NAT*: s= , d= > [1279]
00:28:36: NAT*: s= > , d= [1281]
00:28:36: NAT*: s= , d= > [1281]
00:28:42: NAT*: s= > , d= [1283]
00:28:42: NAT*: s= , d= > [1283]

9. Network AddressTranslation
Dynamic
Config#ip nat pool name pool start ip end ip netmask netmask Ex
Config#ip nat pool ISP netmask
Config#access-list 1 permit
Config#ip nat inside source list 1 pool ISP
Config#interface e0 Config#interface S0
Config-if#ip nat inside Config-if#ip nat outside

10. Network AddressTranslation
Overloading
Config#access-list 1 permit
Config#ip nat inside source list 1 interface S0 overload
หรือ สามารถทำ overloading แบบ dynamic
Config#ip nat inside source list 1 pool name pool overload
Config#interface e0 Config#interface S0
Config-if#ip nat inside Config-if#ip nat outside

11. ตัวอย่าง routerB#debug ip nat
00:41:39: NAT: s= > , d= [1789]
00:41:39: NAT*: s= , d= > [1789]
00:41:40: NAT*: s= > , d= [1790]
00:41:40: NAT*: s= , d= > [1790]
00:41:41: NAT*: s= > , d= [1792]
00:41:41: NAT*: s= , d= > [1792]
00:41:42: NAT*: s= > , d= [1794]
00:41:42: NAT*: s= , d= > [1794]
00:41:43: NAT*: s= > , d= [1795]
00:41:43: NAT*: s= , d= > [1795]
00:41:44: NAT*: s= > , d= [1797]
00:41:44: NAT*: s= , d= > [1797]

12. ตัวอย่าง routerB#debug ip nat
00:52:12: NAT*: s= > , d= [2332]
00:52:12: NAT*: s= , d= > [2332]
00:52:13: NAT*: s= > , d= [2333]
00:52:13: NAT*: s= , d= > [2333]
00:52:14: NAT*: s= > , d= [2337]
00:52:14: NAT*: s= , d= > [2337]
00:52:15: NAT*: s= > , d= [2339]
00:52:15: NAT*: s= , d= > [2339]
00:52:16: NAT*: s= > , d= [2340]
00:52:16: NAT*: s= , d= > [2340]
00:52:17: NAT*: s= > , d= [2342]
00:52:17: NAT*: s= , d= > [2342]

13. Ex Static NAT ip nat inside source list 7 interface Serial0 overload
ip nat inside source static tcp extendable
ip nat inside source static udp extendable
ip nat inside source static udp extendable
ip nat inside source static tcp extendable
ip nat inside source static tcp extendable
ip nat inside source static tcp extendable
ip nat inside source static tcp extendable
ip nat inside source static tcp extendable
ip nat inside source static tcp extendable
ip nat inside source static tcp extendable
ip nat inside source static udp extendable
ip nat inside source static tcp extendable
ip nat inside source static tcp extendable
ip nat inside source static tcp extendable
ip nat inside source static udp extendable
ip nat inside source static tcp extendable