1. 1 © 2004 Cisco Systems, Inc. All rights reserved. CCNA 2 v3.1 Module 11 Access Control Lists (ACLs)

2. 222 © 2004, Cisco Systems, Inc. All rights reserved. Objectives

3. 333 © 2004, Cisco Systems, Inc. All rights reserved. What are ACLs? ACLs are lists of conditions used to test network traffic that tries to travel across a router interface. These lists tell the router what types of packets to accept or deny.

4. 444 © 2004, Cisco Systems, Inc. All rights reserved. How ACLs Work

5. 555 © 2004, Cisco Systems, Inc. All rights reserved. Access Control Lists are a list of permit and deny statements which match various packets Access lists are configured in global configuration mode and applied using:- ip access-group {number} in (or out) on an interface

6. 666 © 2004, Cisco Systems, Inc. All rights reserved. Protocols with ACLs Specified by Numbers

7. 777 © 2004, Cisco Systems, Inc. All rights reserved. Standard Access Lists Access lists numbered 1 -99 or 1300 -1999 Filters traffic based on source IP address Uses wildcard masks Applied to interface closest to destination

8. 888 © 2004, Cisco Systems, Inc. All rights reserved. Extended Access Lists Access lists numbered 100-199 and 2000- 2699 Filters traffic on source and destination IP address Also filters traffic based on Layer protocols such as HTTP, ICMP etc Applied to interface closest to the source

9. 999 © 2004, Cisco Systems, Inc. All rights reserved. Creating ACLs

10. 10 © 2004, Cisco Systems, Inc. All rights reserved. The Function of a Wildcard Mask

11. 11 © 2004, Cisco Systems, Inc. All rights reserved. Wildcard Often the inverse of the subnet mask Specifies the range of IP address which match a statement

12. 12 © 2004, Cisco Systems, Inc. All rights reserved.

13. 13 © 2004, Cisco Systems, Inc. All rights reserved.

14. 14 © 2004, Cisco Systems, Inc. All rights reserved. Verifying ACLs There are many show commands that will verify the content and placement of ACLs on the router. show ip interface show access-lists Show running-config

15. 15 © 2004, Cisco Systems, Inc. All rights reserved. Standard ACLs

16. 16 © 2004, Cisco Systems, Inc. All rights reserved. Extended ACLs

17. 17 © 2004, Cisco Systems, Inc. All rights reserved. Access List Structure

18. 18 © 2004, Cisco Systems, Inc. All rights reserved. Source/ Destination The source and destination can be specified in several ways 1.IP address and mask e.g. 192.168.1.0 0.0.0.255 specified from 192.168.1.0 – 255 2.Host IP address e.g. host 192.168.1.20 specifies this host only 3.Any specifies any addresses

19. 19 © 2004, Cisco Systems, Inc. All rights reserved. Named ACLs

20. 20 © 2004, Cisco Systems, Inc. All rights reserved. Placing ACLs Standard ACLs should be placed close to the destination. Extended ACLs should be placed close to the source.

21. 21 © 2004, Cisco Systems, Inc. All rights reserved. Firewalls A firewall is an architectural structure that exists between the user and the outside world to protect the internal network from intruders.

22. 22 © 2004, Cisco Systems, Inc. All rights reserved. Restricting Virtual Terminal Access

23. 23 © 2004, Cisco Systems, Inc. All rights reserved. Summary