1. Cisco Confidential 1 © 2010 Cisco and/or its affiliates. All rights reserved. Knowledge Nugget Become an ACL Wizard – Advanced ACL Editing Bogdan Doinea - bdoinea@cisco.com Assoc. Technical Manager CEE, Russia&CIS Cisco Networking Academy

2. © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 2 Basic types of ACLs The power of Named ACLs Tips and Tricks The trick to editing Numbered ACLs Technical DEMO

3. © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 3 Numbered ACLs Standard Use only layer 3 source addresses Extended Can filter using layer3/4 information and by source/destination addresses Limitations? When editing, we can only add statements to the end of the ACL access-list 10 permit 192.168.146.0 0.0.1.255 access-list 101 permit tcp host 10.1.1.2 host 172.16.1.1 eq telnet

4. © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 4 Named ACLs have sequence numbers for each entry All ACLs have an implicit, invisible deny statement at the end ONLY if they have at least one statement Recommendation: you should always manually write the deny ip any any rule in order to see if packets matched it ip access-list extended in_to_out permit tcp host 10.1.1.2 host 172.16.1.1 eq telnet log deny ip any any ip access-list extended in_to_out permit tcp host 10.1.1.2 host 172.16.1.1 eq telnet log deny ip any any

5. © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 5 Scenario Ups! Forgot to give IP 10.1.1.3 access through ssh too! Quick solution access-list 101 permit tcp host 10.1.1.2 host 172.16.1.1 eq telnet access-list 101 permit tcp host 10.1.1.2 host 172.16.1.1 eq ssh access-list 101 deny ip 10.1.1.0 0.0.0.255 host 172.16.1.1 access-list 101 permit tcp host 10.1.1.2 host 172.16.1.1 eq telnet access-list 101 permit tcp host 10.1.1.2 host 172.16.1.1 eq ssh access-list 101 deny ip 10.1.1.0 0.0.0.255 host 172.16.1.1 ip access-list extended 101

6. © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 6 Casting: THE ROUTER CCNA

7. © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 7 Instructor Professional Development One-stop-shop http://lms.netacad.net – for more Knowledge nuggets http://lms.netacad.net Learning through Gaming: Cisco Aspire Become an ACL Wizard! Passport 21 to Entrepreneurship Online communities http://community.netacad.net CCNA Topics dedicated to ACLs

8. © 2010 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 8 Basic types of ACLs The power of Named ACLs Tips and Tricks The trick to editing Numbered ACLs Technical DEMO

9. Thank you.