1. © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-1 Managing IP Traffic with ACLs Introducing ACLs

2. © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-2 Outline Overview ACL Overview ACL Applications Types of ACLs ACL Operations ACL Statement Processing Wildcard Masking Process Summary

3. © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-3 Manage IP traffic as network access grows Filter packets as they pass through the router Why Use ACLs?

4. © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-4 Permit or deny packets moving through the router. Permit or deny vty access to or from the router. Without ACLs, all packets could be transmitted onto all parts of your network. ACL Applications

5. © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-5 Special handling for traffic based on packet tests Other ACL Uses

6. © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-6 Standard ACL –Checks source address –Generally permits or denies entire protocol suite Extended ACL –Checks source and destination address –Generally permits or denies specific protocols Types of ACLs

7. © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-7 How to Identify ACLs Standard IP lists (1-99) test conditions of all IP packets from source addresses. Extended IP lists (100-199) test conditions of source and destination addresses, specific TCP/IP protocols, and destination ports. Standard IP lists (1300-1999) (expanded range). Extended IP lists (2000-2699) (expanded range). Other ACL number ranges test conditions for other networking protocols. Named ACLs identify IP standard and extended ACLs with an alphanumeric string (name).

8. © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-8 Testing Packets with Standard ACLs

9. © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-9 Testing Packets with Extended ACLs

10. © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-10 Outbound ACL Operation If no ACL statement matches, discard the packet.

11. © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-11 A List of Tests: Deny or Permit

12. © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-12 0 means check value of corresponding address bit. 1 means ignore value of corresponding address bit. Wildcard Bits: How to Check the Corresponding Address Bits

13. © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-13 172.30.16.29 0.0.0.0 checks all of the address bits. Abbreviate this wildcard mask using the IP address preceded by the keyword host (host 172.30.16.29). Check all of the address bits (match all). Verify an IP host address, for example: Wildcard Bits to Match a Specific IP Host Address

14. © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-14 Test conditions: Ignore all the address bits (match any). An IP host address, for example: Accept any address: any Abbreviate expression with keyword “any” Wildcard Bits to Match Any IP Address

15. © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-15 Check for IP subnets 172.30.16.0/24 to 172.30.31.0/24. Address and wildcard mask: 172.30.16.0 0.0.15.255 Wildcard Bits to Match IP Subnets

16. © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-16 Summary ACLs allow the packet flow to be filtered into or out of router interfaces and vty ports to help limit network traffic and restrict network use by certain users or devices. ACLs can be used to classify and differentiate traffic for special handling. Standard ACLs check the source addresses of packets that could be routed. Extended ACLs check both source and destination packet addresses.

17. © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-17 Summary (Cont.) Inbound ACLs process incoming packets as they enter the router. Outbound ACLs process outgoing packets before they leave an outbound interface. ACL statements operate in sequential, logical order. ACL statements evaluate packets from the top down, one statement at a time, until a matching statement is found. ACL address wildcard masking can be used to identify how to check or ignore corresponding IP address bits. Wildcard masking uses the number 1 and the number 0 to identify how to treat the corresponding IP address bits.

18. © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-18