1. CISCO NETWORKING ACADEMY Chabot College ELEC 99.08 Extended Access Control Lists

2. CISCO NETWORKING ACADEMY ACL Topics Extended ACLs Editing ACLs Anatomy of an ACL

3. CISCO NETWORKING ACADEMY Extended ACLs Provide more precise (finer tuned) packet selection based on: –Source and destination addresses –Protocols –Port numbers 100-199

4. CISCO NETWORKING ACADEMY Steps to Configure ACLs 1) Create ACL (global config mode) 2) Apply to an interface (interface config mode)

5. CISCO NETWORKING ACADEMY Extended ACL operation Permits or denies if all conditions match: –Source Address –Destination Address –Protocol –Port No. or Protocol Options

6. CISCO NETWORKING ACADEMY Extended ACL Syntax Explained Network Computing has published a great summary chart of the “anatomy of an ACL”anatomy of an ACL A PDF copy of this chart is on the Semester 2 class page under “Chabot College Study Sheets”

7. CISCO NETWORKING ACADEMY Extended IP ACL command access-list ACL-number {permit|deny} protocol source-ip-address source-wildcard- mask destination-ip-address destination- wildcard-mask eq port-number ACL number: 100-199 Global Config mode

8. CISCO NETWORKING ACADEMY Extended ACL Example To permit traffic from the network 192.168.1.0 to the host 192.168.3.10 only on telnet: access-list 101 permit tcp 192.168.1.0 0.0.0.255 192.168.3.10 0.0.0.0 eq 23

9. CISCO NETWORKING ACADEMY Some Protocols with Port Numbers FTP – 21 Telnet – 23 SMTP – 25 DNS – 53 TFTP – 69 WWW, HTML – 80 POP3 - 110 SNMP - 161

10. CISCO NETWORKING ACADEMY ACL Configuration Example fre(config)#access-list 101 deny tcp any 192.168.3.10 0.0.0.0 eq 80 fre(config)#access-list 101 permit ip any any fre(config)#int e0 fre(config-if)#ip-access group 101 in fre(config-if)#^z fre hayoak 192.168.3.0 E0 S0 S1 S0 S1 What will this list do? E0 192.168.2.0192.168.1.0 192.168.1.10192.168.2.10192.168.3.10 192.168.1.11

11. CISCO NETWORKING ACADEMY ACL Configuration Example fre(config)#access-list 101 deny tcp 192.168.1.10 0.0.0.0 any eq 80 fre(config)#access-list 101 deny tcp 192.168.1.0 0.0.0.255 any eq 21 fre(config)#access-list 101 permit ip any any fre(config)#int e0 fre(config-if)#ip-access group 101 in fre(config-if)#^z fre hayoak 192.168.3.0 E0 S0 S1 S0 S1 What will this list do? E0 192.168.2.0192.168.1.0 192.168.1.10192.168.2.10192.168.3.10 192.168.1.11

12. CISCO NETWORKING ACADEMY ACL Configuration Example fre(config)#access-list 101 deny tcp 192.168.1.10 0.0.0.0 any eq 80 fre(config)#int e0 fre(config-if)#ip-access group 101 in fre(config-if)#^z fre hayoak 192.168.3.0 E0 S0 S1 S0 S1 What will this list do? (What’s wrong here?) E0 192.168.2.0192.168.1.0 192.168.2.10192.168.3.10192.168.1.10 192.168.1.11

13. CISCO NETWORKING ACADEMY Extended ACL Placement fre(config)#access-list 101 deny ip any host 192.168.3.10 fre(config)#access-list 101 permit ip any any fre(config)#int e0 fre(config-if)#ip-access group 101 in fre hayoak 192.168.3.0 E0 S0 S1 S0 S1 Blocking traffic from Fremont LAN to Oakland PC Place extended ACL close to source. E0 192.168.2.0192.168.1.0 192.168.1.10192.168.2.10192.168.3.10 192.168.1.11

14. CISCO NETWORKING ACADEMY Standard ACL Placement oak(config)#access-list 10 deny 192.168.1.0 0.0.0.255 oak(config)#access-list 10 permit any oak(config)#int e0 oak(config-if)#ip-access group 10 out fre hayoak 192.168.3.0 E0 S0 S1 S0 S1 Blocking traffic from Fremont LAN to Oakland LAN Place standard ACL close to destination. E0 192.168.2.0192.168.1.0 192.168.1.10192.168.2.10192.168.3.10 192.168.1.11

15. CISCO NETWORKING ACADEMY ACL Placement fre hayoak 192.168.3.0 E0 S0 S1 S0 S1 Blocking traffic from Fremont LAN to Oakland PC Standard or Extended ACL Which seems more efficient? Why? E0 192.168.2.0192.168.1.0 192.168.1.10192.168.2.10192.168.3.10 192.168.1.11 Extended Standard

16. CISCO NETWORKING ACADEMY Editing ACLs The exec adds new lines (rules) to an ACL at the end; probably not where you want them. To change lines in the middle, you must delete the entire list and re-enter it. Or - dump your config out to a text file & edit it as follows:

17. CISCO NETWORKING ACADEMY Editing ACLs Use Hyperterm’s “capture text” to save the config as a text file.. In your editor, renumber the existing ACL using search & replace. Edit the renumbered ACL. Paste the new ACL into your running config. On the interface where the old ACL is applied, apply the new list with the command: ip access-group XXX in/out (Make XXX the new ACL number; the old list will automatically be turned off when you turn on the new list. If you encounter problems with the new list, you can re-apply the old one with the ip-access group command.)

18. CISCO NETWORKING ACADEMY ACL Syntax Summary Network Computing has published a great summary chart of the “anatomy of an ACL”anatomy of an ACL There is a link to this chart on the Semester 2 class page under “Chabot College Study Sheets”.