1. Restricting Access in the network
Introduction to Access Control Lists (ACLs)

2. Problem
Allow traffic from source network to be forwarded out on S0/0/0. Traffic from networks other than is blocked

3. What Are ACLs?
An ACL is a list of instructions that tells a router what type of packets to permit or deny.
Based upon such thing as:
Source address
Destination address
Upper Layer protocols (e.g. TCP & UDP port numbers)

4. Testing Packets with ACLs
Configure ACL
Apply to appropriate router interface
In or out
Tested network traffic against the ACL statements in sequential order using
Permit or deny statements
When a statement “matches,” no more statements are evaluated. The packet is either permitted or denied.
If a packet does not match any of the statements in the ACL, it is dropped.

5. Standard ACL
Write the ACL statements sequentially in global configuration mode.
Router(config)#access-list access-list- number {permit/deny} {test-conditions}
Router(config)#access-list 1 deny

6. Apply to interface
Group the ACL to one or more interfaces in interface configuration mode.
Router(config-if)#{protocol} access- group access-list-number {in/out}
Router(config)#interface fa 0/0
Router(config-if)#ip access-group 1 out
Will apply ACL on the outbound interface of the router

7. The Wildcard Mask
A wildcard mask is written to tell the router what bits in the address to match and what bits to ignore.
A “0” bit means means check this bit position. A “1” means ignore this bit position.
Our previous example of can be rewritten in binary as:
(Source address)
(Wildcard mask)
What do all the bits turned off in the wildcard mask tell the router?

8. The Wildcard Mask

9. Masking Practice
Write an ip mask and wildcard mask to check for all hosts on the network:
Answer:
Notice that this wildcard mask is a mirror image of the default subnet mask for a Class C address.
WARNING: This is a helpful rule only when looking at whole networks or subnets.

10. Test parameters in ACL various parameters that can be tested are:
Source address’ ip mask and wildcard mask.
The source address can be a subnet, a range of addresses, or a single host. It is also referred to as the ip mask because the wildcard mask uses the source address to check bits.
Destination address
Protocol
Port number
ip mask
Wild card mask
Lab-A(config)#access-list 1 deny

11. Practice Wild card masks
Write an ip mask and wildcard mask for all hosts in subnet
Write an ip mask and wildcard mask for all hosts in
Write an ip mask and wildcard mask for the host

12. Masking Practice
Write an ip mask and wildcard mask to check for all hosts in the subnet:
is the mirror image of

13. Practice wild card masks
Let’s look at both in binary:
( )
( )
To prove this wildcard mask will work, let’s look at a host address within the .32 subnet
( ) host address
( ) ip mask
( ) wildcard mask

14. Masking Practice
Write an ip mask and wildcard mask for the subnet with a subnet mask of ?
Answer:
Write an ip mask and wildcard mask for the subnet with a subnet mask of ?
Answer:

15. Problem revisited…
This ACL allows only traffic from source network to be forwarded out on S0/0/0. Traffic from networks other than is blocked.
The first line identifies the ACL as access list 1. It permits traffic that matches the selected parameters.
access-list 1 permit
The unseen implicit deny all other traffic.
The ip access-group 1 out interface configuration command links and ties ACL 1 to the Serial 0/0/0 interface as an outbound filter.
Use graphic
Use graphic

16. Applying Standard ACL to Interfaces
Example 2: an ACL that denies a specific host.
The first command deletes the previous ACL 1.
The next ACL statement, denies the PC1 host located at Every other host on the /24 network is permitted.
The implicit deny statement matches other network.
The ACL is again reapplied to interface S0/0/0 in an outbound direction.
Use graphic
Use graphic

17. Next week ..
Network address translation.