CN2668 Routers and Switches

1. CN2668Routers and Switches Kemtis Kunanuraksapong MSIS with Distinction MCTS, MCDST, MCP, A+

2. Agenda • Chapter 10: Access Lists • Exercise • Quiz

3. Access Lists: Usage and Rules • Permit or deny statements that filter traffic based on the source address, destination address, protocol type, and port number of a packet

4. Access List Usage • Examines a packet for the source header information • deny any statement • Implicitly blocks all packets that do not meet the requirements of the access list • It blocks even though it is not shown in the access list • Permit any statement • Allow everything beside what you state to deny in access list

5. Problems with Access Lists • Lack of planning • The need to enter the list sequentially into the router • You cannot move individual statements once they are entered • When making changes, you must remove the list, using the no access-list [list number] command, and then retype the commands • Access lists begin working the second they are applied to an interface • Use reload in [hh:mm] or reload at hh:mm [month day | day month] to reset the router if you messed up • If you did not save it to the startup configuration • Use reload cancel to reset the reload

6. Access List Rules • Example of the structure of a standard IP access list: RouterA(config)#access-list 1 deny 172.22.5.2 0.0.0.0 RouterA(config)#access-list 1 deny 172.22.5.3 0.0.0.0 RouterA(config)# access-list 1 permit any • Router applies each line in the order in which you type it into the access list • The no access-list [list #] command is used to remove an access list otherwise newline will be appended to the end of the list

7. Access List Rules (Continued) • Most specific rule should be first in the list • So that packets will not undergo unnecessary processing • You should avoid unnecessarily long access lists

8. Access List Rules (Continued) • Access lists must be applied to an interface as either inbound or outbound traffic filters • Ip access-group 1 [in | out] • Only one list, per protocol, per direction can be applied to an interface

9. Standard IP Access Lists • Filter network traffic based on the source IP address only • Filter traffic by a host IP, subnet, or a network address • It should be placed as close to the destination as possible • Configure standard IP access lists: • access-list [list #] [permit|deny] [source address] [source wildcard mask] • See Table 10-1 on Page 265

10. Standard IP Access List Examples • Based on Figure 10-9 and 10-9 on Page 268 • You will not be able to block anything since access list is applied outbound • You should apply access list as inbound on Serial0/1 interface instead if you want to block all traffic from the other subnet

11. Standard IP Access List Examples (Continued) • To view the access lists defined on your router, use the show access-lists command • For IP access lists, you could use the show ip access-lists command • See Figure 10-11 and 10-12 on Page 270 • If an access list needs to be removed • no ip access-group [list #] • See Figure 10-13 and 10-14 on Page 271

12. Extended IP Access Lists • Can filter by source IP address, destination IP address, protocol type, and application port number • This granularity allows you to design extended IP access lists that: • Permit or deny a single type of IP protocol • Filter by a particular port of a particular protocol

13. Extended IP Access Lists (Continued) • Create the list • Apply it to an interface • access-list [list #] [permit|deny] [protocol] [source IP address] [source wildcard mask] [operator] [port] [destination IP address] [destination wildcard mask] [operator] [port] [log]

14. Extended IP Access List Examples • Based on Figure 10-18 on Page 274 • Access-list 100-199 are for IP Extended access list • You can use host instead of wildcard mask as shown in Figure 10-20 on Page 276 • It should be placed as close to the source as possible

15. The “Established” Parameter • Permits traffic from any host on any network to any destination, as long as the traffic was in response to a request initiated inside the network • Example: access-list 100 permit tcp any 15.0.0.0 0.255.255.255 established • The traffic will be allowed as long as it was sent from 15.0.0.0

16. Using Named Lists • Named access lists • In Cisco IOS versions 11.2 and above, names instead of numbers can be used to identify lists • To name a standard IP access list, use the following syntax: RouterC(config)#ip access-list standard [name] • To name an extended IP access list, use the following syntax: RouterC(config)#ip access-list extended [name]

17. Using Named Lists (Continued) • Advantages: • Allows you to maintain security by using an easily identifiable access list • With named access lists lines can be selectively deleted in the ACL • Removes the limit of 100 lists per filter type • Named ACLs provide greater flexibility to network administrators who work in environments where large numbers of ACLs are needed

18. Controlling VTY Line Access • Access lists are used for both traffic flow and security • You must first create a standard IP access list that permits the management workstation RouterA(config)#access-list 12 permit 192.168.12.12 0.0.0.0 • Then, it must be applied to the VTY lines access-class [acl #] in | out

19. Controlling VTY Line Access (Continued) • To apply access list 12 to the VTY lines, use the following command: RouterA(config)#line vty 0 4 RouterA(config-line)#access-class 12 in • The commands to restrict access to the VTY lines to network 192.168.12.0/24 only are: RouterA(config)#access-list 13 permit 192.168.12.0 0.0.0.255 RouterA(config)#line vty 0 4 RouterA(config-line)#access-class 13 in

20. Assignment • Lab