![Page 1: Access Control Lists · ITE I Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Access Control Lists Accessing the WAN –Chapter 5](https://reader030.vdocuments.net/reader030/viewer/2022041021/5ed0716f3d22c21f4528b7d2/html5/thumbnails/1.jpg)
© 2006 Cisco Systems, Inc. All rights reserved. Cisco PublicITE I Chapter 6 1
Access Control Lists
Accessing the WAN – Chapter 5
![Page 2: Access Control Lists · ITE I Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Access Control Lists Accessing the WAN –Chapter 5](https://reader030.vdocuments.net/reader030/viewer/2022041021/5ed0716f3d22c21f4528b7d2/html5/thumbnails/2.jpg)
© 2006 Cisco Systems, Inc. All rights reserved. Cisco PublicITE 1 Chapter 6 2
Objectives
Explain how ACLs are used to secure a medium-size Enterprise branch office network.
Configure standard ACLs in a medium-size Enterprise branch office network.
Configure extended ACLs in a medium-size Enterprise branch office network.
Describe complex ACLs in a medium-size Enterprise branch office network.
Implement, verify and troubleshoot ACLs in an enterprise network environment.
![Page 3: Access Control Lists · ITE I Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Access Control Lists Accessing the WAN –Chapter 5](https://reader030.vdocuments.net/reader030/viewer/2022041021/5ed0716f3d22c21f4528b7d2/html5/thumbnails/3.jpg)
© 2006 Cisco Systems, Inc. All rights reserved. Cisco PublicITE 1 Chapter 6 3
Explain How ACLs are Used to Secure a Medium-Size Enterprise Branch Office Network
Describe the steps that occur in a complete TCP conversation
![Page 4: Access Control Lists · ITE I Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Access Control Lists Accessing the WAN –Chapter 5](https://reader030.vdocuments.net/reader030/viewer/2022041021/5ed0716f3d22c21f4528b7d2/html5/thumbnails/4.jpg)
© 2006 Cisco Systems, Inc. All rights reserved. Cisco PublicITE 1 Chapter 6 4
Explain How ACLs are Used to Secure a Medium-Size Enterprise Branch Office Network
Explain how a packet filter allows or blocks traffic
![Page 5: Access Control Lists · ITE I Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Access Control Lists Accessing the WAN –Chapter 5](https://reader030.vdocuments.net/reader030/viewer/2022041021/5ed0716f3d22c21f4528b7d2/html5/thumbnails/5.jpg)
© 2006 Cisco Systems, Inc. All rights reserved. Cisco PublicITE 1 Chapter 6 5
Explain How ACLs are Used to Secure a Medium-Size Enterprise Branch Office Network
Describe how ACLs control access to networks
![Page 6: Access Control Lists · ITE I Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Access Control Lists Accessing the WAN –Chapter 5](https://reader030.vdocuments.net/reader030/viewer/2022041021/5ed0716f3d22c21f4528b7d2/html5/thumbnails/6.jpg)
© 2006 Cisco Systems, Inc. All rights reserved. Cisco PublicITE 1 Chapter 6 6
Explain How ACLs are Used to Secure a Medium-Size Enterprise Branch Office Network
Use a flow chart to show how ACLs operate
![Page 7: Access Control Lists · ITE I Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Access Control Lists Accessing the WAN –Chapter 5](https://reader030.vdocuments.net/reader030/viewer/2022041021/5ed0716f3d22c21f4528b7d2/html5/thumbnails/7.jpg)
© 2006 Cisco Systems, Inc. All rights reserved. Cisco PublicITE 1 Chapter 6 7
Explain How ACLs are Used to Secure a Medium-Size Enterprise Branch Office Network
Describe the types and formats of ACLs
![Page 8: Access Control Lists · ITE I Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Access Control Lists Accessing the WAN –Chapter 5](https://reader030.vdocuments.net/reader030/viewer/2022041021/5ed0716f3d22c21f4528b7d2/html5/thumbnails/8.jpg)
© 2006 Cisco Systems, Inc. All rights reserved. Cisco PublicITE 1 Chapter 6 8
Explain How ACLs are Used to Secure a Medium-Size Enterprise Branch Office Network
Explain how Cisco ACLs can be identified using standardized numbering or names
![Page 9: Access Control Lists · ITE I Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Access Control Lists Accessing the WAN –Chapter 5](https://reader030.vdocuments.net/reader030/viewer/2022041021/5ed0716f3d22c21f4528b7d2/html5/thumbnails/9.jpg)
© 2006 Cisco Systems, Inc. All rights reserved. Cisco PublicITE 1 Chapter 6 9
Explain How ACLs are Used to Secure a Medium-Size Enterprise Branch Office Network
Describe where ACLs should be placed in a network
![Page 10: Access Control Lists · ITE I Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Access Control Lists Accessing the WAN –Chapter 5](https://reader030.vdocuments.net/reader030/viewer/2022041021/5ed0716f3d22c21f4528b7d2/html5/thumbnails/10.jpg)
© 2006 Cisco Systems, Inc. All rights reserved. Cisco PublicITE 1 Chapter 6 10
Explain How ACLs are Used to Secure a Medium-Size Enterprise Branch Office Network
Explain the considerations for creating ACLs
![Page 11: Access Control Lists · ITE I Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Access Control Lists Accessing the WAN –Chapter 5](https://reader030.vdocuments.net/reader030/viewer/2022041021/5ed0716f3d22c21f4528b7d2/html5/thumbnails/11.jpg)
© 2006 Cisco Systems, Inc. All rights reserved. Cisco PublicITE 1 Chapter 6 11
Configure Standard ACLs in a Medium-Size Enterprise Branch Office Network
Explain why the order in which criteria statements are entered into an ACL is important
![Page 12: Access Control Lists · ITE I Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Access Control Lists Accessing the WAN –Chapter 5](https://reader030.vdocuments.net/reader030/viewer/2022041021/5ed0716f3d22c21f4528b7d2/html5/thumbnails/12.jpg)
© 2006 Cisco Systems, Inc. All rights reserved. Cisco PublicITE 1 Chapter 6 12
Configure Standard ACLs in a Medium-Size Enterprise Branch Office Network
Explain how to configure a standard ACL
![Page 13: Access Control Lists · ITE I Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Access Control Lists Accessing the WAN –Chapter 5](https://reader030.vdocuments.net/reader030/viewer/2022041021/5ed0716f3d22c21f4528b7d2/html5/thumbnails/13.jpg)
© 2006 Cisco Systems, Inc. All rights reserved. Cisco PublicITE 1 Chapter 6 13
Configure Standard ACLs in a Medium-Size Enterprise Branch Office Network
Describe how to use wildcard masks with ACLs
![Page 14: Access Control Lists · ITE I Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Access Control Lists Accessing the WAN –Chapter 5](https://reader030.vdocuments.net/reader030/viewer/2022041021/5ed0716f3d22c21f4528b7d2/html5/thumbnails/14.jpg)
© 2006 Cisco Systems, Inc. All rights reserved. Cisco PublicITE 1 Chapter 6 14
Configure Standard ACLs in a Medium-Size Enterprise Branch Office Network
Describe how to apply a standard ACL to an interface
![Page 15: Access Control Lists · ITE I Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Access Control Lists Accessing the WAN –Chapter 5](https://reader030.vdocuments.net/reader030/viewer/2022041021/5ed0716f3d22c21f4528b7d2/html5/thumbnails/15.jpg)
© 2006 Cisco Systems, Inc. All rights reserved. Cisco PublicITE 1 Chapter 6 15
Configure Standard ACLs in a Medium-Size Enterprise Branch Office Network
Explain the process for editing numbered ACLs
![Page 16: Access Control Lists · ITE I Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Access Control Lists Accessing the WAN –Chapter 5](https://reader030.vdocuments.net/reader030/viewer/2022041021/5ed0716f3d22c21f4528b7d2/html5/thumbnails/16.jpg)
© 2006 Cisco Systems, Inc. All rights reserved. Cisco PublicITE 1 Chapter 6 16
Configure Standard ACLs in a Medium-Size Enterprise Branch Office Network
Explain how to create a named ACL
![Page 17: Access Control Lists · ITE I Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Access Control Lists Accessing the WAN –Chapter 5](https://reader030.vdocuments.net/reader030/viewer/2022041021/5ed0716f3d22c21f4528b7d2/html5/thumbnails/17.jpg)
© 2006 Cisco Systems, Inc. All rights reserved. Cisco PublicITE 1 Chapter 6 17
Configure Standard ACLs in a Medium-Size Enterprise Branch Office Network
Describe how to monitor and verify ACLs
![Page 18: Access Control Lists · ITE I Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Access Control Lists Accessing the WAN –Chapter 5](https://reader030.vdocuments.net/reader030/viewer/2022041021/5ed0716f3d22c21f4528b7d2/html5/thumbnails/18.jpg)
© 2006 Cisco Systems, Inc. All rights reserved. Cisco PublicITE 1 Chapter 6 18
Configure Standard ACLs in a Medium-Size Enterprise Branch Office Network
Explain the process for editing named ACLs
![Page 19: Access Control Lists · ITE I Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Access Control Lists Accessing the WAN –Chapter 5](https://reader030.vdocuments.net/reader030/viewer/2022041021/5ed0716f3d22c21f4528b7d2/html5/thumbnails/19.jpg)
© 2006 Cisco Systems, Inc. All rights reserved. Cisco PublicITE 1 Chapter 6 19
Configure Extended ACLs in a Medium-Size Enterprise Branch Office Network
Explain how an extended ACL provides more filtering then a standard ACL
![Page 20: Access Control Lists · ITE I Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Access Control Lists Accessing the WAN –Chapter 5](https://reader030.vdocuments.net/reader030/viewer/2022041021/5ed0716f3d22c21f4528b7d2/html5/thumbnails/20.jpg)
© 2006 Cisco Systems, Inc. All rights reserved. Cisco PublicITE 1 Chapter 6 20
Configure Extended ACLs in a Medium-Size Enterprise Branch Office Network
Describe how to configure extended ACLs
![Page 21: Access Control Lists · ITE I Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Access Control Lists Accessing the WAN –Chapter 5](https://reader030.vdocuments.net/reader030/viewer/2022041021/5ed0716f3d22c21f4528b7d2/html5/thumbnails/21.jpg)
© 2006 Cisco Systems, Inc. All rights reserved. Cisco PublicITE 1 Chapter 6 21
Configure Extended ACLs in a Medium-Size Enterprise Branch Office Network
Describe how to apply an extended ACL to an interface
![Page 22: Access Control Lists · ITE I Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Access Control Lists Accessing the WAN –Chapter 5](https://reader030.vdocuments.net/reader030/viewer/2022041021/5ed0716f3d22c21f4528b7d2/html5/thumbnails/22.jpg)
© 2006 Cisco Systems, Inc. All rights reserved. Cisco PublicITE 1 Chapter 6 22
Configure Extended ACLs in a Medium-Size Enterprise Branch Office Network
Describe how to create named extended ACLs
![Page 23: Access Control Lists · ITE I Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Access Control Lists Accessing the WAN –Chapter 5](https://reader030.vdocuments.net/reader030/viewer/2022041021/5ed0716f3d22c21f4528b7d2/html5/thumbnails/23.jpg)
© 2006 Cisco Systems, Inc. All rights reserved. Cisco PublicITE 1 Chapter 6 23
Describe Complex ACLs in a Medium-Size Enterprise Branch Office Network
List the three types of complex ACLs
![Page 24: Access Control Lists · ITE I Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Access Control Lists Accessing the WAN –Chapter 5](https://reader030.vdocuments.net/reader030/viewer/2022041021/5ed0716f3d22c21f4528b7d2/html5/thumbnails/24.jpg)
© 2006 Cisco Systems, Inc. All rights reserved. Cisco PublicITE 1 Chapter 6 24
Describe Complex ACLs in a Medium-Size Enterprise Branch Office Network
Explain how and when to use dynamic ACLs
![Page 25: Access Control Lists · ITE I Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Access Control Lists Accessing the WAN –Chapter 5](https://reader030.vdocuments.net/reader030/viewer/2022041021/5ed0716f3d22c21f4528b7d2/html5/thumbnails/25.jpg)
© 2006 Cisco Systems, Inc. All rights reserved. Cisco PublicITE 1 Chapter 6 25
Describe Complex ACLs in a Medium-Size Enterprise Branch Office Network
Explain how and when to use reflexive ACLs
![Page 26: Access Control Lists · ITE I Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Access Control Lists Accessing the WAN –Chapter 5](https://reader030.vdocuments.net/reader030/viewer/2022041021/5ed0716f3d22c21f4528b7d2/html5/thumbnails/26.jpg)
© 2006 Cisco Systems, Inc. All rights reserved. Cisco PublicITE 1 Chapter 6 26
Describe Complex ACLs in a Medium-Size Enterprise Branch Office Network
Explain how and when to use time-based ACLs
![Page 27: Access Control Lists · ITE I Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Access Control Lists Accessing the WAN –Chapter 5](https://reader030.vdocuments.net/reader030/viewer/2022041021/5ed0716f3d22c21f4528b7d2/html5/thumbnails/27.jpg)
© 2006 Cisco Systems, Inc. All rights reserved. Cisco PublicITE 1 Chapter 6 27
Describe Complex ACLs in a Medium-Size Enterprise Branch Office Network
Describe how to troubleshoot common ACL problems
![Page 28: Access Control Lists · ITE I Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Access Control Lists Accessing the WAN –Chapter 5](https://reader030.vdocuments.net/reader030/viewer/2022041021/5ed0716f3d22c21f4528b7d2/html5/thumbnails/28.jpg)
© 2006 Cisco Systems, Inc. All rights reserved. Cisco PublicITE 1 Chapter 6 28
Implement, Verify and Troubleshoot ACLs in an Enterprise Network Environment
Create, place and verify a standard/ extended ACL and verify its placement.
Verify ACL’s functionality and troubleshoot as needed.
![Page 29: Access Control Lists · ITE I Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Access Control Lists Accessing the WAN –Chapter 5](https://reader030.vdocuments.net/reader030/viewer/2022041021/5ed0716f3d22c21f4528b7d2/html5/thumbnails/29.jpg)
© 2006 Cisco Systems, Inc. All rights reserved. Cisco PublicITE 1 Chapter 6 29
Summary
An Access List (ACL) is:
A series of permit and deny statements that are used to filter traffic
Standard ACL
–Identified by numbers 1 - 99 and 1300 - 1999
–Filter traffic based on source IP address
Extended ACL
–Identified by number 100 -199 & 2000 - 2699
–Filter traffic based on
•Source IP address
•Destination IP address
•Protocol
•Port number
![Page 30: Access Control Lists · ITE I Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Access Control Lists Accessing the WAN –Chapter 5](https://reader030.vdocuments.net/reader030/viewer/2022041021/5ed0716f3d22c21f4528b7d2/html5/thumbnails/30.jpg)
© 2006 Cisco Systems, Inc. All rights reserved. Cisco PublicITE 1 Chapter 6 30
Summary
Named ACL
–Used with IOS 11.2 and above
–Can be used for either standard or extended ACL
ACL’s use Wildcard Masks (WCM)
–Described as the inverse of a subnet mask
•Reason
–0 check the bit
–1 ignore the bit
![Page 31: Access Control Lists · ITE I Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Access Control Lists Accessing the WAN –Chapter 5](https://reader030.vdocuments.net/reader030/viewer/2022041021/5ed0716f3d22c21f4528b7d2/html5/thumbnails/31.jpg)
© 2006 Cisco Systems, Inc. All rights reserved. Cisco PublicITE 1 Chapter 6 31
Summary
Implementing ACLs
–1st create the ACL
–2nd place the ACL on an interface
•Standard ACL are placed nearest the destination
•Extended ACL are placed nearest the source
Use the following commands for verifying & troubleshooting an ACL
–Show access-list
–Show interfaces
–Show run
![Page 32: Access Control Lists · ITE I Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Access Control Lists Accessing the WAN –Chapter 5](https://reader030.vdocuments.net/reader030/viewer/2022041021/5ed0716f3d22c21f4528b7d2/html5/thumbnails/32.jpg)
© 2006 Cisco Systems, Inc. All rights reserved. Cisco PublicITE 1 Chapter 6 32
Summary
Complex ACL
–Dynamic ACL
–Reflexive ACL
–Time based ACL
![Page 33: Access Control Lists · ITE I Chapter 6 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Access Control Lists Accessing the WAN –Chapter 5](https://reader030.vdocuments.net/reader030/viewer/2022041021/5ed0716f3d22c21f4528b7d2/html5/thumbnails/33.jpg)
© 2006 Cisco Systems, Inc. All rights reserved. Cisco PublicITE 1 Chapter 6 33