In the previous video, we already learn about standard access list, 2
so the case is we block the packet from vlan 20 to the server. 3
We assign the access list in the fa0/0 with direction out. 4
Next in this video, we are going to learn more about direction. 5
We will remove the access-group in the fa0/0 and then try to assign the access list to fa0/1. 6
And absolutely if we assign the access list to fa0/1, the direction will be in, 7
because if we see the flow, from vlan 20 go to server, the packet will be go like this. 8
So here in the fa0/1, the packet will be in, but in fa0/0, the packet will be out. 9
Okay now let’s go to interface fa0/0, and then no ip access-group 1 out. 10
Now the access list is not assign to any interface, so now, vlan 20 should be able 11
to ping to the server again, let’s try. Okay here we can see that the result is success. 12
Now let’s assign the access-list to fa0/1, interface fa0/1, ip access-group 1 in. 13
Let’s test from vlan 20 to the server again, 14
okay here failed. Test again from vlan 20 to server 2, also failed. 15
Let’s see the access-list, do show access-list, here we can see that now the match is 6. 16
Okay now let’s talk more about direction. 17
If we assign the access-list in fa0/1 with direction in like this, the packet that blocked 18
is not only from vlan 20 to the server, but from vlan 20 to the router will also blocked. 19
Why? Remember that we assign the access list in the fa0/1, 20
so packet from vlan 20 to the router will also blocked here. 21
Let’s test it, vlan 20 to the router 2, here we can see that the result Is failed, test again, 22
still failed. 23
Let’s see the access list, here we can see that now the match is 8. 24
Let’s test from vlan 10 to pc 2, success, vlan 10 to the server, also success. 25
Okay so if we assign the access list in fa0/0, from vlan 20 to the router is still success, 26
but to the server absolutely failed. 27
But if we assign the access list in fa0/1, from vlan 20 to the router is already blocked. 28
Let’s try, now let’s remove the access list from fa0/1, interface fa0/1, no ip access-group 1 in, 29
and then let’s assign the access list to fa0/0 again, interface fa0/0, ip access-group 1 out. 30
Okay now from vlan 20 to the router should be success. Let’s test it, 31
Okay here we can see that the result is success. Let’s see the access list , do show access-list, 32
here we can see that the match on second rule is 19, let’s test again, show again, okay here we can 33
see that the match is still 19, this is because we assign the access list to fa0/0, 34
and the packet from vlan 20 to the router is not go through fa0/0, this is why the packet is not match. 35
Some of you may be have a question, why we don’t configure access list on router1. 36
If we configure access list on router 1, we can assign the access list to fa0/0 or fa0/1, 37
if we assign to fa0/0, 38
the direction is in, and we assign the access list to fa0/1, the direction is out. 39
Let’s say we assign the access list on fa0/0, so from vlan 20 to router 1, 40
router 2, and server will be blocked. 41
Let’s try it, unassign the access list on router2 first, here we assign the access list to fa0/0, 42
go to interface fa0/0, and then no ip access-group 1 out. 43
Next we can copy the access list configuration, 44
and then next we will paste the configuration to router 1, do show run, 45
this is the access list configuration, copy. 46
Now let’s configure the access list on router 1. 47
Enable, configure terminal, let’s just paste the access list from router 2. 48
Next, let’s assign the access list to interface, 49
let’s say we will assign to fa0/0, so interface fa0/0, ip access-group 1 in. 50
Now from vlan 20 to router 1, router 2, and server should be blocked. Let’s test it. 51
Okay this is success, test again from pc 2 to router 1, still success. 52
Let’s check it, do show access list, okay here nothing match with the access list. 53
This is because the interface that connected to vlan 20 is not fa0/0, but fa0/0.20, 54
so let unassign the access list from fa0/0, 55
and then go to interface fa0/0.20. ip access-group 1 in. 56
Let’s test again, from vlan 20 to router1, failed, vlan 20 to router 2, 57
also failed, vlan 20 to server, also failed. 58
Let’s see the access list again, 59
do show access-list, here we can see that the match is 3. This is because we send 3 packet. 60
Okay, so now from vlan 20 to anywhere is blocked. 61
This is why we configure the access list on router 2, because if we configure the 62
access list on router 1, so from vlan 20 to router 1 and router 2 will also blocked. 63
Let’s unassign the access list, no ip access-group 1 in, 64
Test the ping again, 65
okay success. 66
Now let’s assign the access list on router 2 again, 67
Interface fa0/0, ip access-group 1 out. 68
Let’s test again, vlan 20 to router, success, vlan 20 to router 2 also success, 69
vlan 20 to server, okay this is failed. 70
Okay I hope you understand the implementation of direction in access list. 71
I think enough for this video 72
Thankyou for watching and see you on the next video.