In the previous video, we already learn about direction in access list. 2
Now we have an access list to block from vlan 20 to the server. 3
Let’s check it, do show access list, here we have access list 1 to block 4
from vlan 20 and permit any, and this access list is assign to interface fa0/0, 5
let’s check it, 6
here we can see that in fa0/0, there is a command to assign the access-list. 7
In the router 1, actually we also have access-list, 8
let’s check it, here we also have access-list 1. But if we try show run, 9
here we can see that the access list is not assign to any interface. So this access list is not used. 10
So now, from vlan 20 to router 1 and router 2 should be ok, but vlan 20 to server will failed. 11
Now let’s try with new case, let’s say we also want to block from pc 0 to the server. 12
Pay attention that we only block from pc0, not from vlan 10. 13
So pc 1 should be able to ping to the server. but vlan 20 and pc 0 should be failed. 14
Let’s try it first, pc 0 to server, okay this is success. 15
So now let’s add the access list to block from pc 0. Let’s check the ip address of pc 0 first, 16
here we can see that the ip address is 192.168.10.2. 17
Okay go to router 2, configure terminal, and then access-list 18
1 deny, because we only want to block 1 pc, so we can use host. 19
So deny host, and then the ip address of pc 0, which is 192.168.10.2. 20
Let’s see the access list again, 21
here we can see that now we have rule to block from 192.168.10.2, which is pc 0. 22
Let’s test ping from pc 0 to server again, here we can see that the result is still success. 23
Let’s see on the router 2, do show access list. we can see that we don’t have any match here. 24
But we have new match in the permit any, the match for permit any before is 21, but now 22. 25
So the packet from pc 0 to the server is match with this rule. 26
Let’s test again, here the match is 22, let’s test send packet from pc 0 to the server, 27
let’s see in the router again, here we can see that now the match in the permit any is 23. 28
why packet from pc 0 match with this rule? This is because, access list will read the rule 29
from top to the buttom. Here we have number 10 20 30, this is a sequence number 30
when pc 0 send packet to the server, router will read the access list, 31
the packet is not match with the first rule, and then router will read second rule, 32
and here the packet is match, because the source is any. This is why from pc 0 to the server is success. 33
So, to block from pc 0, we need to create the rule with sequence number lower than 20. 34
Let’s say 17 or 15 or anything, as long as lower than 20. 35
Let’s try it, 36
First, we need to go to the access list, the command is ip access-list and then here standard, 37
and then the id. 38
Next we need to remove the rule with sequence number 30 first, the command is no 30. 39
Let’s see the access list again, 40
here we can see that now sequence number 30 is gone. 41
Next let’s create rule to block from pc 0 with sequence number lower than 20. 42
Let’s say I use sequence number 15 and then deny host 192.168.10.2. 43
So here we define the sequence number that we want. 44
Let’s see the access list again, do show access list, okay here we have sequence number 10, 45
and then 15 that we just add, and finally we have sequence number 20 to permit any. 46
Now pc 0 should not able to communicate with server. Let’s try, okay the result is failed. 47
Okay I think enough for this video, I hope you understand about the concept 48
of sequence number in access list. 49
Thankyou for watching and see you on the next video.