In the previous video, we already learn the differences between standard and extended access list. 2
Now in this video, we are going to configure extended access list based on this example case. 3
Let’s just start, we are free to configure on router 1 or router 2, 4
in this case, let’s try to configure on router 1. 5
Enable, configure terminal. 6
Access-list, here for extended access list, we can use id 100 until 199, 7
let’s say here I use 100. 8
And then here we want to block http, so here deny, and then question mark, 9
here we can define the protocol. 10
For http, the protocol is tcp, question mark, here we need to define the source, 11
we will use any, because we want to block http from anywhere to all server, so the source is any. 12
And then here we can define the destination, in this case the destination is server, 13
so here 192.168.1.0 0.0.0.255. 14
question mark again, here we need to define eq, eq means the port that we are going to 15
block, in this case we want to block http, and the port of http is 80. 16
So here eq 80. 17
Okay now we have done for the first case. 18
For the second case, all vlan is allowed to access server 1, access-list 100 permit 19
and then we need to define the protocol. 20
Here the case is all vlan is allowed to access server 1, so all protocol should be allowed. 21
Here we can use ip, ip is means any protocol. 22
And then the source, we will allow from all vlan, so the source is any, the destination 23
is server 1, so here host and then the ip address of server 1, 192.168.1.10. 24
Okay for the second case is done. 25
Next for the third case, we will only allow from vlan 20 to the server, so here 26
access-list 100 permit here we will also use protocol ip, and then the source is vlan 20, 27
so network 192.168.20.0 0.0.0.255. 28
The destination is server 2, so host 192.168.1.20. 29
Last, we need to allow from vlan 30 to the server 3, access-list 100 permit ip, 30
the source is vlan 30, so 192.168.30.0 0.0.0.255, the destination is server 3, so host 192.168.1.30. 31
Okay we have done configuring the access list, let’s check it, do show access list. 32
Here we can see access list 100, we have 4 rule in here, the first rule is block http 33
from all vlan to all server. 34
Second rule all vlan is allowed to access server 1, third rule, only vlan 20 is allowed 35
to access server 2. And last only vlan 30 is allowed to access server 3. 36
And remember that we have default rule to deny any, so let’s say from vlan 10 to the 37
server, this is will be blocked by default rule. 38
Vlan 10 to server 3 will also blocked. 39
Next, let’s assign the access list to the interface, let’s say we will assign the 40
access list to fa0/1, so here interface fa0/1, and then ip access-group 100 out. 41
Pay attention here that we use direction out, because the flow is from client to the server, 42
so fa0/0 will in, and fa0/1 will out. 43
But we can not assign the access list to fa0/0, we need to assign the access list on the sub 44
interface, fa0/0.10, fa0/0.20, or fa0/0.30. 45
Okay I think enough for this video, in the next video, we are going to test our configuration. 46
Thankyou for watching and see you on the next video.