There are also two methods to identify whether an ACL is a standard ACL or extended ACL, access list are
either configured as numbered access lists or named access lists with numbered ACLs, the number of the
ACL determines what type of ACL it is.
So, for example, ACLs in the range 1 to 99 or what's called the expanded range
1300 to 1999 would be used for standard IP ACLs.
So as an example on our router,
in global configuration mode, I can type the command access list,
question mark, and as you can see here, 1-99 is used for IP standard access lists
The expanded range
is also listed 1300-1999.
Now, the reason for the expanded range is that initially about 100 ACLs seemed more than enough
but as we all know, as time goes by, what was deemed to be enough is not necessarily enough
and these days, we can use both 1-99 or the expanded range.
If the requirement for more than 100 access lists is there, IP be extended access lists on the range
100-199, as well as the expanded range, which is 2000-2699.
Depending on your IOS
you'll see other types of ACLslisted, for instance, to support Apple talk ACLs in the range 600
to 699 can be used to support IPEX.
You could, for instance, use ACLs in the range 800 to 899 or extended IP access lists in the range
900-999, notice here for example,
ACLs in the range 700-799 are used for Mac address access lists. In this course we
fortunately only concentrate on IP access lists, so we will concentrate on both IP standard access
lists and IP extended access lists.
But be aware, please, that there are other number ranges used for other protocols like iPX, Apple
talk and so forth.
The second type is named access lists, which are more descriptive because they use alphanumeric characters
as names.
So rather than access list 100 for instance, permitting telnet traffic to switch, you could call the ACL
permit telnet and give it a name with more meaning.
That also allows you to create many, many more ACLs on a router than the list specified by the numbered
ACLs.
Originally named ACLs also gave you more flexibility when it came to editing individual lines or deleting
individual lines in an ACL
but these days that flexibility is available for both named as well as numbered ACLs.
Just to demonstrate a little bit more, if I specify one as my ACL, no notice, it gives me three options
deny, permit or remark.
Now, let's start with the last one.
The remark option allows you to add a description to your ACLs.
This is very useful because when you return to an ACL that you can figure out months ago, rather than
having to decipher the lines of the ACL, the remark or in other words, the description can let you
know what that ACL is attempting to accomplish.
So it's recommended that you use the remarks statement to add descriptions to ACLs to make them more
user friendly and understandable, both for yourself and for others.
If I choose the option permit.
Notice because this is a standard IP access list, the only options here are permitting either a hostname
or IP address, permitting any which permits everyone or anything and the host option.
So I could, for example, put an address here like 10.1.1.1 and then notice the next option
is to put in wild card bits or to hit enter or I can log this information to, say, a six log server
or another logging device on my network.
So if I put in the option 0.
0.0.0 that is specifying that I will permit traffic from a specific host, 10.1.1
.1.
Now, ACLS don't use standard network mask, they use inverse mask where a 0 in binary means
they must be a match and a 1 in binary means that doesn't have to be a match.
So just to reiterate, you need to look at this in binary
if you're not sure a 0 in binary in the mask means that there must be a match on the host or network,
a 1 in the mask means that we ignore the host or network value.
So as an example, if I want to match a specific IP address, I can type the command access list 1,
1 denoting that
this is a standard IP access list.
I'm permitting traffic that matches 10.1.1.1
exactly.
The 0 in the mask mean that the first octet must be a 10.
The second octet must be a 1, the third octet must be a 1 and the fourth octet must be a 1.
A 0 in the mask means an exact match.
A 1 in the mosque means it doesn't have to match.
So this statement will only match for a specific host with the IP address
10.1.1
.1.
Now, rather than doing it that way, you can configure the access list as follows.
You can type the command access list 1 permit
and in this case, we're looking for a specific host so you can use the keyword host
and in specifying the host IP address, either will do.
It's like saying tomato versus tomato, depending on which you prefer, will depend on which one you
configure.
The opposite of specifying an individual host would be matching anything or everything, so you could
create an excellent access list 1 permit and notice in the address portion, we have put 00
00
and this could essentially be made anything, in the mask
however, we've put 255.255.255.255.
If you remember, a 1 in binary in the mask means ignore this value.
In other words, it can be anything, a 0 in the mask means an exact match.
So if we look at the IP address, it's 0.0.0.0 in decimal, which is equal to all 0s
in binary.
This gap in the binary address obviously doesn't exist.
I've just put it here for readability.
So looking at the address in binary, it's eight 0s.
The mask, in other words, in the first octet, the mosque is set to 255, which is equal to eight
binary 1s.
So what we saying by putting 255 in the first octet in the mask is that the first octet in the address
is irrelevant.
We are just ignoring all the bits.
We've done the same with octet 2, 3 and 4.
So this is essentially matching anything or everything and we are not matching any specific hosts or
network.
Alternately, you could also use the Syntex Access List one permit any.
So once again, tomatoe versus tomatoe, you decide which you prefer.
Both will work and both have the same result.
If you wanted to match an individual subnet rather than an individual host or any traffic, you could
use a combination of 0s and 1s in the mask.
So as an example, access list 1, permit 10 and notice in the mask, we have 0 in the first
octet, which means that we are matching on the 10, 10.1.1.0
and in the mask we have 000.255.
Now in the first octet in the mask.
We have got binary 0s, which means that there must be an exact match on this address.
In other words, we are specifically matching the first octet.
It must be equal to a 10.
The second octet must be 1 because we have got a 0 in the mask.
The third octet must be 1 because we have a 0 in the mask.
But notice in the fourth octet, this could be set to anything because we've got binary 1s in the
fourth octet, 255, if you remember, is eight binary 1s.
In other words, we are saying we don't care what the lost octet is set to.
This statement will match any host or any address where the first three octets are said to 10.1
.1.
The fourth octet can be anything.
So just to sum up, if we were using the dotted decimal notation to match a specific IP address like 10
111 we would full the mask with 0s.
Once again, this is an inverse mask.
A 0 in the mask means that we are looking for a specific value in the host portion of the address.
A 1 in the mask means we ignore what the host portion is set to.
So this matches a specific IP address to match a specific subnet, let's say 10.1.1.0
we could configure the access list is 10.1.1.0 with the first three octets equal to 0 and
the last octet equal to 255.
Or if we wanted to match anything, we could set the host portion to actually any number and the mask
255.255.255.255.
So as an example on a router, I could type the command access list 2
permit and then specify anything I wanted to.
But if the mask is set to all 1s, if I type the command show IP access list.
Notice the routers changed it to say permit any, we typed this on the router, but the router has changed
it to permit any I could do the command show run pipe include access list to see all my access lists statement
configured on the router
and you can see once again, the router has changed the format of the access lists.
Here's a more complicated example, if we had an access list, let's say access list 1 permit, 10.1.1.0
and the mask is 0.0.0.15.
What we are saying is ignore the last four bits of the last octet.
So notice the address is 10.1.1.0 and the mask is 0.0.0.15.
Now, the first three octets are fairly easy to work out.
What we're saying is that the first octet must be 10, the second octet must be 1, the third octet
must be 1.
But it gets a little bit more complicated.
Looking at the last octet in decimal, it's a lot easier if you convert it to binary.
Four binary zeros, followed by four binary ones, zero in binary equals eight binary zeros.
Once again, the gap in the middle in these octets is just there for readability so that it's easier
to see what's going on.
So what we're saying is that the last four bits, in an address can be set to anything.
So in other words, these lost four binary bit could be set to either a 0 or a 1 but the first
four binary bits must be equal to 0 because the address portion has a 0 in it and the first four
bits of the mosque are set to zero.
It means that the first four bits of an address must be equal to this value.
In other words, 0.
So let's show you some examples, if I had an address of 10.1.1.1 would it
be matched by this statement permit 10 .1.1.0.0.0.0.15
and the answer would be yes.
I've only converted the last octet into binary as the first three octet.
So easy to work out.
What we're saying is that the first three octets must be equal to 10.1.1.1 which it is for
this address
but the last octet converted to binary will look as follows.
We would have seven binary 0s, followed by a binary 1, 15 in binary
once again is four binary 0s, followed by four binary 1s.
So what we are saying is notice the first four bits and the address must, because of the zeros in the
mask, be equal to 0000, which for one is true.
The first four bits are set to 0s.
It doesn't matter what the last four bits are set to because we have binary 1s in the mask.
So there is a match on 10.1.1.1.
But does this access list statement match 10.1.1.1.29 and the answer is no, because in the first
four bits of the address, it must be equal to four binary 0s.
And if you convert 129 into binary, it consists of one binary 1 followed by six binary
0 followed by binary 1.
In other words, the first four binary bits do not equal four 0s.
So this is not a match.
In this example, we have some hosts on subnet 10.1.1.0.
So as an example, this PC and this MacBook, we also have servers, server 1 with IP, address 10.
121 and server 2 with IP, address 10.131.
In this example, we want to permit host 10.1.1.1 access to the servers but deny everyone else.
Please note these examples are just to help teach you the syntax of access lists and how they can be
used in various scenarios.
These examples are not best practice, so please don't try and understand the why of these examples.
They're just here to try and help you understand how access lists can be applied.
Obviously, in the real world and in exam situations, you might be presented with various scenarios
and in those cases you will need to know how access lists work to be able to meet the requirements of
the scenario.
The first decision you need to make is on which interface
are you going to apply the access list on this example?
We are going to use a standard IP access list.
We are not going to use extended access lists.
So it makes sense to apply the access list inbound on this interface because that will accomplish what
we set out to do.
You could also apply the access list on both f01 and f02 but it would be more efficient
to apply inbound rather than outbound and also means that you only have to apply the access list on
one interface rather than on two interfaces.
So on my router, I could configure the access list, but before doing that, I'm going to type the command show
access lists just to see which access lists have already been configured so that I don't inadvertently
edit an access list that already exists.
In this example, you can see that there are no access lists so I can go into global config mode
and type the command access list and then specify a number
and let's say in this example we have to use a standard IP access list
So I'm going to just choose a number, let's say one, and then I'm going to say permit
host 10.1.1.1 and hit enter our scenario states that we need to permit this host access
to the servers.
Now a standard IP access list does not allow you to specify destinations.
You can only specify the source.
Now it's worth remembering the implicit deny any at the end of every IP access list. Our criteria
and this example is just to permit that specific host 10.1.1.1 and deny everyone else.
So this single line access list will accomplish what we set out to do.
The next step is to bind the access list on an interface.
So on interface f0/0 I'll type the command IP
access group and notice, it prompted me to put in the number or word of the access list, so 1 and
then a prompt me to specify the direction and I'm going to say inbound that just by doing that, I've
accomplished what I set out to do.
We are permitting this host 10.1.1.1 and denying everyone else, you obviously need to be careful
with access lists because if another interface were configured on this router, no traffic except for
this host would be allowed to send traffic through interface f0/0
but in this scenario, we have met the requirements.
One last thing to show you.
Is if I type the command show IP nterface and the relevant interface.
The router will show me which access list is bound outbound and which axis list is bound inbound on this
specific interface.
And as you can see here, axis list 1 is bound inbound and no access list is bound outbound.
So as an example, I could create another access list, let's say, access list 2 permit any
and then go on to that interface and type IP access group
to out.
Do the same show command again, show IP interface f0/0 and you'll be able to see that access list
2 is bound up on an axis list, one is bound inbound.
If I made the following mistake
and bound access list to inbound rather than outbound.
The following would take place.
The router does not warn me about anything, but notice the inbound access list has been replaced with
with access 2, so the previous access list 1 was removed off the interface and replaced with access
list 2.
There's no need to firstly remove the old access list before applying the new access list.
The old one is implicitly removed and the new one is applied.
Also, notice that you can apply the same access list in and out at the same time.