(electricity crackling over pulsing tones)
- In this video I'd like to talk about a classification
feature of Cisco IOS called Access-Lists.
Now you might be wondering,
what do you mean by classification feature?
That's what I'm going to talk about.
So there are many features within Cisco IOS
that allow you to look for certain things.
Look for certain things in data that's passing through
your switch or through your router.
Because you want to identify something and then based on
if what you're looking for is matching,
you wanna do something to that frame or that packet
that matches what you're looking for.
So a lot of times in Cisco IOS, features are divided
into two separate sections.
You've got a feature that you configure
to say this is what I'm looking for.
Like I'm looking for this particular destination IP address,
or I'm looking for this particular MAC address,
or I'm looking for a packet that's a certain size,
or a whole variety of things.
So there's features that say this is what I'm looking for,
and you program those, you type those in.
And then there's other features that refer to
those identification or those classification features.
And those other features say okay, if you find a packet
that matches what you're looking for,
tell me and I'm gonna do something to it.
And maybe one feature will say I'm going to encrypt
that packet and we'll take the data and sort of garble it up
so that if anybody happens to see it while it's in transit
they won't be able to tell what's in the payload,
what's in the data.
There are other features that say:
okay I'm a security feature, if a packet matches you
classification tool, tell me and then I'll make sure
it gets dropped or I'll make sure it gets forwarded
and there's a lot of other things like that as well.
So a lot of times in Cisco IOS we have this separation
between various tools you can use to identify or classify
things and then you can associate those tools
with other tools that actually do something,
that take some action on what has been identified.
And an access list is one example of those tools
that are for classification.
So Access-Lists are specifically designed to look
for Layer 3 and Layer 4 information.
There actually are MAC Access-Lists
that you can also configure to look for Layer 2 information
but we don't really go into those at all at the CCNA level.
So when you create an Access-List, think of an Access-List
as being like a container of several different statements.
Maybe one statement is I'm looking for a packet
with this specific destination.
Maybe another statement is, I'm looking for a packet
with this particular source and then that grouping
of entries, we give it some sort of identifier.
So with Access-List, that identifier could be a number.
For example, I could say I have Access-List 101
and Access-List 101 has 15 or 20 entries in it.
What we call Access-Control Entries.
So Access-List 101, look for the source address,
Access-List 101 the next line down,
look for this destination
Access-List 101 the third line down, look at this
combination of source and destination.
So all of that together would be considered Access-List 101.
I'm identifying it by that number 101, every single line
has that 101 in it, but each entry is unique and different.
Or another option you have available to you is naming
your Access-List and we'll look at that a little bit later,
about maybe it's more, maybe if you're looking at
your running config it's more meaningful to you
if the name is there.
For example Access-List: deny engineering to payroll
or Access-List: permit marketing, or something like that.
And then once again you'd have a bunch of entries
beneath that grouping.
So an Access-List is gonna have
one or more Access-Control Entries in it.
How many Access-Control Entries are really
completely up to you.
How specific you wanna get, how many different things
you wanna match.
Now one key thing to remember is that, whether you configure
an Access-List with just one Access-Control Entry
or 500 Access-Control Entries at the very bottom
it's actually gonna put in an entry that you can't even see
in the running config.
It's sort of invisible and I frequently call it the
deny all entry, or the implicit-deny entry.
Now what these entries do is just looking for something,
just matching on something.
You don't know, if I show you an Access-List that says
permit this, deny this, you can't tell me what's
gonna happen to a packet if it matches
this permit statement or if it matches this deny statement.
It really depends on, what is the feature
that's using this Access-List.
Perhaps that packet, if it says deny in the Access-List,
will be dropped because we're referencing
a security-related feature.
Or maybe that packet, if it says deny in the Access-List,
will mean let it go through, just don't encrypt it
because the encryption feature says okay, I'm only gonna
encrypt stuff that says permit in the Access-List.
Or maybe it says, if it's a deny it means,
don't change it in some way.
So just by looking at ACL you don't know what each line
is ultimately going to do if it matches a packet or not.
So when you look at the running configuration
and you see one or more lines of an Access-List,
they'll be in some sort of an order
and the way you see it in the running config
is actually the way it will be processed.
So when a packet comes in and some feature says:
- ope- hold on, I gotta have the Access-List check you out
and then tell me if I should do something to you.
Then it's gonna start by looking at the top line
of the access list and then proceed in sequential order.
Do I match the first line? No.
Do I match the second line? No.
Do I match the third line? Yes.
We're done.
Now that's an important point, look at
that last bullet point there.
ACEs are processed in a sequential order
until a match is found.
So if I showed you an Access-List that has ten entries
and I gave you a packet and I said here's the source
and destination of a packet.
And you looked at these ten entries and you said:
oh well that packet would match entry number three,
entry number seven and entry number ten.
Entries seven and ten are irrelevant.
The fact that it matched entry number three, it's done.
Whatever entry number three says to do, permit or deny,
that's gonna be what happens to that packet.
Now if a packet comes in and it goes line-by-line
says there's no match, no match, no match
and it goes all the way to the end and finds no match.
It will always match that invisible
deny any statement at the very end.
Now once again, what does that mean?
We don't know unless we know what the Access-List
is referring to as far as what feature is using it.
Now from the CCNA level, you use Access-Lists
for a couple of different things.
The very first thing we're gonna learn about Access-List
is pairing it up with a security feature
called an access group feature.
The access group feature is sorta like
a real basic firewall.
It says either, it says either let the packet
go through or drop the packet.
So in that context when you're looking at an Access-List,
it says permit something, if a packet comes in
and it matches that permit statement
and we're referencing an access group security feature,
that means permit the packet through, let it be forwarded.
If a packet comes in and it matches
a deny statement in an Access-List,
but it's matching an access group security feature,
that means deny the packet, drop it.
And then later on we'll see some other videos
about a different type of feature called NAT,
Network Address Translation that says
if a packet comes in and it matches
a permit, we're gonna change the IP address
in some way and then let it go through.
If a packet comes in and it matches an access list
that says deny, that means we're not gonna change it
in any way whatsoever.
NAT will not get involved, we'll just
let it through unchanged.
So what can be matched by Access-Lists?
Well it really depends on what kind of Access-List
you are using and we will talk about that.
But theoretically within your Layer 3
or your Layer 4 headers these are all the various things
that could be matched.
Some fields have to be matched entirely.
For example if your Access-List is looking at port numbers
or TCP flags or within the IP Header if it's matching
on the TOS byte or the Protocol field, you have to match
the entire field bit for bit.
Sort of like how switches have to match
an entire MAC address, it's either
an entire 48-bit match or it's nothing.
Other fields, you have a choice of partially matching
those fields and that's when we're looking at the address,
the source and destination IP address.
You have a choice, you can say I want to match
that entire source address, all 32-bits.
I want to match a specific post.
Or you could say, well I only wanna match
a certain, a certain few bits within that.
Maybe I'll only want a match on packets coming
from a particular network.
So any host within the ten network, I only care
about matching on that first byte, the number ten.
I don't care about what their host identifier is.
So you can do that, that's a partial match is supported.
So when we are looking at these fields
of the address specifically and we are looking
at the potential of matching the entire thing
or matching just part of it, well then that means
we have to have something that goes along with
that field that tells exactly how much am I gonna match.
This sounds sort of familiar doesn't it?
When you put an IP address on an interface,
something else goes with that IP address doesn't it?
A Subnet Mask.
And what does a Subnet Mask do?
In the context of an IP address and a Subnet Mask,
it tells the system where that IP address is.
It provides the boundary line between
these are the networking bits, if you're looking
for the network these are the bits
that are important for you.
So 10.10.10.10/8 says if you're looking for the network,
only the first eight bits matter.
The rest of it are host bits.
(coughs) Excuse me.
So when we're talking about an Access-List,
the same thing is gonna apply.
There's gonna be a portion of the Access-List where we can
plug in our source or our destination address or both
and then we're gonna apply something against that says:
okay of this 32-bit source, or of this 32-bit destination,
here's how many of the bits I'm interested in.
Now you might be thinking: oh okay, well then you put
a Subnet Mask in there right?
No, actually with Access-List it's something
that we call a Wildcard mask.
An easy way to think of a Wildcard mask, is think of it
as being sort of like just the inverse of a Subnet Mask.
It's a what?
Okay let me whiteboard this for you, for a moment.
Let's say I was to give you just one single byte.
So not an entire IP address, just a single byte.
Let's say 00110001, okay.
Now if I said, I want you to use a Subnet Mask
and using that Subnet Mask, I want you to tell
whatever feature is gonna be looking at this byte
to match the first five bits.
Well with a Subnet Mask, ones are important,
zeros mean we don't care.
So you would say: 11111000.
So if this number was paired up with a Subnet Mask,
the ones here in the Subnet Mask would say I only want
you to match against this five-bit pattern: 00110
and I don't care about anything else.
Well a Wildcard mask is just the opposite of that.
So I'll put the Wildcard mask below it.
In a Wildcard mask zeros mean match that bit,
one, two, three, four, five
and ones mean I don't care.
So this is a Wildcard mask.
Where you're saying the zeros have to match up
and that's what I'm interested in
and the ones, I don't care.
So this can be pretty easy, since you're already used
to creating Subnet Masks.
If you can create a Subnet Mask in your head,
if you can imagine what that Subnet Mask looks like
in binary and then flip it, you've got a Wildcard Mask.
So let's do that a couple of times.
Let's say for example, that I had
an IP address of 10.10.10.anything.
So all I care to match on are the first three bytes
and that's it.
Well if we were talking about a Subnet Mask,
it'd be 255.255.255.0, right?
And in binary one, two, three, four, five, six, seven, eight
one, two, three, four, five, six, seven, eight,
one, two, three, four, five, six, seven, eight.
That's what our Subnet Mask would look like.
Okay.
Well if a Wildcard Mask is just the opposite of that,
imagine turning all these ones to zeros
and all these zeros to ones.
And so if we convert that back
in a dotted decimal, what do we have: 0.0.0.255
So if the feature I'm using needs an access list
as it's classification mechanism,
an Access-List matches bits based on
Wildcard Masks not Subnet Masks.
Let's do another one of these.
If I gave you this address:
10.40.32.0 and I said:
use a Wildcard Mask to match...
only the first 19-bits.
Okay, well there's a couple of ways we could approach this.
We could sort of envision it binary:
one, two, three, four, five, six, seven, eight,
one, two, three, okay that's the first 19-bits.
One, two, three, four, five,
one, two, three, four, five, six, seven, eight, okay.
So we could do that, which ends up being:
0.0. what's that number?
Remember the quick way to do this?
If you don't wanna add up all those ones,
ask yourself what's the value of that right there?
Isn't that the 32-bit?
So if that's the 32-bit, this is one less than that.
That's 31.255.
So if I'm creating an access list saying
of this 32-bit number right here, I only want you to match
on the first 19-bits, if you find a packet that matches
the first 19-bits that looks like this,
that's a hit, that's a match.
Then my Wildcard Mask would be 0.0.31.255.
Here's another way of doing it.
This is a shortcut.
For those of you that are really good at coming up with
Subnet Masks because you've had a lot of practice
with that now, what would the Subnet Mask be
in this particular case?
The Subnet Mask would be 255.255.224.0.
Here's one way that you can come up with,
if this is easier for you I don't know,
but this is one way you could, some people use,
to come up with a Wildcard Mask.
Once you know what the Subnet Mask is,
put 255 above each number...
and then subtract the lower number from it.
So 255 minus 255 is zero,
255 minus 255 is zero,
two five, 255 minus 224 is 31
and 255 minus zero is 255.
It's your choice, however you wanna approach it.
Some people find this method easier
because they are used to coming up with Subnet Masks
and then from a Subnet Mask you can just subtract
the Subnet Mask from 255, 255, 255, 255 and whatever
you're left with is your Wildcard Mask.
What if I had this?
When a packet arrives, we must do something,
we don't know what the feature is, to it only
if the packet exactly matches...
5.5.5.5 all 32-bits.
So only if it matches that host.
What Wildcard Mask would we select?
Well if zeros in binary mean match that bit,
and we're saying I wanna match all the bits,
that would be my Wildcard Mask: all zeros.
Actually when we create an Access-List
and in the next section, in the next video we'll start
showing you the commands to do that.
In this case, you can actually shorten that to this.
So in the Access-List, I'll show you a quick preview here
of a simple Access-List.
I could say: access-list 1 permit and then what
am I looking for?
I could say that or since I'm matching all 32-bits.
Typically when you're matching all 32-bits it's because
you're matching a host address, you're matching
on packet coming from or going to a particular host.
So a short-hand way of doing it is like this,
access-list 1 permit host.
I'm assuming this is a host, so match all 32-bits of this.
So that's a keyword you'll see a lot in Access-List
and notice that when you use the shorthand of host
instead of Wildcard Mask, it actually goes
in front of what you're matching, not behind.
So if you're using a Wildcard Mask, which you might have to,
the Wildcard Mask goes behind the value, just like
in an IP address, right?
In an IP address the Subnet Mask went behind the IP address.
But in this particular case, if you use the keyword of host,
that goes in front of.
And there's one other shortcut I wanna show you,
that you will see a lot in Access-Lists.
Match any packet,
I don't care what bit sequence it has.
Okay, so what would my Wildcard Mask,
what Wildcard Mask would you use?
Well in a Wildcard Mask in binary, what binary bits
indicate I don't care?
This could be anything to me.
Isn't it the one bit?
So that Wildcard Mask applied against anything means
don't even bother matching this bit sequence.
I had to put some bit sequence in here because
I'm forced to, I had to put something in this field
but the Wildcard Mask of 255.255.255.255 says ignore
that field, you don't even have to match on it at all.
So I could do it like this: access-list 1 permit
and I could put anything right there if I input this.
It really doesn't matter, I could put 7.7.7.7.
I could put 1.2.3.4, I could put 10.3.3.3
because this Wildcard Mask is saying this pattern
doesn't mean anything.
Doesn't, you don't have to match any of the bits here.
So usually the shorthand way that people do
for this, is access-list 1 permit any.
Now you don't have to, now all you have to do
is the word any.
Cause that's exactly what this Wildcard Mask means,
I don't care what the bit pattern is, it all matches.
There's nothing I am excluding.
So with IP version four Access-Lists, you can have
a standard Access-List, you can have
an Extended Access-List and both of these
are considered numbered Access-Lists.
So for example, my whiteboard here where
I was putting a number.
And then a lot of times in my verbal explanations,
I was saying Access-List 101.
Those are numbered Access-Lists and a numbered Access-List
can take the form of a Standard ACL or an Extended ACL.
And we'll get into what the differences are
between those coming up.
Or like I said, if you wanted to you create
a named Access-List.
Now a named Access-List is something
we will get into a bit later, but a named Access-List,
you still have to identify whether
it is standard or extended.
Standard or extended tells Cisco IOS what
my limitations are as far as what I can match.
With a standard Access-List there's not a lot of things
I can match, but maybe that's fine.
Maybe I don't need to match a whole lot.
But if I need to match a lot of those other fields,
like the TCP port numbers or the TCP flags,
then I need more options and that's where
an Extended Access-List would help me.
So that concludes this particular video
and in the next video we'll start looking at standard
Access-Lists, what they can match against
and how we configure them.
(electricity crackling over pulsing tones)