- So I've talked about in theory, what an access list
is that's an identification or classification tool.
I talked about at a real high level,
that there's things called numbered and named access lists,
although we haven't really looked at how
to configure them yet.
And I've talked about how, at a high level there's
differences between a standard and extended access list.
Now we're gonna go into more details about standard
access lists, what they can do, what they can't do,
how to configure them.
And then just for demonstration purposes,
I'm gonna pair a standard access list
with a feature, a security feature,
called an access group feature.
So you can see how the two work together.
So a standard access list, probably the most basic
and simple of the access lists you can configure,
identifies traffic simply based on the layer three header.
So if you have anything you wanna match
other than the layer-3 header, this is not the tool for you.
Within the layer-3 header, the only thing it can
match on is the source IP address and that's it.
So once again, if you wanna match on anything other
than this, like the destination of where the packet's going,
or something else in the IP header,
this is not the tool for you.
So when you're configuring a standard access list,
if you're gonna be using a numbered access list,
the number should be in the range from one to 99.
In other words, at the global configuration level,
we're gonna see this in just a moment,
you're gonna type access-list and then
you're gonna give it a number.
If the number you give it is in this range,
iOS knows, okay what follows next is I can only--
I should say this, when iOS sees a number in this range,
it says okay now after this the only options
I'm going to give the user, the network admin who's
configuring me, is the option to match on the source IP
address and a wildcard mask, and that's it.
Now there's also an extended range, or I should say
an expanded range of numbers.
Because for most people, 'cause remember with access
lists for example one, that is the name of the container.
I could have multiple lines of that.
Access list one, match on this.
Access list one, match on that.
Access list one, match on something else.
So I could have dozens or even hundreds of access control
entries all numbered one.
Now for most companies, this range here is more than enough.
But sometimes especially when you're talking about
internet service providers, their access list can be huge
because they've got thousands of companies that they're
servicing and they need to have different access lists
for each one and so they might run out of 'em,
even from one to 99.
So there is an expanded range of standard ACL's
and you should probably memorize this number
from 1300, I'll write this down here,
from 1300 through 1999.
So the same thing, if you're configuring your access list
as a numbered access list, access-list 1301
or access-list 1400, anything in this range,
it's as if you were using the numbers one through 99.
iOS still recognizes that you want
is a standard access list.
Standard access lists should be applied
closest to the destination.
What does that mean?
We'll take a look at that in just a moment.
And there's no method to check the decimation address
or port numbers because all the standard access list checks
is the source IP address, that's it.
Now a lot of times, that's all you need to check.
You know, based on the feature that you're using,
maybe you say, you know what, all I care about
is where this packet's coming from.
I could care less about where it's going to
or anything else like that.
So here's how you would configure a standard access list.
So notice a few very important things here.
Number one, where are we doing it?
At the global configuration level.
So that's very important.
Number two, so we say access-list,
we provide a number that's in the standard range
and then you have to say permit or deny.
Now remember, permit or deny, we don't know
what that's gonna do.
If we're talking about an encryption feature
that's using this, that means permit the packet
to be encrypted or deny it to be encrypted.
If we're using the access group feature,
which is what I am gonna be using for my demonstrations,
permit means allow the packet through.
Deny means kill the packet, deny it, block it.
And now we specify some 32 bit number
as our source address.
And then a wildcard mask.
Now to verify what we've configured,
we can do show IP access-list.
And that will show us our access list.
Now that's gonna show you what feature or features,
'cause you've got more than one that are using
this access list for identification purposes.
But it will show you the access list that you've
configured or you can do show run
and you can use the pipe symbol on your keyboard.
And then inc, that's short for include access-list.
Or you can just look at show run.
Now in order to actually use an access list for something,
'cause if you just configure this access list
and it's sitting in a global configuration level,
it's not doing anything.
Here's an example, remember back when we were talking about
switching and I said if you wanna create a VLAN
and have some hosts on your switch, use that VLAN.
I said it was a two step process.
I said at the global configuration level,
you typed VLAN five or VLAN 100,
and then you had to go to the interface and say,
switch port access VLAN five or switch port access VLAN 100.
Well on a switch, if I just configured VLAN five
and nothing else, that's a broadcast domain
that isn't really being used for anything.
Same thing here.
If I configure my access list, but I don't have
any feature that's referencing it,
it's just taking up space in my running config.
It's not doing anything.
So one of the first features that you learn
in the CCNA level that uses access lists
is something called the IP Access-Group feature.
Now this is an interface level feature,
it's a security feature and it's like it says here,
a primitive firewall.
Basically it's using the access list to determine
if a packet matches a permit statement,
allow the packet through.
If the packet matches a drop statement,
well I should say a deny statement, filter it, drop it.
An IP access group is directional.
So when you apply it to an interface,
you have to specify am I looking at traffic coming in,
that's coming in off the cable.
Or am I looking at traffic that's going out,
that I'm about to put on to the cable.
You have to specify directionality.
And then a references and access list either
could be a named access list or a numbered access list
for the identification or classification purposes.
And so here's an example of how you would apply it.
So notice that we are at the interface level.
And you would say, IP access-group and then
you reference your access list.
Like IP access-group one or access-group two.
And then you specify your direction, in or out.
Now one thing that's important about the IP access-group
feature is you can only have it in
one direction per protocol.
What do I mean by that?
Well for example, I could say IP, I'll just put
little hash symbols here.
IP access-group four, let me get rid of some
of this stuff here.
Okay I could say, IP access-group four in.
And I could say IP access-group eight out.
So right now, if a packet comes, we don't know
what this interface is.
Let's just put something here, let's say it's
fast ethernet 0/0.
Okay, so if a packet comes in, fast ethernet 0/0,
I'm gonna stop and I'm gonna inspect that packet
against my standard access list number four.
If there's a line in access list four,
an access control entry that says deny,
I'm gonna drop the packet.
If there's a line in my standard access list
that says permit that matches this packet,
I'm gonna forward it through,
I'm gonna let it into my device.
Now if there's a packet that came in some other interface,
fast ethernet 11 or a serial interface and my router
has decided it needs to route it out, fast ethernet 00,
well then it's gonna look at access list eight
to make that decision.
Now let's say I come back later and I say,
IP access-group, let's say seven in.
And then guess what?
It's going to delete this line.
'Cause I can only have one inbound and one outbound.
So whatever the most recent one is that you typed in,
it will override what the previous
one was that said inbound.
So let's play around with this a little bit.
So we're gonna use this topology.
And I'm gonna build this up from the CCNA
racks we have here at INE.
So if you're using our rack rental tokens,
you could create this on your own.
And I thought about having this pre-built in advance,
but then I thought I could use this as a good learning tool
for you guys, so when I'm creating a topology
from nothing, step number one is you have to know
what do I have to work with.
What physical equipment do I have, how is it physically
cabled up, and I know that my physical
topology supports this.
And how do I know that?
Well because if you rent time on our CCNA CCNP racks,
this is what the LAN topology looks like.
This is every possible LAN connection.
And so you can see from this, I can derive all kinds
of certain topologies.
So for example, I wanna use my connection
from R1 to switch one.
So that's right here, I'm gonna be using this connection.
This connection I'm not gonna use it,
so I'm just gonna shut it down and so that
is not even part of my topology.
I'm gonna use this connection from R2 to switch one.
Which is right here.
Once again, even though R2 has a connection
to switch two I'm not gonna use it.
I'm gonna shut it down, disable it,
so it's not even part of my diagram.
I'm gonna use this connection from switch one
to switch two, I only need one connection
for this lab I'm creating, 0/10.
So I'm gonna use this one link right here.
I'm gonna shut the other ones down.
So what I usually do is, in this lab,
I will disable interfaces that I don't use
because I don't want them to distract me.
I don't want my traffic to go off in directions
I can't foresee, I can't predict.
And then I will only enable with a no shut command,
those interfaces are actually part of my topology.
So these numbers here in brown are the actual interfaces
I'm gonna be using, like 0/1,
0/2, 0/10 and anything that's not
shown here that's on this diagram is not being used.
For example 13, 14, and 15, switch three entirely,
I'm not even using him.
So all these connections at switch three
are disabled, I'm not using it.
Now once I've figured out from my physical topology,
what interface I want up and actually active,
and what interfaces are not relevant,
then the next thing is to figure out my IP addressing.
And so I just came up with some very easy addresses,
I sort of base it off of the interface,
off of the device names.
I figured okay, router one connecting to switch one,
let's just have a bunch of ones in the subnet.
Switch one connecting to router two,
let's have a combination of ones and twos,
so that's sort of how I came up with these
subnets here that I'm gonna use.
And then for my host bits, once again,
I tried to make it meaningful.
Right switch one, I'll just have him be .11 for everything.
Switch two I'll have him be .22 for everything.
So that way my IP subnetting scheme makes sense to me.
And when I see these subnets and my various routing tables,
I'll sort of be able to visualize where
they belong in my topology diagram.
Then what I do is once I have all this mapped out,
this is a great exercise for you in order to
test your skills and your knowledge about
have I memorized the commands?
Do I actually know the commands really well?
This is what I do, I bring up a text editor
like Notepad, let me go to it.
And I will write out my configuration in the text editor
from beginning to end.
Okay I need to go into enable mode first,
then config T, I'll type in a host name.
So this is all the configuration that router
one should need for this topology.
And then I'll scroll down and I'll make a configuration
for the next device, router two.
And then the next device, so I'll write in text
all of the configuration I think I need for each device.
And then I'll copy and paste it in.
If I was right, if I didn't mess up any of my commands,
I won't get any error messages and I'll be done.
If I get any error messages, then I'll know,
oh okay I misspelled something or I forgot a keyword.
And this is a great way for you to practice
your knowledge of your iOS commands,
so let's just go ahead and do it.
I haven't actually implemented any of this yet.
Hopefully all of it's right.
So let's go into router one and put this in.
Okay, I'll just right-click and paste it in.
And everything looks good, there were no error messages.
Alright, save my configuration.
And let's repeat it now with router two.
Copy, paste.
And we're done with him.
Now let's go to router three.
Okay this guy clearly has a debug running.
Show debug, otherwise I would not have
seen that I don't think, let's see.
Yup, there's a debug running.
So how do I turn off all debugs if I don't wanna
see a bunch of stuff?
Undebug all.
Alright and let's go to router four.
Show debug, do you have anything running in you?
No, that's good.
Okay and then my switches.
Now my switches, I'm configuring them a little bit
differently than what we've been dealing with in the videos.
In the videos, all of my physical interfaces
were always configured as layer two switching ports,
as either switch port mode access, or switch port mode
trunk, or switch port mode dynamic something.
And you could certainly do that, I could've elected
to have three different VLAN's because these
are three different broadcast domains.
And then I would've made the switch port mode access
and then I would've needed to create a layer three
switched virtual interface like interface VLAN one,
interface VLAN two, interface VLAN whatever.
But there's an alternative approach.
That's one way you could do it.
But on these switches, because these switches
are multilayer switches, meaning they can be routing,
I can actually elect to convert their ports
from a layer two switching port like access or trunk
into what's called a routed port.
Which means it's like a port on a router.
You can slap an IP address on it and
it's a layer three interface.
And you simply do that on switches by using the
no switch port command.
When you type no switch port, then it allows you to
put in an IP address as if it was a port on a router.
And for me, this was easier because I didn't have to
create VLAN's, I don't have to create interface VLAN's,
I can basically turn this switch into a router
with three interfaces.
So let's go ahead and put that on there for,
and notice I'm using the interface range command
to shut down all of my interfaces first
and then I selectively go into each interface,
say no switch port, add an IP address,
and then bring the interface up.
So my configurations for my switches
are a little bit larger.
Oh okay, something wasn't right.
So right there I can tell, it did not like the
no auto summary, ahh okay so look at this.
So this is a great test.
So as you're doing this, if you see the caret symbol,
you say uh-oh something went wrong.
Because that indicates iOS didn't like something.
So at first it looks like it didn't like no auto summary,
but I think wait a second, that's a valid command.
Why didn't it like that?
But look, we're at the global configuration level.
This is a rip command and then if I go up a little bit
more, ahh, IP routing not enabled.
So I forgot in my configuration, I should probably
put in IP routing up here towards the top.
And I should do that in switch two as well,
because he will need IP routing.
Actually that is switch two.
Let's do it up here in switch one.
Alright, let's try copying.
I don't have to copy and paste thing whole thing,
'cause a lot of the interfaces already worked.
So actually what I'll do is I'll just put
IP routing right here.
And then I'll take it out up here.
Okay because I previously didn't exit,
if I did copy and paste this whole thing in again,
because I typed exit here at the interface level,
I would be back to global configuration level again.
And this command would work.
So this all I'm gonna copy and paste for now.
There we go and now let's go into switch two
and finish that off.
I know I could've started like I said,
with all this stuff preconfigured.
And for those of you who are watching the video saying,
I wish you would have done that, I'm sorry,
but I figured for those of you who might actually
be trying to build labs from scratch,
this could be a useful example of a way of doing that.
And practicing your memorization of iOS commands
at the same time.
Okay so if everything's working correctly,
router one now should have a connected network
and he should have one, two, three, four routes
that he learned via rip, four rip routes, four subnets.
Let's find out.
Show IP route.
And there they are, they are all four rip routes,
so right now router one should be able to ping
all the way down to 2.4.2.4.
And he can.
Okay, so I now have end to end connectivity,
let's practice my access list.
So we know that with a standard access list,
all it can match on is the source.
So let's, first of all, write my objective.
So if you're creating a lab for yourself or you're building
a lab from scratch, you need to have a clearly defined
idea of what is my objective in this lab.
What am I trying to test and how am I gonna test it.
So objective, test standard ACL
feature and IP access-group feature,
and directionality.
Okay so how am I gonna do it?
So my objective here is prevent IP packets
sourced from R1 from
pinging R4.
So my idea here is that I want R1 to be able to
ping everything but R4.
Now here's the problem, I shouldn't say a problem,
but my challenge is that a standard access list,
I can't specify the direction.
I mean I can't specify the destination.
All I can specify in a standard access list is the source.
So that being the case, let's see here,
my access list should look something like this.
ACL configuration, access-list and I'll just
choose the number one because it's a standard access list.
Deny and I'll say, host, actually let's
do it with a wildcard mask, 1.1.1.1.
And then what would the wildcard mask be
to match all 32 bits of that host, 0000.
Or I could've said access-list one deny host, 1.1.1.1.
That also would've worked.
And I need to put in a permit statement,
because if I don't, that invisible deny anything
will kill everything, so access-list one permit any.
Okay now I have to use the access-group command.
Which will be on some interface.
And I'll say IP access-group one and then I'll
have to supply some sort of direction, either in or out.
Now this is where we get back to that one slide.
If I go back...
This bullet point right here.
Where it said access list or standard access list,
should be applied nearest to the destination.
Here's where that is gonna make sense.
If I took this IP access group and I put it,
let's say right here, well if I put it in
the outbound direction, would that work?
That'd be saying, match packets going out this way.
Well is there ever gonna be any packet going out this
way with a source address that matches 1111?
No, destination yes, but source address going
this direction, no that wouldn't make sense.
Okay what if I did it inbound on this interface?
Okay, well that means a packet coming in
that has a source address of 1111, it'll be matched
and it'll be dropped because the access group
feature says drop it.
But that'll drop everything from router one.
My objective was not to drop router one going everywhere,
my objective was only if router one is trying
to get to this guy down here, should I drop it.
And that's why a standard access list should
be applied as close to the destination as possible.
Since you can't specify the destination, well,
you might think oh okay well then why don't I put it
right here inbound?
Well here's the problem with that.
If you put it here, router four, he will actually
look up that packet and process it before he even
looks at the access list.
So let's just imagine for a moment that the destination
was not a router, but imagine that this was a server
right here that didn't support access lists
'cause it's not a Cisco device.
It's a Windows server or a Linux server.
Well then in that case, the closest we could get
to the destination would be right here on this.
And I would say doing it in the outbound direction.
So if I go to switch two and I go to interface
fast ethernet 0/4 and I apply this command,
I put this access list on it, on switch two.
And then I put this command in the outbound direction.
Let's see how that logic's gonna work.
So as R1 is pinging R4, no one's gonna be looking
at his packet, it's gonna go all the way through switch one
so he can ping R2 if he wants to.
He can ping any of the IP addresses on switch one
if he wants to 'cause there's no access list here.
Goes all the way down to switch two, if R1 is trying to ping
this .22 or this .22, no problem.
But then when it's routed out this interface,
if I have IP access-group one out,
he'll say hold on a second partner,
I gotta look at that packet.
And so if that packet matches 1111 as a source,
he'll say, I'm gonna drop it.
And so that will prevent router one from
pinging router four.
Let's go ahead and configure that on switch two
just like it says.
Access-list and I could pick any number in the
standard range, I'll just pick one.
People usually start with the lowest number.
And I'll say deny host 1111.
Or an alternative to that would be 1111
and then a wildcard mask of all zeros.
And then access-list one permit,
I could put anything here.
It doesn't really matter because that wildcard
mask says, I could've used the word any.
Let's see what happens actually here.
Show run include access-list.
So look what it did.
My access list of 0000, it actually
took out the wildcard mask.
I could've typed it in as host, but it displays it as this.
And this right here, it said, look that 32 bit number is
meaningless because you said any of the bits
could match it, it really doesn't matter.
So that's the same thing as saying permit any.
And now I just need to apply it.
So now on switch two, I will go to interface
fat ethernet 0/4 and I will insert my
IP access-group one out command.
'Cause I'm monitoring packets going out onto the wire.
Interface fast ethernet 0/4 IP access-group one out.
Alright so let's test it.
From router one, I should be able to ping router two.
'Cause there's no access list on switch one.
So from router one, let's see if I can ping 1212.
1212 and I can.
From router one I should be able to ping this
address on switch two.
Because it's coming in this interface, there's no inbound
access list here, there's no access groups
applied to either one of these interfaces,
so it should be able to ping in and then get a reply back.
So from router one let's ping 2.3.2.22.
No problem, I should even be able to ping
this interface right here, 2.4.2.22.
And I can, but if a packet tries to go out
on this wire with a source address of 1111,
now the access group feature should match that
and it should be filtered or denied.
So I should not be able to ping 242.4.
And I cannot.
These U's, the reason I'm getting these
U's here, right here...
That is a result of receiving what's called
ICMP unreachable messages.
So I sent an ICMP echo request to 2424.
It was blocked by the switch, who has the access list
and the access group security feature.
And the switch responded to me saying,
that is unreachable, you can't get there,
and that's what that is.
So that concludes this video on standard access lists
and pairing them up with a security feature
known as the IP access group.