Scribd
Upload
7 views18 pages

Access Control List

The document provides an overview of Access Control Lists (ACLs) used to manage IP traffic by filtering packets through routers. It details the types of ACLs, their applications, and operations, including standard and extended ACLs, as well as the use of wildcard masking for IP address matching. ACLs help restrict network access and classify traffic for special handling, processing packets in a sequential manner based on defined statements.

Uploaded by

asfa rehman
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPT, PDF, TXT or read online on Scribd
7 views18 pages

Access Control List

The document provides an overview of Access Control Lists (ACLs) used to manage IP traffic by filtering packets through routers. It details the types of ACLs, their applications, and operations, including standard and extended ACLs, as well as the use of wildcard masking for IP address matching. ACLs help restrict network access and classify traffic for special handling, processing packets in a sequential manner based on defined statements.

Uploaded by

asfa rehman
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPT, PDF, TXT or read online on Scribd
You are on page 1/ 18

Managing IP Traffic with ACLs

Introducing ACLs

© 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-1


Outline

• Overview
• ACL Overview
• ACL Applications
• Types of ACLs
• ACL Operations
• ACL Statement Processing
• Wildcard Masking Process
• Summary

© 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-2


Why Use ACLs?

• Manage IP traffic as network access grows


• Filter packets as they pass through the router

© 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-3


ACL Applications

• Permit or deny packets moving through the router.


• Permit or deny vty access to or from the router.
• Without ACLs, all packets could be transmitted onto all parts of your network.

© 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-4


Other ACL Uses

• Special handling for traffic based on packet tests

© 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-5


Types of ACLs

• Standard ACL
– Checks source address
– Generally permits or denies entire protocol suite
• Extended ACL
– Checks source and destination address
– Generally permits or denies specific protocols

© 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-6


How to Identify ACLs

• Standard IP lists (1-99) test conditions of all IP packets from


source addresses.
• Extended IP lists (100-199) test conditions of source and destination addresses,
specific TCP/IP protocols, and destination ports.
• Standard IP lists (1300-1999) (expanded range).
• Extended IP lists (2000-2699) (expanded range).
• Other ACL number ranges test conditions for other networking protocols.
• Named ACLs identify IP standard and extended ACLs with an alphanumeric
string (name).

© 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-7


Testing Packets with
Standard ACLs

© 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-8


Testing Packets with
Extended ACLs

© 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-9


Outbound ACL Operation

• If no ACL statement matches, discard the packet.


© 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-10
A List of Tests: Deny or Permit

© 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-11


Wildcard Bits: How to Check the
Corresponding Address Bits

• 0 means check value of corresponding address bit.


• 1 means ignore value of corresponding address bit.

© 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-12


Wildcard Bits to Match a Specific IP Host
Address

• Check all of the address bits (match all).


• Verify an IP host address, for example:

• 172.30.16.29 0.0.0.0 checks all of the address bits.


• Abbreviate this wildcard mask using the IP address preceded
by the keyword host (host 172.30.16.29).

© 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-13


Wildcard Bits to Match Any IP Address

• Test conditions: Ignore all the address bits (match any).


• An IP host address, for example:

• Accept any address: any


• Abbreviate expression with keyword “any”

© 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-14


Wildcard Bits to Match IP Subnets

• Check for IP subnets 172.30.16.0/24 to 172.30.31.0/24.


• Address and wildcard mask:
172.30.16.0 0.0.15.255

© 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-15


Summary

• ACLs allow the packet flow to be filtered into or out of router


interfaces and vty ports to help limit network traffic and
restrict network use by certain users or devices.
• ACLs can be used to classify and differentiate traffic for
special handling.
• Standard ACLs check the source addresses of packets that
could be routed. Extended ACLs check both source and
destination packet addresses.

© 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-16


Summary (Cont.)

• Inbound ACLs process incoming packets as they enter the


router. Outbound ACLs process outgoing packets before they
leave an outbound interface.
• ACL statements operate in sequential, logical order. ACL
statements evaluate packets from the top down, one
statement at a time, until a matching statement is found.
• ACL address wildcard masking can be used to identify how to
check or ignore corresponding IP address bits. Wildcard
masking uses the number 1 and the number 0 to identify how
to treat the corresponding IP address bits.

© 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-17


© 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-18

You might also like