There are also two methods to identify whether an ACL is a standard ACL or extended ACL access lists
either configured as numbered access lists or named access lists with numbered ACLC the number of the
ACL determines what type of ACL it is.
So for example ACL is in the range 1099 or what's called the expanded range 2300 to one triple nine
would be used for standard IP ACLC So as an example when Arata in global configuration I can type the
C'mon access list questionmark.
And as you can see here 1 to 99 is used for IPS standard access lists the expanded range is also listed.
Certain 300 to one triple nine.
Now the reason for the expanded range is that initially about 100 ACLC seen more than enough.
But as we all know as time goes by what was deemed to be enough is not necessarily enough and these
days we can use both 1 to 99 or the expanded range if the requirement for more than 100 access lists
is their IP extended access lists on the range one hundred to one ninety nine as well as the expanded
range which is thousand to 2 6 9 9 depending on your Iowas you will see other types of ACLC listed for
instances of Port epal talk ACL in the range 600 to 699 can be used or to support IPX.
You could for instance use a cells in the range 800 to eight nine nine or extended IPX X-ists lists
in the range 900 to 9 9 9.
Notice have for example ACLJ in the range 700 to 7 9 9 are used for mac address access lists in this
course we fortunately only concentrate on Ickey access lists so we will concentrate on both IP stented
access lists an IP extended access lists that be away please that there are other number ranges used
for other protocols like IPX Apple talk and so forth.
The second type is named X-ists lists which are more descriptive because they use alphanumeric characters
as names.
So rather than access list 100 for instance permitting telnet traffic to switch you could call TACL
hemat telnet and give it a name with more meaning.
That also allows you to create many many more ACLC on a router than the list specified by the numbered
ACLC originally named ACLJ also gave you more flexibility when it came to editing individual lines or
deleting individual lines in an ACL.
But these days that flexibility is available for both named as well as numbered ACLC just to demonstrate
a little bit more.
If I specify one as my ACL number.
Notice it gives me three options.
Deny permit or remark.
Now let's start with the last one.
The Remarque option allows you to add a description to your heels.
This is very useful because when you return to an ACL that you configured months ago rather than having
to decipher the lines of the ACL the remark or in other words the description conflicts you know what
that ACL is attempting to accomplish.
So it's recommended that you use the remark statement to add descriptions TACL as to make them more
user friendly and understandable both for yourself and for others.
Do I choose the option to meet notice because this is a standard IP access list the only options here
are permitting either a hostname or IP address permitting any which permits everyone or anything and
the host option.
So I could for example put in and dress like 10.0 one would one.
And then noticed the next option is to put in wildcard bets or to hit enter or I can log this information
to say this log server or another logging device on my network.
So if I put in the option 0 then 0.00 that is specifying that I will permit traffic from a specific
host 10 dot one dot 1.1.
Now ISIL is don't you stented network mosques.
They use Inv. mosques whereas zero in binary means they must be a match and a one in binary means that
doesn't have to be a match.
So just to reiterate you need to look at this in binary if you're not sure a zero in binary in the mosque
means that there must be a match on the host or network a one in the mosque means that we ignore the
host or network Valley.
So as an example if I want to match a specific IP address I can tap the come on access list one 1 denoting
that this is a standard the access list.
I'm permitting traffic that matches 10 dot one dot 1.1 exactly the zeros in the mosque mean that the
first octet must be a 10.
The second noctis must be a one the third octet must be a one and the fourth octet must be or 1 0 in
the MOS means an exact match a one in the most means.
It doesn't have to match.
So this statement will only match for specific host with the IP address 10 dot $1.1 1.
Now rather than doing it that way you can configure the access list as follows.
You can tap on access list one Hammet.
And in this case we're looking for a specific host.
So you can use the keyword host and then specifying the host IP address either will do.
It's like saying tomato versus to Meda depending on which you prefer will depend on which one you configure.
The opposite of specifying an individual host would be matching anything or everything.
So you could create an access list access list one per minute and notice in the address portion we have
put 0 0 0 0.
And this could essentially be made anything in the Moscow but we've put 2 5 5 2 4 5 2 4 5 2 4 5.
I remember a one in binary in the mosque means ignored this failure.
In other words it can be anything at zero in the mosque means an exact match.
So if we look at the IP address it's 0.0 0.0 in decimal which is equal to all zeroes in binary this
get in the binary address obviously doesn't exist.
I'll just put a chair for readability.
So looking at the address in binary it's eight zeros the mosque.
In other words in the first octet the mosque is set to 255 which is equal to eight binary ones.
So what we are saying by putting 255 in the first octet in the mosque is that the first octet in the
address is irrelevant.
We are just ignoring all the bets we've done the same with Octave two three and four.
So this is essentially meshing anything or everything.
And we are not matching any specific host or network.
Alternately you could also use the syntax access list one that any.
So once again tomato versus tomato you decide which you prefer.
Both will work and both have the same result.
If you wanted to match an individual subnet rather than an individual host for any traffic you could
use a combination of zeros and ones in the mosque.
So as an example X-ists list one has met 10 and notice in the mosque we have a zero in the first octet
which means that we are matching on the 10 10 dot wonder 1.0.
And in the mosque we have 0 0 0 up 255.
Now in the first octet in the mosque we have got binary zeros which means that there must be an exact
match on the address.
In other words we are specifically matching the first octet.
It must be equal to a 10.
The second octet must be 1 because we've got a zero in the mosque.
The third octet must be 1 because we have a zero in the mosque.
But notice in the fourth octet this can be set to anything because we've got binary ones in the fourth
octet 255 if you remember is eight binary ones.
In other words we are saying we don't care what the last octet does City this statement will match any
host or any address where the first three octets are set to 10 dot one dot one.
The fourth octet can be anything.
So just to sum up if we were using the dotted decimal notation it matches specific IP address like 10
1 1 1.
We would fool the mosque with Ciro's.
Once again this is an inverse mosque.
A zero in the mosque means that we are looking for a specific value in the host portion of the address.
A one in the mosque means we ignore what the host portion is 60.
So this matches a specific IP address to match specific subnet lets say 10 1 1 0.
We could configure the access list is 10 1 1 0 with the first three octets equal to zero.
And the last octet equal to 255.
Or if we wanted to match anything we could say the host portion to actually any number and the mosque
at 255 255 255 255.
So as an example on a Rodda I could top the cream on access list to the Met and then specify anything
I wanted to.
But if a mosque is set to all ones flattops the come on show IP X-ists list
noticed the rioters changed that to say permit any.
We talked this on the Rodda but the rot has changed it to permit any I can do the come on show run piping
clean access list to see all my ex's live statements configured on the router and you can see once again
the Rodda has changed the format of the access lists.