Now let's implement some examples of extended IP access lists.
In this example we are saying permit sheepy traffic from 10 1 1 1 to 10 1 to 1.
In other words this host should be permitted to talk to the server but only using a sheepy.
We need to deny all other traffic from subnet 10 1 1 0 Sless 24 going to the server.
In other words anyone else in the subnet should be denied access to the specific server.
But we want to permit all other traffic from the subnet anywhere else.
In other words this host for example should be able to connect to this router to be able to connect
to this router should be able to send traffic to this MacBook.
Now once again it's very important to look at the direction of the traffic so the traffic flow is from
left to right now as per best practices and extended IP access list should be placed as close to the
source as possible and thus we can apply the access list inbound on Fosset.
Ethan it's 0.
The advantage of doing this as well is that the router does not need to process packets unnecessarily
which is just going to be dropped elsewhere in the network.
So we will apply the access list as close to the source as we can and the closest interfaces F-Series
level 0.
So the first statement should permit HDP traffic from 10 1 1 1 to 10 1 to 1 on the Rodda going into
global configuration mode.
I can talk to him on this list and notice once again is a range of numbers.
We are going to choose one in this range 100 to 199 because we're creating an extended IP access list.
So let's pick 100 now we're going to say permit notice here we can permit multiple protocols.
Now this is where it becomes important knowing what lower level protocols Hialeah protocols like HTP
use.
So in this example we are looking to permit HTP HGP relies on TGP at least for.
And there was a model so we are going to specify TZP and Boadicea we can specify a source.
So I'm going to do it this way.
I notice I can put in my wildcard bits.
So that was the source.
And now we need to specify a destination.
In this case the destination is 10 1 to 1 so doing it another way I'm going to specify a host 10 Dalt
one to 2 to one.
And that is if I press question mark at the end it gives me many options here including equal which
allows me to match on a specific port number or greater than which allows me to look at port numbers
greater than a certain number.
All less then which allows me to look at port numbers less than a specific number.
All range which allows me to look at port numbers in a specific range.
But in this case we're looking for HTP so I'm going to topic him on equal press question mark.
I notice I can enter a specific port number if I know the number or I can use the word and notice the
many words here.
But notice as an example HGP use of the word GWW so I could either put in 80 or I could put in w WW.
Once again notice the dollar sign.
It's just telling me that there's more to the left.
So I put in the command control a They'll take me to the beginning of the line or control e takes me
to the end of the line that dollars just telling me that there's more takes than what can fit on the
specific output.
So it's just hidden some of the text to make it easier to read.
So I can hit enter so that completes the first part of the access list.
Now we have to deny all of the traffic from that specific subnet to the server.
So I could to come on this list 100 and in this case specify denie.
Now we have to specify protocol so we can just deny everything.
In other words deny all IP the source is tendered 1. 1.0 put in the wildcard mos.
The destination is aspecific host which is 10 1 2 2 0 1 it enter.
So that line denies all other traffic.
So in other words all IP traffic is denied from subnet 10 1 1 0 10 1 1 0 with the relevant mosque going
to host 10 1 to 1 which is what we've got configured here.
So we have successfully created the second part of the axis list.
The third part is saying permit all other traffic from subnet anywhere else so I could literally just
say access list 100 Myrt IP and we're going to specify that specific subnet Tendo squandered 1.0 with
the mosque.
And in this case I can say any way.
So any the last step is to bind the access list on the interface.
So IP access group 100 in.
Now just to show you what we've configured show access list shows me in this case that I've got an extended
IP access list.
The first line is permitting TCAP from that host 10 1 on 1 to host 10 1 to 1.
And notice the rod has automatically changed the port number into the name description double-D WW.
The second line is denying traffic from that subnet to the host 10 1 to 1 and the third line is permitting
traffic from that subnet anyway.
Show IP interface 0 0 shows me an example that that access list is bound inbound on Fosset Ethernet
Cirrus flesh sirra.
So we have accomplished what we set out to do based on those criteria.
In this example we want to permit both HGP and TFT traffic from the submit 10 1 1 0 slash 24 to the
server.
In other words devices on the subnet should be able to open SCDP sessions and DFT sessions to the server.
We then want to deny all other traffic from the subnet to the server.
In other words we only want to allow HTP and TFT the traffic to the server and no other traffic.
But we also want to permit all other traffic from the subnet anywhere else.
In other words these devices and the subnet should be able to access this server to actually TFT TFT.
They should not be able to use any other protocols to access the server but they should be able to connect
for instance to this MacBook using any protocol.
So the first thing we need to look at is the direction and once again the traffic is flowing from the
left hand side to the right hand side.
Once again as our base practices we will apply the access list inbound on FASA Ethernet 00 on our one
because this is the interface closest to the source of traffic so to do that on our road to go into
global config mode again top access list choose a number.
In this case choose 101 because its an extended access list.
I mean the next one available choose commed and this case which is our protocol we are going to be permitting
both HGP and TFT P from the subnet to the server.
Remember HGP uses TZP Atlay for that TFT P uses UDP at Layer 4 so firstly TCAP the source network is
10 1 1 0 the wildcard mosque 0 0 0 255.
So that's our source.
And now we have to specify the destination the destination is our server 10 dot 1.2 to 1.
And now we can choose either equal or greater than less than or range and so forth.
In this case we're going to say equal to port 80.
In other words HTP the next line would be 40 50 p before we do that let's put a remark in just to make
it easier to understand.
So I'd say Remarque SMRT London site to New York City for example and they will say access this 101
Matt.
In this case you have to specify UDP because TFT uses UDP.
The source
subnet going to the destination.
In this case I'll just change it around just to show you that both options will work.
I can specify the server with a mosque.
And in this case the set equal and notice now please.
The protocols are different because we are using UDP as an example you won't see HTP in this list but
you will see TFT the rod is clever enough to know which Hiler protocols use UDP or TZP.
And in this example we specified UDP.
So I'm just going to say 69.
It's also at a remark to make this more descriptive exercise 101
remark met TFT from London site to New York service for example.
That remark is obviously just for us as humans to know what's going on and has no effect on the router.
So we have permitted HGP and TFT traffic from that subnet to the server and now we are told to deny
all other traffic from the subnet to the server.
So access list one deny.
And because this is an IP based access let's begin to deny IP tendered wondered 1.0 0.02 0 to 255 and
we're told only deny traffic from that subnet to the server so the destination will be host 10 one or
two to one.
So we've met the second criteria the last step is to permit all other traffic from the subnet anywhere
else so we would say access list 101 commit 10 dot dot 1.0 with a mosque anywhere the last step is to
bind it on to the interface interface if sera sera as per our best practices begin to bind it in in-bound
and this interface so IP X-ists group 101 in and that's at in this example we want to promote HTP and
TFT traffic from any way to the server 10 1 to 1 but we're going to deny all of the traffic to the server.
So now things are a little bit different.
We are only allowing a European TFT from anywhere to the server.
So traffic from this host as well as these hosts needs to have access to the server but only HGP and
TFT traffic.
If we were asked to only apply a single access list we would need to apply it outbound and if Sarah
is left for However we were given the option to apply multiple access control lists we would for instance
apply it on 0 1 on Arti as well as 0 7 0 on or 1 which would have the effect that traffic that is going
to be dropped will be dropped sooner and quicker rather than traversing the when link and then being
dropped as when using this setup so easy to read between the lines and determine what you are being
asked to do and what restrictions have been placed on your solutions.
So on the route of before we go any further lets see what access lists have been configured so I can
do the C'mon show run pipe include access list which will just show me the access list part of the configuration
on this router.
As you can see here we created this list three ACL four ACL five
extended ACL 100 an extended ACL 101.
Notice its easier to see what's going on when the remarks or descriptions have been added to the access
list to going into level configuration mode.
I can top the command access list one or two per murd TZP.
Any host 10 not 1 or 2 to 1 or all of the
equal 80 once again be very careful.
What I've just done there that statement no access list one or two would have removed the entire access
list.
I'll show you in a moment how you can edit individual lines on an access list and an access list 100
to permit UDP.
Any host ten dollars $1.2 one equal sixty nine.
That will accomplish what we set out to do with this first statement and then we need to deny all other
traffic on that server.
So access list one or two deny IP any and don't forget you have to put the source and destination I
can now that's a mistake.
Now if I do that Kim Monge do show access list one or two.
You'll notice these line numbers 10 20 30 later versions of the Iowas the rajah to automatically puts
line numbers on each line created which is great because it allows us to edit individual lines if I
tap the command no access list wanted to deny IP any any to try and remove this last line.
It will remove the entire access list.
So rather than doing that I can do the common IP access list extended because this is an extended IP
access list and then I put the number in and then I can type node city to remove line 30 stopping the
come do show access list one or two will show you that that last line has been removed.
And I could add the line back by saying city deny any host 10 1 or 2 to 1 or rather the night IP any
host 10 1 to 1 and not doing a show come on shows me that that line has been added correctly.
So that makes life a lot easier rather than having to delete the access list and then recreate it from
scratch or editing a notepad.
You could edit it directly on the router.
The last step once again would be to bind it on the interface if seriously 6 zero outbound.