Icnd23 s04l01

  • 24 views
Uploaded on

 

More in: Technology , Education
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Be the first to comment
    Be the first to like this
No Downloads

Views

Total Views
24
On Slideshare
0
From Embeds
0
Number of Embeds
0

Actions

Shares
Downloads
4
Comments
0
Likes
0

Embeds 0

No embeds

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
    No notes for slide

Transcript

  • 1. Managing IP Traffic with ACLs Introducing ACLs © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-1
  • 2. Outline • Overview • ACL Overview • ACL Applications • Types of ACLs • ACL Operations • ACL Statement Processing • Wildcard Masking Process • Summary © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-2
  • 3. Why Use ACLs? • Manage IP traffic as network access grows • Filter packets as they pass through the router © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-3
  • 4. ACL Applications • Permit or deny packets moving through the router. • Permit or deny vty access to or from the router. • Without ACLs, all packets could be transmitted onto all parts of your network. © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-4
  • 5. Other ACL Uses • Special handling for traffic based on packet tests © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-5
  • 6. Types of ACLs • Standard ACL – Checks source address – Generally permits or denies entire protocol suite • Extended ACL – Checks source and destination address – Generally permits or denies specific protocols © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-6
  • 7. How to Identify ACLs • Standard IP lists (1-99) test conditions of all IP packets from source addresses. • Extended IP lists (100-199) test conditions of source and destination addresses, specific TCP/IP protocols, and destination ports. • Standard IP lists (1300-1999) (expanded range). • Extended IP lists (2000-2699) (expanded range). • Other ACL number ranges test conditions for other networking protocols. • Named ACLs identify IP standard and extended ACLs with an alphanumeric string (name). © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-7
  • 8. Testing Packets with Standard ACLs © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-8
  • 9. Testing Packets with Extended ACLs © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-9
  • 10. Outbound ACL Operation • If no ACL statement matches, discard the packet. © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-10
  • 11. A List of Tests: Deny or Permit © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-11
  • 12. Wildcard Bits: How to Check the Corresponding Address Bits • 0 means check value of corresponding address bit. • 1 means ignore value of corresponding address bit. © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-12
  • 13. Wildcard Bits to Match a Specific IP Host Address • Check all of the address bits (match all). • Verify an IP host address, for example: • 172.30.16.29 0.0.0.0 checks all of the address bits. • Abbreviate this wildcard mask using the IP address preceded by the keyword host (host 172.30.16.29). © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-13
  • 14. Wildcard Bits to Match Any IP Address • Test conditions: Ignore all the address bits (match any). • An IP host address, for example: • Accept any address: any • Abbreviate expression with keyword “any” © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-14
  • 15. Wildcard Bits to Match IP Subnets • Check for IP subnets 172.30.16.0/24 to 172.30.31.0/24. • Address and wildcard mask: 172.30.16.0 0.0.15.255 © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-15
  • 16. Summary • ACLs allow the packet flow to be filtered into or out of router interfaces and vty ports to help limit network traffic and restrict network use by certain users or devices. • ACLs can be used to classify and differentiate traffic for special handling. • Standard ACLs check the source addresses of packets that could be routed. Extended ACLs check both source and destination packet addresses. © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-16
  • 17. Summary (Cont.) • Inbound ACLs process incoming packets as they enter the router. Outbound ACLs process outgoing packets before they leave an outbound interface. • ACL statements operate in sequential, logical order. ACL statements evaluate packets from the top down, one statement at a time, until a matching statement is found. • ACL address wildcard masking can be used to identify how to check or ignore corresponding IP address bits. Wildcard masking uses the number 1 and the number 0 to identify how to treat the corresponding IP address bits. © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-17
  • 18. © 2006 Cisco Systems, Inc. All rights reserved. ICND v2.3—4-18