SlideShare a Scribd company logo
Filtering Traffic
              Using Access
              Control Lists


              Introducing Routing and Switching in the Enterprise –
              Chapter 8




Version 4.0       © 2006 Cisco Systems, Inc. All rights reserved.   Cisco Public   1
Objectives
   Describe traffic filtering and explain how Access
    Control Lists (ACLs) can filter traffic at router
    interfaces.
   Analyze the use of wildcard masks.
   Configure and implement ACLs.
   Create and apply ACLs to control specific types of
    traffic.
   Log ACL activity and integrate ACL best practices.




    © 2006 Cisco Systems, Inc. All rights reserved.   Cisco Public   2
Describe Traffic Filtering
 Analyze the contents of a packet
 Allow or block the packet
 Based on source IP, destination IP, MAC address,
  protocol, application type




    © 2006 Cisco Systems, Inc. All rights reserved.   Cisco Public   3
Describe Traffic Filtering
Devices providing traffic filtering:
 Firewalls built into integrated routers
 Dedicated security appliances
 Servers




    © 2006 Cisco Systems, Inc. All rights reserved.   Cisco Public   4
Describe Traffic Filtering
 Uses for ACLs:
  Specify internal hosts for NAT
  Classify traffic for QoS
  Restrict routing updates, limit debug outputs, control
   virtual terminal access




     © 2006 Cisco Systems, Inc. All rights reserved.   Cisco Public   5
Describe Traffic Filtering
Possible issues with ACLs:
 Increased load on router
 Possible network disruption
 Unintended consequences from incorrect placement




   © 2006 Cisco Systems, Inc. All rights reserved.   Cisco Public   6
Describe Traffic Filtering
  Standard ACLs filter based on source IP address
  Extended ACLs filter on source and destination, as well
   as protocol and port number
  Named ACLs can be either standard or extended




    © 2006 Cisco Systems, Inc. All rights reserved.   Cisco Public   7
Describe Traffic Filtering
  ACLs consist of statements
  At least one statement must be a permit statement
  Final statement is an implicit deny
  ACL must be applied to an interface in order to work




    © 2006 Cisco Systems, Inc. All rights reserved.   Cisco Public   8
Describe Traffic Filtering
 ACL is applied inbound or outbound
 Direction is from the router’s perspective
 Each interface can have one ACL per direction for each
  network protocol




   © 2006 Cisco Systems, Inc. All rights reserved.   Cisco Public   9
Analyze the Use of Wildcard Masks
 Wildcard mask can block a range of addresses or a
  whole network with one statement
 0s indicate which part of an IP address must match the
  ACL
 1s indicate which part does not have to match
  specifically




   © 2006 Cisco Systems, Inc. All rights reserved.   Cisco Public   10
Analyze the Use of Wildcard Masks
 Use the host parameter in place of a 0.0.0.0 wildcard
 Use the any parameter in place of a 255.255.255.255
  wildcard




   © 2006 Cisco Systems, Inc. All rights reserved.   Cisco Public   11
Configure and Implement Access
  Control Lists
 Determine traffic filtering requirements
 Decide which type of ACL to use
 Determine the router and interface on which to apply
  the ACL
 Determine in which direction to filter traffic




    © 2006 Cisco Systems, Inc. All rights reserved.   Cisco Public   12
Configure and Implement Access Control
  Lists: Numbered Standard ACL
    Use access-list command to enter statements
    Use the same number for all statements
    Number ranges: 1-99, 1300-1999
    Apply as close to the destination as possible




      © 2006 Cisco Systems, Inc. All rights reserved.   Cisco Public   13
Configure and Implement Access Control
  Lists: Numbered Extended ACL
    Use access-list command to enter statements
    Use the same number for all statements
    Number ranges: 100-199, 2000-2699
    Specify a protocol to permit or deny
    Place as close to the source as possible




      © 2006 Cisco Systems, Inc. All rights reserved.   Cisco Public   14
Configure and Implement Access
  Control Lists: Named ACLs
 Descriptive name replaces number range
 Use ip access-list command to enter initial statement
 Start succeeding statements with either permit or deny
 Apply in the same way as standard or extended ACL




    © 2006 Cisco Systems, Inc. All rights reserved.   Cisco Public   15
Configure and Implement Access
  Control Lists: VTY access
 Create the ACL in line configuration mode
 Use the access-class command to initiate the ACL
 Use a numbered ACL
 Apply identical restrictions to all VTY lines




    © 2006 Cisco Systems, Inc. All rights reserved.   Cisco Public   16
Create and Apply ACLs to Control Specific
   Types of Traffic
  Use a specified condition when filtering on port
   numbers: eq, lt, gt
  Deny all appropriate ports for multi-port applications like
   FTP
  Use the range operator to filter a group of ports




     © 2006 Cisco Systems, Inc. All rights reserved.   Cisco Public   17
Create and Apply ACLs to Control Specific
   Types of Traffic
  Block harmful external traffic while allowing internal
   users free access
  Ping: allow echo replies while denying echo requests
   from outside the network
  Stateful Packet Inspection




     © 2006 Cisco Systems, Inc. All rights reserved.   Cisco Public   18
Create and Apply ACLs to Control Specific
   Types of Traffic
  Account for NAT when creating and applying ACLs to a
   NAT interface
  Filter public addresses on a NAT outside interface
  Filter private addresses on a NAT inside interface




    © 2006 Cisco Systems, Inc. All rights reserved.   Cisco Public   19
Create and Apply ACLs to Control Specific
   Types of Traffic
  Examine every ACL one line at a time to avoid
   unintended consequences




    © 2006 Cisco Systems, Inc. All rights reserved.   Cisco Public   20
Create and Apply ACLs to Control Specific
   Types of Traffic
  Apply ACLs to VLAN interfaces or subinterfaces just as
   with physical interfaces




    © 2006 Cisco Systems, Inc. All rights reserved.   Cisco Public   21
Log ACL Activity and ACL Best Practices
  Logging provides additional details on packets denied
   or permitted
  Add the log option to the end of each ACL statement to
   be tracked




    © 2006 Cisco Systems, Inc. All rights reserved.   Cisco Public   22
Log ACL Activity and ACL Best Practices
 Syslog messages:
  Status of router interfaces
  ACL messages
  Bandwidth, protocols in use, configuration events




     © 2006 Cisco Systems, Inc. All rights reserved.   Cisco Public   23
Log ACL Activity and ACL Best Practices
  Always test basic connectivity before applying ACLs
  Add deny ip any to the end of an ACL when logging
  Use reload in 30 when testing ACLs on remote routers




    © 2006 Cisco Systems, Inc. All rights reserved.   Cisco Public   24
Summary
 ACLs enable traffic management and secure access to
  and from a network and its resources
 Apply an ACL to filter inbound or outbound traffic
 ACLs can be standard, extended, or named
 Using a wildcard mask provides flexibility
 There is an implicit deny statement at the end of an
  ACL
 Account for NAT when creating and applying ACLs
 Logging provides additional details on filtered traffic


    © 2006 Cisco Systems, Inc. All rights reserved.   Cisco Public   25
© 2006 Cisco Systems, Inc. All rights reserved.   Cisco Public   26

More Related Content

What's hot

CCNA Exploration 4 - Chapter 6
CCNA Exploration 4 - Chapter 6CCNA Exploration 4 - Chapter 6
CCNA Exploration 4 - Chapter 6
Irsandi Hasan
 
Week4(1)(1)
Week4(1)(1)Week4(1)(1)
Week4(1)(1)
trayyoo
 
CCNA Discovery 3 - Chapter 1
CCNA Discovery 3 - Chapter 1CCNA Discovery 3 - Chapter 1
CCNA Discovery 3 - Chapter 1
Irsandi Hasan
 
Week5 f2017(1)
Week5 f2017(1)Week5 f2017(1)
Week5 f2017(1)
trayyoo
 
CCNA Discovery 4 - Chapter 6
CCNA Discovery 4 - Chapter 6CCNA Discovery 4 - Chapter 6
CCNA Discovery 4 - Chapter 6
Irsandi Hasan
 
CCNA Exploration 4 - Chapter 4
CCNA Exploration 4 - Chapter 4CCNA Exploration 4 - Chapter 4
CCNA Exploration 4 - Chapter 4
Irsandi Hasan
 
CCNAv5 - S3: Chapter 4 Wireless Lans
CCNAv5 - S3: Chapter 4 Wireless LansCCNAv5 - S3: Chapter 4 Wireless Lans
CCNAv5 - S3: Chapter 4 Wireless Lans
Vuz Dở Hơi
 
CCNA Discovery 4 - Chapter 5
CCNA Discovery 4 - Chapter 5CCNA Discovery 4 - Chapter 5
CCNA Discovery 4 - Chapter 5
Irsandi Hasan
 
Exploration lan switching_chapter3
Exploration lan switching_chapter3Exploration lan switching_chapter3
Exploration lan switching_chapter3
Jaime Cuevas
 
CCNA Discovery 4 - Chapter 9
CCNA Discovery 4 - Chapter 9CCNA Discovery 4 - Chapter 9
CCNA Discovery 4 - Chapter 9
Irsandi Hasan
 
Exploration Lan Switching Chapter2
Exploration Lan Switching Chapter2Exploration Lan Switching Chapter2
Exploration Lan Switching Chapter2
Carmelo de Jesús
 
CCNA Discovery 4 - Chapter 8
CCNA Discovery 4 - Chapter 8CCNA Discovery 4 - Chapter 8
CCNA Discovery 4 - Chapter 8
Irsandi Hasan
 
CCNA Discovery 4 - Chapter 3
CCNA Discovery 4 - Chapter 3CCNA Discovery 4 - Chapter 3
CCNA Discovery 4 - Chapter 3
Irsandi Hasan
 
CCNAv5 - S3: Chapter3 Link Aggregation
CCNAv5 - S3: Chapter3 Link AggregationCCNAv5 - S3: Chapter3 Link Aggregation
CCNAv5 - S3: Chapter3 Link Aggregation
Vuz Dở Hơi
 
CCNA Discovery 4 - Chapter 7
CCNA Discovery 4 - Chapter 7CCNA Discovery 4 - Chapter 7
CCNA Discovery 4 - Chapter 7
Irsandi Hasan
 
Chapter 6
Chapter 6Chapter 6
Chapter 6
ali raza
 
Week3 1
Week3 1Week3 1
Week3 1
trayyoo
 
Chapter 3
Chapter 3Chapter 3
Chapter 3
ali raza
 
CCNAv5 - S3: Chapter2 Lan Redundancy
CCNAv5 - S3: Chapter2 Lan RedundancyCCNAv5 - S3: Chapter2 Lan Redundancy
CCNAv5 - S3: Chapter2 Lan Redundancy
Vuz Dở Hơi
 
Chapter 2 overview
Chapter 2 overviewChapter 2 overview
Chapter 2 overview
shah_ril1512
 

What's hot (20)

CCNA Exploration 4 - Chapter 6
CCNA Exploration 4 - Chapter 6CCNA Exploration 4 - Chapter 6
CCNA Exploration 4 - Chapter 6
 
Week4(1)(1)
Week4(1)(1)Week4(1)(1)
Week4(1)(1)
 
CCNA Discovery 3 - Chapter 1
CCNA Discovery 3 - Chapter 1CCNA Discovery 3 - Chapter 1
CCNA Discovery 3 - Chapter 1
 
Week5 f2017(1)
Week5 f2017(1)Week5 f2017(1)
Week5 f2017(1)
 
CCNA Discovery 4 - Chapter 6
CCNA Discovery 4 - Chapter 6CCNA Discovery 4 - Chapter 6
CCNA Discovery 4 - Chapter 6
 
CCNA Exploration 4 - Chapter 4
CCNA Exploration 4 - Chapter 4CCNA Exploration 4 - Chapter 4
CCNA Exploration 4 - Chapter 4
 
CCNAv5 - S3: Chapter 4 Wireless Lans
CCNAv5 - S3: Chapter 4 Wireless LansCCNAv5 - S3: Chapter 4 Wireless Lans
CCNAv5 - S3: Chapter 4 Wireless Lans
 
CCNA Discovery 4 - Chapter 5
CCNA Discovery 4 - Chapter 5CCNA Discovery 4 - Chapter 5
CCNA Discovery 4 - Chapter 5
 
Exploration lan switching_chapter3
Exploration lan switching_chapter3Exploration lan switching_chapter3
Exploration lan switching_chapter3
 
CCNA Discovery 4 - Chapter 9
CCNA Discovery 4 - Chapter 9CCNA Discovery 4 - Chapter 9
CCNA Discovery 4 - Chapter 9
 
Exploration Lan Switching Chapter2
Exploration Lan Switching Chapter2Exploration Lan Switching Chapter2
Exploration Lan Switching Chapter2
 
CCNA Discovery 4 - Chapter 8
CCNA Discovery 4 - Chapter 8CCNA Discovery 4 - Chapter 8
CCNA Discovery 4 - Chapter 8
 
CCNA Discovery 4 - Chapter 3
CCNA Discovery 4 - Chapter 3CCNA Discovery 4 - Chapter 3
CCNA Discovery 4 - Chapter 3
 
CCNAv5 - S3: Chapter3 Link Aggregation
CCNAv5 - S3: Chapter3 Link AggregationCCNAv5 - S3: Chapter3 Link Aggregation
CCNAv5 - S3: Chapter3 Link Aggregation
 
CCNA Discovery 4 - Chapter 7
CCNA Discovery 4 - Chapter 7CCNA Discovery 4 - Chapter 7
CCNA Discovery 4 - Chapter 7
 
Chapter 6
Chapter 6Chapter 6
Chapter 6
 
Week3 1
Week3 1Week3 1
Week3 1
 
Chapter 3
Chapter 3Chapter 3
Chapter 3
 
CCNAv5 - S3: Chapter2 Lan Redundancy
CCNAv5 - S3: Chapter2 Lan RedundancyCCNAv5 - S3: Chapter2 Lan Redundancy
CCNAv5 - S3: Chapter2 Lan Redundancy
 
Chapter 2 overview
Chapter 2 overviewChapter 2 overview
Chapter 2 overview
 

Viewers also liked

CCNA Discovery 2 - Chapter 7
CCNA Discovery 2 - Chapter 7CCNA Discovery 2 - Chapter 7
CCNA Discovery 2 - Chapter 7
Irsandi Hasan
 
CCNA Discovery 4 - Chapter 4
CCNA Discovery 4 - Chapter 4CCNA Discovery 4 - Chapter 4
CCNA Discovery 4 - Chapter 4
Irsandi Hasan
 
CCNA Discovery 4 - Chapter 1
CCNA Discovery 4 - Chapter 1CCNA Discovery 4 - Chapter 1
CCNA Discovery 4 - Chapter 1
Irsandi Hasan
 
CCNA Discovery 4 - Chapter 2
CCNA Discovery 4 - Chapter 2CCNA Discovery 4 - Chapter 2
CCNA Discovery 4 - Chapter 2
Irsandi Hasan
 
CCNA Discovery 2 - Chapter 9
CCNA Discovery 2 - Chapter 9CCNA Discovery 2 - Chapter 9
CCNA Discovery 2 - Chapter 9
Irsandi Hasan
 
CCNA Discovery 2 - Chapter 8
CCNA Discovery 2 - Chapter 8CCNA Discovery 2 - Chapter 8
CCNA Discovery 2 - Chapter 8
Irsandi Hasan
 

Viewers also liked (6)

CCNA Discovery 2 - Chapter 7
CCNA Discovery 2 - Chapter 7CCNA Discovery 2 - Chapter 7
CCNA Discovery 2 - Chapter 7
 
CCNA Discovery 4 - Chapter 4
CCNA Discovery 4 - Chapter 4CCNA Discovery 4 - Chapter 4
CCNA Discovery 4 - Chapter 4
 
CCNA Discovery 4 - Chapter 1
CCNA Discovery 4 - Chapter 1CCNA Discovery 4 - Chapter 1
CCNA Discovery 4 - Chapter 1
 
CCNA Discovery 4 - Chapter 2
CCNA Discovery 4 - Chapter 2CCNA Discovery 4 - Chapter 2
CCNA Discovery 4 - Chapter 2
 
CCNA Discovery 2 - Chapter 9
CCNA Discovery 2 - Chapter 9CCNA Discovery 2 - Chapter 9
CCNA Discovery 2 - Chapter 9
 
CCNA Discovery 2 - Chapter 8
CCNA Discovery 2 - Chapter 8CCNA Discovery 2 - Chapter 8
CCNA Discovery 2 - Chapter 8
 

Similar to CCNA Discovery 3 - Chapter 8

CCNA 2 Routing and Switching v5.0 Chapter 9
CCNA 2 Routing and Switching v5.0 Chapter 9CCNA 2 Routing and Switching v5.0 Chapter 9
CCNA 2 Routing and Switching v5.0 Chapter 9
Nil Menon
 
CCNAv5 - S2: Chapter 9 Access Control Lists
CCNAv5 - S2: Chapter 9 Access Control ListsCCNAv5 - S2: Chapter 9 Access Control Lists
CCNAv5 - S2: Chapter 9 Access Control Lists
Vuz Dở Hơi
 
Chapter 09 - Access Control Lists
Chapter 09 - Access Control ListsChapter 09 - Access Control Lists
Chapter 09 - Access Control Lists
Yaser Rahmati
 
Chapter 20 : access control lists
Chapter 20 : access control listsChapter 20 : access control lists
Chapter 20 : access control lists
teknetir
 
CCNA_RSE_Chp7.pptx
CCNA_RSE_Chp7.pptxCCNA_RSE_Chp7.pptx
CCNA_RSE_Chp7.pptx
NarcisIlie1
 
CCNA (R & S) Module 02 - Connecting Networks - Chapter 4
CCNA (R & S) Module 02 - Connecting Networks - Chapter 4CCNA (R & S) Module 02 - Connecting Networks - Chapter 4
CCNA (R & S) Module 02 - Connecting Networks - Chapter 4
Waqas Ahmed Nawaz
 
CNv6_instructorPPT_Chapter4.pptx
CNv6_instructorPPT_Chapter4.pptxCNv6_instructorPPT_Chapter4.pptx
CNv6_instructorPPT_Chapter4.pptx
OritseKings
 
Chapter 08 - Acl
Chapter 08 - AclChapter 08 - Acl
Chapter 08 - Acl
phanleson
 
redes telematicas CISCO para ingenieros parte 2
redes telematicas CISCO para ingenieros parte 2redes telematicas CISCO para ingenieros parte 2
redes telematicas CISCO para ingenieros parte 2
VictorTonio
 
Icnd210 s06l01
Icnd210 s06l01Icnd210 s06l01
Icnd210 s06l01
computerlenguyen
 
CCNA3 Verson6 Chapter7
CCNA3 Verson6 Chapter7CCNA3 Verson6 Chapter7
CCNA3 Verson6 Chapter7
Chaing Ravuth
 
CCNA CHAPTER8 BY jetarvind kumar madhukar
CCNA CHAPTER8 BY jetarvind kumar madhukarCCNA CHAPTER8 BY jetarvind kumar madhukar
CCNA CHAPTER8 BY jetarvind kumar madhukar
ALLCAD Services Pvt Limited
 
CCNA4 Verson6 Chapter4
CCNA4 Verson6 Chapter4CCNA4 Verson6 Chapter4
CCNA4 Verson6 Chapter4
Chaing Ravuth
 
CCNA (R & S) Module 03 - Routing & Switching Essentials - Chapter 7
CCNA (R & S) Module 03 - Routing & Switching Essentials - Chapter 7CCNA (R & S) Module 03 - Routing & Switching Essentials - Chapter 7
CCNA (R & S) Module 03 - Routing & Switching Essentials - Chapter 7
Waqas Ahmed Nawaz
 
5 ip security aaa and acl
5 ip security aaa and acl5 ip security aaa and acl
5 ip security aaa and acl
SagarR24
 
Chapter 1 overview
Chapter 1 overviewChapter 1 overview
Chapter 1 overview
shah_ril1512
 
Access Control List (ACL)
Access Control List (ACL)Access Control List (ACL)
Access Control List (ACL)
ISMT College
 
ENSA_Module_4.pptx
ENSA_Module_4.pptxENSA_Module_4.pptx
ENSA_Module_4.pptx
SkyBlue659156
 
5 ip security dataplace security
5 ip security dataplace security5 ip security dataplace security
5 ip security dataplace security
SagarR24
 
5 ip security aaa
5 ip security aaa5 ip security aaa
5 ip security aaa
SagarR24
 

Similar to CCNA Discovery 3 - Chapter 8 (20)

CCNA 2 Routing and Switching v5.0 Chapter 9
CCNA 2 Routing and Switching v5.0 Chapter 9CCNA 2 Routing and Switching v5.0 Chapter 9
CCNA 2 Routing and Switching v5.0 Chapter 9
 
CCNAv5 - S2: Chapter 9 Access Control Lists
CCNAv5 - S2: Chapter 9 Access Control ListsCCNAv5 - S2: Chapter 9 Access Control Lists
CCNAv5 - S2: Chapter 9 Access Control Lists
 
Chapter 09 - Access Control Lists
Chapter 09 - Access Control ListsChapter 09 - Access Control Lists
Chapter 09 - Access Control Lists
 
Chapter 20 : access control lists
Chapter 20 : access control listsChapter 20 : access control lists
Chapter 20 : access control lists
 
CCNA_RSE_Chp7.pptx
CCNA_RSE_Chp7.pptxCCNA_RSE_Chp7.pptx
CCNA_RSE_Chp7.pptx
 
CCNA (R & S) Module 02 - Connecting Networks - Chapter 4
CCNA (R & S) Module 02 - Connecting Networks - Chapter 4CCNA (R & S) Module 02 - Connecting Networks - Chapter 4
CCNA (R & S) Module 02 - Connecting Networks - Chapter 4
 
CNv6_instructorPPT_Chapter4.pptx
CNv6_instructorPPT_Chapter4.pptxCNv6_instructorPPT_Chapter4.pptx
CNv6_instructorPPT_Chapter4.pptx
 
Chapter 08 - Acl
Chapter 08 - AclChapter 08 - Acl
Chapter 08 - Acl
 
redes telematicas CISCO para ingenieros parte 2
redes telematicas CISCO para ingenieros parte 2redes telematicas CISCO para ingenieros parte 2
redes telematicas CISCO para ingenieros parte 2
 
Icnd210 s06l01
Icnd210 s06l01Icnd210 s06l01
Icnd210 s06l01
 
CCNA3 Verson6 Chapter7
CCNA3 Verson6 Chapter7CCNA3 Verson6 Chapter7
CCNA3 Verson6 Chapter7
 
CCNA CHAPTER8 BY jetarvind kumar madhukar
CCNA CHAPTER8 BY jetarvind kumar madhukarCCNA CHAPTER8 BY jetarvind kumar madhukar
CCNA CHAPTER8 BY jetarvind kumar madhukar
 
CCNA4 Verson6 Chapter4
CCNA4 Verson6 Chapter4CCNA4 Verson6 Chapter4
CCNA4 Verson6 Chapter4
 
CCNA (R & S) Module 03 - Routing & Switching Essentials - Chapter 7
CCNA (R & S) Module 03 - Routing & Switching Essentials - Chapter 7CCNA (R & S) Module 03 - Routing & Switching Essentials - Chapter 7
CCNA (R & S) Module 03 - Routing & Switching Essentials - Chapter 7
 
5 ip security aaa and acl
5 ip security aaa and acl5 ip security aaa and acl
5 ip security aaa and acl
 
Chapter 1 overview
Chapter 1 overviewChapter 1 overview
Chapter 1 overview
 
Access Control List (ACL)
Access Control List (ACL)Access Control List (ACL)
Access Control List (ACL)
 
ENSA_Module_4.pptx
ENSA_Module_4.pptxENSA_Module_4.pptx
ENSA_Module_4.pptx
 
5 ip security dataplace security
5 ip security dataplace security5 ip security dataplace security
5 ip security dataplace security
 
5 ip security aaa
5 ip security aaa5 ip security aaa
5 ip security aaa
 

More from Irsandi Hasan

CCNA v6.0 ITN - Chapter 11
CCNA v6.0 ITN - Chapter 11CCNA v6.0 ITN - Chapter 11
CCNA v6.0 ITN - Chapter 11
Irsandi Hasan
 
CCNA v6.0 ITN - Chapter 10
CCNA v6.0 ITN - Chapter 10CCNA v6.0 ITN - Chapter 10
CCNA v6.0 ITN - Chapter 10
Irsandi Hasan
 
CCNA v6.0 ITN - Chapter 09
CCNA v6.0 ITN - Chapter 09CCNA v6.0 ITN - Chapter 09
CCNA v6.0 ITN - Chapter 09
Irsandi Hasan
 
CCNA v6.0 ITN - Chapter 08
CCNA v6.0 ITN - Chapter 08CCNA v6.0 ITN - Chapter 08
CCNA v6.0 ITN - Chapter 08
Irsandi Hasan
 
CCNA v6.0 ITN - Chapter 07
CCNA v6.0 ITN - Chapter 07CCNA v6.0 ITN - Chapter 07
CCNA v6.0 ITN - Chapter 07
Irsandi Hasan
 
CCNA v6.0 ITN - Chapter 06
CCNA v6.0 ITN - Chapter 06CCNA v6.0 ITN - Chapter 06
CCNA v6.0 ITN - Chapter 06
Irsandi Hasan
 
CCNA v6.0 ITN - Chapter 05
CCNA v6.0 ITN - Chapter 05CCNA v6.0 ITN - Chapter 05
CCNA v6.0 ITN - Chapter 05
Irsandi Hasan
 
CCNA v6.0 ITN - Chapter 04
CCNA v6.0 ITN - Chapter 04CCNA v6.0 ITN - Chapter 04
CCNA v6.0 ITN - Chapter 04
Irsandi Hasan
 
CCNA v6.0 ITN - Chapter 03
CCNA v6.0 ITN - Chapter 03CCNA v6.0 ITN - Chapter 03
CCNA v6.0 ITN - Chapter 03
Irsandi Hasan
 
CCNA v6.0 ITN - Chapter 02
CCNA v6.0 ITN - Chapter 02CCNA v6.0 ITN - Chapter 02
CCNA v6.0 ITN - Chapter 02
Irsandi Hasan
 
CCNA v6.0 ITN - Chapter 01
CCNA v6.0 ITN - Chapter 01CCNA v6.0 ITN - Chapter 01
CCNA v6.0 ITN - Chapter 01
Irsandi Hasan
 
VMware vShield - Overview
VMware vShield - OverviewVMware vShield - Overview
VMware vShield - Overview
Irsandi Hasan
 
CCNA RS_NB - Chapter 11
CCNA RS_NB - Chapter 11CCNA RS_NB - Chapter 11
CCNA RS_NB - Chapter 11
Irsandi Hasan
 
CCNA RS_NB - Chapter 10
CCNA RS_NB - Chapter 10CCNA RS_NB - Chapter 10
CCNA RS_NB - Chapter 10
Irsandi Hasan
 
CCNA RS_NB - Chapter 9
CCNA RS_NB - Chapter 9CCNA RS_NB - Chapter 9
CCNA RS_NB - Chapter 9
Irsandi Hasan
 
CCNA RS_NB - Chapter 8
CCNA RS_NB - Chapter 8CCNA RS_NB - Chapter 8
CCNA RS_NB - Chapter 8
Irsandi Hasan
 
CCNA RS_NB - Chapter 7
CCNA RS_NB - Chapter 7CCNA RS_NB - Chapter 7
CCNA RS_NB - Chapter 7
Irsandi Hasan
 
CCNA RS_NB - Chapter 6
CCNA RS_NB - Chapter 6CCNA RS_NB - Chapter 6
CCNA RS_NB - Chapter 6
Irsandi Hasan
 
CCNA RS_NB - Chapter 5
CCNA RS_NB - Chapter 5CCNA RS_NB - Chapter 5
CCNA RS_NB - Chapter 5
Irsandi Hasan
 
CCNA RS_NB - Chapter 4
CCNA RS_NB - Chapter 4CCNA RS_NB - Chapter 4
CCNA RS_NB - Chapter 4
Irsandi Hasan
 

More from Irsandi Hasan (20)

CCNA v6.0 ITN - Chapter 11
CCNA v6.0 ITN - Chapter 11CCNA v6.0 ITN - Chapter 11
CCNA v6.0 ITN - Chapter 11
 
CCNA v6.0 ITN - Chapter 10
CCNA v6.0 ITN - Chapter 10CCNA v6.0 ITN - Chapter 10
CCNA v6.0 ITN - Chapter 10
 
CCNA v6.0 ITN - Chapter 09
CCNA v6.0 ITN - Chapter 09CCNA v6.0 ITN - Chapter 09
CCNA v6.0 ITN - Chapter 09
 
CCNA v6.0 ITN - Chapter 08
CCNA v6.0 ITN - Chapter 08CCNA v6.0 ITN - Chapter 08
CCNA v6.0 ITN - Chapter 08
 
CCNA v6.0 ITN - Chapter 07
CCNA v6.0 ITN - Chapter 07CCNA v6.0 ITN - Chapter 07
CCNA v6.0 ITN - Chapter 07
 
CCNA v6.0 ITN - Chapter 06
CCNA v6.0 ITN - Chapter 06CCNA v6.0 ITN - Chapter 06
CCNA v6.0 ITN - Chapter 06
 
CCNA v6.0 ITN - Chapter 05
CCNA v6.0 ITN - Chapter 05CCNA v6.0 ITN - Chapter 05
CCNA v6.0 ITN - Chapter 05
 
CCNA v6.0 ITN - Chapter 04
CCNA v6.0 ITN - Chapter 04CCNA v6.0 ITN - Chapter 04
CCNA v6.0 ITN - Chapter 04
 
CCNA v6.0 ITN - Chapter 03
CCNA v6.0 ITN - Chapter 03CCNA v6.0 ITN - Chapter 03
CCNA v6.0 ITN - Chapter 03
 
CCNA v6.0 ITN - Chapter 02
CCNA v6.0 ITN - Chapter 02CCNA v6.0 ITN - Chapter 02
CCNA v6.0 ITN - Chapter 02
 
CCNA v6.0 ITN - Chapter 01
CCNA v6.0 ITN - Chapter 01CCNA v6.0 ITN - Chapter 01
CCNA v6.0 ITN - Chapter 01
 
VMware vShield - Overview
VMware vShield - OverviewVMware vShield - Overview
VMware vShield - Overview
 
CCNA RS_NB - Chapter 11
CCNA RS_NB - Chapter 11CCNA RS_NB - Chapter 11
CCNA RS_NB - Chapter 11
 
CCNA RS_NB - Chapter 10
CCNA RS_NB - Chapter 10CCNA RS_NB - Chapter 10
CCNA RS_NB - Chapter 10
 
CCNA RS_NB - Chapter 9
CCNA RS_NB - Chapter 9CCNA RS_NB - Chapter 9
CCNA RS_NB - Chapter 9
 
CCNA RS_NB - Chapter 8
CCNA RS_NB - Chapter 8CCNA RS_NB - Chapter 8
CCNA RS_NB - Chapter 8
 
CCNA RS_NB - Chapter 7
CCNA RS_NB - Chapter 7CCNA RS_NB - Chapter 7
CCNA RS_NB - Chapter 7
 
CCNA RS_NB - Chapter 6
CCNA RS_NB - Chapter 6CCNA RS_NB - Chapter 6
CCNA RS_NB - Chapter 6
 
CCNA RS_NB - Chapter 5
CCNA RS_NB - Chapter 5CCNA RS_NB - Chapter 5
CCNA RS_NB - Chapter 5
 
CCNA RS_NB - Chapter 4
CCNA RS_NB - Chapter 4CCNA RS_NB - Chapter 4
CCNA RS_NB - Chapter 4
 

CCNA Discovery 3 - Chapter 8

  • 1. Filtering Traffic Using Access Control Lists Introducing Routing and Switching in the Enterprise – Chapter 8 Version 4.0 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1
  • 2. Objectives  Describe traffic filtering and explain how Access Control Lists (ACLs) can filter traffic at router interfaces.  Analyze the use of wildcard masks.  Configure and implement ACLs.  Create and apply ACLs to control specific types of traffic.  Log ACL activity and integrate ACL best practices. © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 2
  • 3. Describe Traffic Filtering  Analyze the contents of a packet  Allow or block the packet  Based on source IP, destination IP, MAC address, protocol, application type © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 3
  • 4. Describe Traffic Filtering Devices providing traffic filtering:  Firewalls built into integrated routers  Dedicated security appliances  Servers © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 4
  • 5. Describe Traffic Filtering Uses for ACLs:  Specify internal hosts for NAT  Classify traffic for QoS  Restrict routing updates, limit debug outputs, control virtual terminal access © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 5
  • 6. Describe Traffic Filtering Possible issues with ACLs:  Increased load on router  Possible network disruption  Unintended consequences from incorrect placement © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 6
  • 7. Describe Traffic Filtering  Standard ACLs filter based on source IP address  Extended ACLs filter on source and destination, as well as protocol and port number  Named ACLs can be either standard or extended © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 7
  • 8. Describe Traffic Filtering  ACLs consist of statements  At least one statement must be a permit statement  Final statement is an implicit deny  ACL must be applied to an interface in order to work © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 8
  • 9. Describe Traffic Filtering  ACL is applied inbound or outbound  Direction is from the router’s perspective  Each interface can have one ACL per direction for each network protocol © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 9
  • 10. Analyze the Use of Wildcard Masks  Wildcard mask can block a range of addresses or a whole network with one statement  0s indicate which part of an IP address must match the ACL  1s indicate which part does not have to match specifically © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 10
  • 11. Analyze the Use of Wildcard Masks  Use the host parameter in place of a 0.0.0.0 wildcard  Use the any parameter in place of a 255.255.255.255 wildcard © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 11
  • 12. Configure and Implement Access Control Lists  Determine traffic filtering requirements  Decide which type of ACL to use  Determine the router and interface on which to apply the ACL  Determine in which direction to filter traffic © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 12
  • 13. Configure and Implement Access Control Lists: Numbered Standard ACL  Use access-list command to enter statements  Use the same number for all statements  Number ranges: 1-99, 1300-1999  Apply as close to the destination as possible © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 13
  • 14. Configure and Implement Access Control Lists: Numbered Extended ACL  Use access-list command to enter statements  Use the same number for all statements  Number ranges: 100-199, 2000-2699  Specify a protocol to permit or deny  Place as close to the source as possible © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 14
  • 15. Configure and Implement Access Control Lists: Named ACLs  Descriptive name replaces number range  Use ip access-list command to enter initial statement  Start succeeding statements with either permit or deny  Apply in the same way as standard or extended ACL © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 15
  • 16. Configure and Implement Access Control Lists: VTY access  Create the ACL in line configuration mode  Use the access-class command to initiate the ACL  Use a numbered ACL  Apply identical restrictions to all VTY lines © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 16
  • 17. Create and Apply ACLs to Control Specific Types of Traffic  Use a specified condition when filtering on port numbers: eq, lt, gt  Deny all appropriate ports for multi-port applications like FTP  Use the range operator to filter a group of ports © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 17
  • 18. Create and Apply ACLs to Control Specific Types of Traffic  Block harmful external traffic while allowing internal users free access  Ping: allow echo replies while denying echo requests from outside the network  Stateful Packet Inspection © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 18
  • 19. Create and Apply ACLs to Control Specific Types of Traffic  Account for NAT when creating and applying ACLs to a NAT interface  Filter public addresses on a NAT outside interface  Filter private addresses on a NAT inside interface © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 19
  • 20. Create and Apply ACLs to Control Specific Types of Traffic  Examine every ACL one line at a time to avoid unintended consequences © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 20
  • 21. Create and Apply ACLs to Control Specific Types of Traffic  Apply ACLs to VLAN interfaces or subinterfaces just as with physical interfaces © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 21
  • 22. Log ACL Activity and ACL Best Practices  Logging provides additional details on packets denied or permitted  Add the log option to the end of each ACL statement to be tracked © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 22
  • 23. Log ACL Activity and ACL Best Practices Syslog messages:  Status of router interfaces  ACL messages  Bandwidth, protocols in use, configuration events © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 23
  • 24. Log ACL Activity and ACL Best Practices  Always test basic connectivity before applying ACLs  Add deny ip any to the end of an ACL when logging  Use reload in 30 when testing ACLs on remote routers © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 24
  • 25. Summary  ACLs enable traffic management and secure access to and from a network and its resources  Apply an ACL to filter inbound or outbound traffic  ACLs can be standard, extended, or named  Using a wildcard mask provides flexibility  There is an implicit deny statement at the end of an ACL  Account for NAT when creating and applying ACLs  Logging provides additional details on filtered traffic © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 25
  • 26. © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 26