CCNA2_M11_Access_Control_Lists (1130746)
Текст из файла
CCNA – Semester2Module 11Access Control ListsObjectives• Standard and extended ACLs• The rules for placement of ACLs• Create and apply named ACLsAccess Control ListFundamentalsWhat are ACLs• ACLs are lists of conditions that are applied to traffictraveling across a router's interface.• These lists tell the router what types of packets to acceptor deny.• Acceptance and denial can be based on specifiedconditions.ACLReasons to create ACLs• Limit network traffic and increase networkperformance.• Provide traffic flow control.• Provide a basic level of security for networkaccess.• Decide which types of traffic are forwarded orblocked at the router interfaces.Testing packets with ACLs• The order in which youplace ACL statements isimportant.• A packet is checked againsteach condition statement,in the order in which thestatements were created.• After a match is found, nomore condition statementsare checked.• If all the ACL statements areunmatched, an implicit"deny any" statement isimposed.Configuration task list• ACL are classified as: numbered of named ACL,each has 2 types: standard and extended.• Configuration task includes 2 steps:– Create an ACL– Apply ACL to interfaceAssigning ACL number• ACL number must be within the specific rangespecified for the protocol.• Modification of a numbered ACL involves deleting theentire list and creating a new one• Remove numbered ACL:no access-list list-numberApply Access Lists• An ACL can be assigned to one or more interfaces andcan filter inbound or outbound traffic.• ACLs must be defined on a per-protocol, per direction,or per interface basis.• Eg: Only 1 IP access list on interface s0 inbounddirectionTypes of Access Control ListsStandard ACL Overview• When you want to:– block all traffic from a network,– allow all traffic from a network,– permit or deny an entire protocol suite.• Standard ACLs check the source address ofpackets that could be routed.• Results in either permit or deny of an entireprotocol suite, based on the network, subnet,and host addresses.Standard ACL commandsRouter (config)#access-listaccess-list access-list-numberaccess-list-number{deny{deny || permit}permit} sourcesource [source-wildcard][source-wildcard] [log][log]Router (config-if)#ipip access-groupaccess-group access-list-numberaccess-list-number {{ inin || outout }}• Access list number: 1 Æ 99 or 1300 Æ 1999 inrecent IOSWildcard mask bits• A wildcard mask is a 32-bit quantity that is divided intofour octets, with each octet containing 8 bits.• A wildcard mask bit 0 means "check the correspondingbit value“.• A wildcard mask bit 1 means "do not check (ignore) thatcorresponding bit value".Wildcard & Subnet mask• Wildcard mask operate differently from IPsubnet mask.– Subnet mask: The zeros and ones determine the network(or subnet) and host portions of the corresponding IPaddress.– Wildcard mask: The zeros and ones determine whetherthe corresponding bits in an IP address should bechecked or ignored for ACL purposes.Wildcard anyWildcard hostExamples: any, host• Router(config)# access-list 1 permit 0.0.0.0255.255.255.255• Router(config)# access-list 1 permit any• Router(config)# access-list 1 permit172.30.16.29 0.0.0.0• Router(config)# access-list 1 permit host172.30.16.29Verifying ACLs• show ip interface command displays IP interfaceinformation and indicates whether any ACLs areset.• show access-lists command displays thecontents of all ACLs on the router.• show running-config command will also reveal theaccess lists on a router and the interfaceassignment information.Show ip interfaceShow access-listsStandard ACL examplesACL Requirement1.
Do not allow traffic between outside andnetwork 172.16.3.02. - Node 172.16.4.13 can only access Internet- Network 172.16.4.0 (accept 172.16.4.13) cannot access InternetExtended ACL Overview• Provide a greater range of control than standardACLs including:–––––Protocols (IP, IPX, ICMP, TCP…)Source address (IP address, IPX address…)Destination addressServices or ports (Telnet, HTTP, FTP …)Other parameters (SYN, ACK, Echo…)Extended ACL commandsRouter (config)#access-listaccess-list ACL-numberACL-number {permit{permit || deny}deny}protocolprotocol sourcesource [source-mask[source-mask operatoroperator extended-para]extended-para]destinationdestination [destination-mask[destination-mask operatoroperator extended-para]extended-para][log[log || loglog input]input]Router (config-if)#ipip access-groupaccess-group access-list-numberaccess-list-number {{ inin || outout }}•Access list number: 100 Æ 199 or 2000 Æ 2699 in recent IOSExtended ACL parametersParametersDescriptionaccess-listDefines an access listaccess-list-numberProtocol-dependent ACL number (100-199)permit/denyDefines a statement to allow/block trafficprotocolThe protocol in question, including: IP, TCP, UDP, ICMP, GRE, ICMPsource/destinationSource/destination addresssource-mask/destination-maskWildcard mask: zeros Æ must match bit; ones Æ do not match bitoperatorLogical operator:•lt: less than•gt: greater than•eq: equal to•neq: not equal toextended-paraExtended parameter of the protocols used, eg : port (for TCP/UDP),echo (for ICMP)log [log input]Records all ACL matches including violationsin|outapplies this access list to inbound or outbound trafficExtended ACL: TCP/UDP protocolRouter (config)#access-listaccess-list access-list-numberaccess-list-number {permit{permit || deny}deny}[tcp[tcp || udp]udp] sourcesource [s-mask[s-mask operatoroperator s-port]s-port]destinationdestination [d-mask[d-mask operatoroperator d-port]d-port] [established][established][log[log || loglog input]input]established: only match if ACK bit is setRouter (config-if)#ipip access-groupaccess-group access-list-numberaccess-list-number {{ inin || outout }}Reserved port numbersExtended ACL: ICMP protocolRouter (config)#access-listaccess-list access-list-numberaccess-list-number {permit{permit || deny}deny}icmpicmp sourcesource [source-mask[source-mask destinationdestinationdestination-mask]destination-mask] [icmp-type[icmp-type || [[icmp-type[[icmp-type icmpicmpcode]code] || [icmp-message]][icmp-message]] [log[log || loglog input]input]Router (config-if)#ipip access-groupaccess-group access-list-numberaccess-list-number {{ inin || outout }}Extended ACL: ICMP parametersParametersDescriptionIcmp type(Optional) A number from between 0 and 255specifying the ICMP message typeIcmp code(Optional) ICMP packets that are filtered by ICMPmessage type can also be filtered by the ICMPmessage code.
The code is a number from 0 to255.icmp-message(Optional) ICMP packets can be filtered by anICMP message type name or ICMP message typeand code name.Named ACL Overview• Uses a name string to identify standard andextended IP ACLs instead of the numeric (1 to199) representation.• Considerations:– Named ACLs are not compatible with Cisco IOS releasesprior to Release 11.2.– You cannot use the same name for multiple ACLs.Named ACLs vs. Numbered ACLs• Named ACLs have individual configurationmode with shorter and clearer command line.• Named ACLs can be used to remove individualentries from a specific ACL.• Using name is more understandable than usingnumber• Eliminate the limit of 798 simple and 799extended ACLsNamed ACL commands• Router(config)# ip access-list {standard |extended} name• Router(config {std- | ext-}nacl)# deny{source [source-wildcard] | any}• Router(config {std- | ext-}nacl)# permit{source [source-wildcard] | any}.• Router(config-if)# ip access-group name {in |out}• Router# show access-listsNamed ACL exampleInbound and Outbound• If the ACL is inbound, when the router receivesa packet and prior to the routing process, routerchecks the ACL's statements for a match.• If the ACL is outbound, after receiving androuting a packet to the outbound interface,router checks the ACL's statements for a match.Recommended Rule• Place extended ACLs as close to the source ofthe traffic denied as possible.• Place the standard ACL as close to thedestination as possible.• Place ACLs on the inbound interfaces may helpto reduce routing processing tasks.• Place ACLs on the outbound interfaces mayavoid filterring unnessecary traffic.Firewall architectureControl VTY access with Access list••Instead of applying ACL on all router interfaces to filter telnetsessions to router interfaces, use ACL on vty lines.Access into and out of virtual terminal line ports can be controlledby IP numbered ACLs.line vty 0 4loginpassword ciscoaccess-class access-list-number {in|out}•Interface access lists are applied only to traffics passing the router,not to traffics originated from the router.VTY Control ExampleExtended ACL examplesRA172.16.3.100Access List Requirements1.2.3.4.Prevents telnet and ftp access from Internet to 172.16.3.100 and172.16.4.13Prevents all hosts except 172.16.4.13 on network 172.16.4.0 toaccess server 65.10.13.133Prevents all hosts, except 172.16.3.100, on network 172.16.3.0 toaccess 172.16.4.13 using web and tftpAllow all hosts on local network as well as Internet to accesscompany’s web site on server 172.16.4.13.
Block all other types ofaccess to this server.ACL Challenge•Outer-network can’t ping into innernetworkInternet•Do not allow outer-network to accessinner-network except web service inWeb Server(.66).E0R_1S0•Traffic between Net1 and Net3 is notallowedS1Net3•Other networks can only access web.96service in Web ServerS1R_2•Packets between PC1(.48) and PC3(.80) are only allowed if routed acrossthe direct serial link•Telnet to routers only from PC1•All other kind of traffic is allowed192.169.10.0/24S0S0R_3E0E1E0PC1Net1.32PC2S1PC3Net2.64WebSummary•••••••ACL definitionHow ACL worksWild-card maskStandard numbered ACL configurationExtended numbered ACL configurationNamed numbered ACL configurationPlacing ACLsCCNA2 – Module11.
Характеристики
Тип файла PDF
PDF-формат наиболее широко используется для просмотра любого типа файлов на любом устройстве. В него можно сохранить документ, таблицы, презентацию, текст, чертежи, вычисления, графики и всё остальное, что можно показать на экране любого устройства. Именно его лучше всего использовать для печати.
Например, если Вам нужно распечатать чертёж из автокада, Вы сохраните чертёж на флешку, но будет ли автокад в пункте печати? А если будет, то нужная версия с нужными библиотеками? Именно для этого и нужен формат PDF - в нём точно будет показано верно вне зависимости от того, в какой программе создали PDF-файл и есть ли нужная программа для его просмотра.
![](https://s.studizba.com/z.php?f=/templates/si/i/noavatar.png&w=100&h=100&t=1"){kind=avatar}
