An access control list (ACL), with respect to a computer file system, is a list of permissions attached to an object. An ACL specifies which users or system processes are granted access to objects, as well as what operations are allowed on given objects or you can say for each rule we have two conditions and that is Permit or Deny.
Types of Access Lists
There are two categories of access
lists: numbered and named.
Numbered Access Lists:-
Numbered access lists are broken down
into several ranges, each dedicated
to a specific protocol:
1–99 IP standard access list
100-199 IP extended access list
200-299 Protocol type-code access
list
300-399 DECnet access list
400-499 XNS standard access list
500-599 XNS extended access list
600-699 Appletalk access list
700-799 48-bit MAC address access
list
800-899 IPX standard access list
900-999 IPX extended access list
1000-1099 IPX SAP access list
1100-1199 Extended 48-bit MAC address
access list
1200-1299 IPX summary address access
list
1300-1999 IP standard access list
(expanded range)
2000-2699 IP extended access
list
Named Access Lists:-
Named access lists provide a bit more
flexibility. Descriptive names can be
used to identify your access-lists.
Additionally, individual lines can be
removed from a named access-list.
However, like numbered lists, all new
entries are still added to the bottom
of the access list.
There are two common types of named
access lists:
• IP standard named access lists
• IP extended named access lists
Standard IP Access List
access-list [1-99] [permit | deny] [source address] [wildcard
mask] [log]
Standard IP access-lists are based
upon the source host or network IP address, and should be placed closest to the
destination network.
Router(config)# access-list 10 deny
172.18.0.0 0.0.255.255 ( Just for an Example)
Router(config)# access-list 10 permit any
To apply Access Lists we have to
configure the Access-Group on the Interface. Like wise we are taking the
interface serial 0 as a refrence.
Router(config)# int s0
Router(config-if)# ip access-group 10
in
To view all IP access lists
configured on the router:
Router# show ip access-list
To view what interface an access-list
is configured on:
Router# show ip interface
Router# show running-config
Extended IP Access List
access-list [100-199] [permit | deny] [protocol] [source
address] [wildcard
mask] [destination address] [wildcard
mask] [operator [port]] [log]
Router(config)# access-list
101 permit tcp 172.18.0.0 0.0.255.255 host 172.16.10.10 eq 80
Router(config)# access-list 101 deny
ip 172.18.0.0 0.0.255.255 172.16.0.0 0.0.255.255
Router(config)# access-list 101 permit
ip any any
*The above ip address
is just taken for the example and dont have real environment
existance.
The first line allows the 172.18.x.x
network access only to port 80 on the web server. The second line blocks
172.18.x.x from accessing anything else on the 172.16.x.x network. The third
line allows 172.18.x.x access to anything else.
To apply this access list, we would
configure the following
Router(config)# int e0
Router(config-if)# ip access-group 101
in
Extended IP Access List Port Operators
ICMP Access List
The specific ICMP port that a “ping” uses is echo. To block specific ICMP parameters, use an extended IP access list. On Router B, we would configure:
Router(config)# access-list 102 deny icmp 172.18.0.0 0.0.255.255 172.16.0.0 0.0.255.255 echo
Router(config)# access-list 102 permit icmp 172.18.0.0 0.0.255.255 172.16.0.0 0.0.255.255
Router(config)# access-list 102 permit ip any any
The first line blocks only ICMP echo requests (pings). The second line allows all other ICMP traffic. The third line allows all other IP traffic.
Named Access-Lists will be cover in the Next Session.
Visit Official Facebook Page:- https://www.facebook.com/Networksbaseline
Discussion Group:- https://www.facebook.com/groups/networksbaseline/
Follow me on facebook : https://www.facebook.com/cisco.core
In the preceding example, we
identified TCP port 80 on a specific host use the following syntax:
Router(config)# access-list 101 permit
tcp 172.18.0.0 0.0.255.255 host 172.16.10.10 eq 80
We accomplished this using an operator
of eq, which is short for equals. Thus, we are identifying host 172.16.10.10
with a port that equals 80. We can use several other operators for port
numbers:
- eq Matches a specific port
- gt Matches all ports greater than the port specified
- lt Matches all ports less than the port specified
- neq Matches all ports except for the port specified
- range Match a specific inclusive range of ports
ICMP Access List
The specific ICMP port that a “ping” uses is echo. To block specific ICMP parameters, use an extended IP access list. On Router B, we would configure:
Router(config)# access-list 102 deny icmp 172.18.0.0 0.0.255.255 172.16.0.0 0.0.255.255 echo
Router(config)# access-list 102 permit icmp 172.18.0.0 0.0.255.255 172.16.0.0 0.0.255.255
Router(config)# access-list 102 permit ip any any
The first line blocks only ICMP echo requests (pings). The second line allows all other ICMP traffic. The third line allows all other IP traffic.
To apply the access lists on other router, you need to configure the
follwing as:-
Router(config)# int e0
Router(config-if)# ip access-group 102 in
Router(config-if)# ip access-group 102 in
Named Access-Lists will be cover in the Next Session.
Visit Official Facebook Page:- https://www.facebook.com/Networksbaseline
Discussion Group:- https://www.facebook.com/groups/networksbaseline/
Follow me on facebook : https://www.facebook.com/cisco.core
