Scribd Logo
Upload

Welcome to Scribd!

  • 67 views

    CCNA 200-301 Official Cert Guide, Volume 2-24

    Uploaded by

    Arif Hasan

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    CCNA 200-301 Official Cert Guide, Volume 2-24

    Uploaded by

    Arif Hasan
    67 views3 pages

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    67 views3 pages

    CCNA 200-301 Official Cert Guide, Volume 2-24

    Uploaded by

    Arif Hasan

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    You are on page 1of 3

    CHAPTER 2

    Basic IPv4 Access Control Lists


    This chapter covers the following exam topics:
    5.0 Security Fundamentals
    5.6 Configure and verify access control lists

    IPv4 access control lists (ACL) give network engineers the ability to program a filter into a
    router. Each router, on each interface, for both the inbound and outbound direction, can
    enable a different ACL with different rules. Each ACL’s rules tell the router which packets
    to discard and which to allow through.
    This chapter discusses the basics of IPv4 ACLs, and in particular, one type of IP ACL: stan-
    dard numbered IP ACLs. Standard numbered ACLs use simple logic, matching on the source
    IP address field only, and use a configuration style that references the ACL using a number.
    This chapter sets out to help you learn this simpler type of ACL first. The next chapter,
    titled, “Advanced IPv4 Access Control Lists,” completes the discussion by describing other
    types of IP ACLs. The other types of ACLs use features that build on the concepts you
    learn in this chapter, but with more complexity and additional configuration options.

    “Do I Know This Already?” Quiz


    Take the quiz (either here or use the PTP software) if you want to use the score to help you
    decide how much time to spend on this chapter. The letter answers are listed at the bottom
    of the page following the quiz. Appendix C, found both at the end of the book as well as
    on the companion website, includes both the answers and explanations. You can also find
    both answers and explanations in the PTP testing software.

    Table 2-1 “Do I Know This Already?” Foundation Topics Section-to-Question Mapping
    Foundation Topics Section Questions
    IP Access Control List Basics 1
    Standard Numbered IPv4 ACLs 2–5
    Practice Applying Standard IP ACLs 6

    1. Barney is a host with IP address 10.1.1.1 in subnet 10.1.1.0/24. Which of the fol-
    lowing are things that a standard IP ACL could be configured to do? (Choose two
    answers.)
    a. Match the exact source IP address.
    b. Match IP addresses 10.1.1.1 through 10.1.1.4 with one access-list command
    without matching other IP addresses.
    c. Match all IP addresses in Barney’s subnet with one access-list command without
    matching other IP addresses.
    d. Match only the packet’s destination IP address.
    2. Which of the following answers list a valid number that can be used with standard
    numbered IP ACLs? (Choose two answers.)
    a. 1987
    b. 2187
    c. 187
    d. 87
    3. Which of the following wildcard masks is most useful for matching all IP packets in
    subnet 10.1.128.0, mask 255.255.255.0?
    a. 0.0.0.0
    b. 0.0.0.31
    c. 0.0.0.240
    d. 0.0.0.255
    e. 0.0.15.0
    f. 0.0.248.255
    4. Which of the following wildcard masks is most useful for matching all IP packets in
    subnet 10.1.128.0, mask 255.255.240.0?
    a. 0.0.0.0
    b. 0.0.0.31
    c. 0.0.0.240
    d. 0.0.0.255
    e. 0.0.15.255
    f. 0.0.248.255
    5. ACL 1 has three statements, in the following order, with address and wildcard mask
    values as follows: 1.0.0.0 0.255.255.255, 1.1.0.0 0.0.255.255, and 1.1.1.0 0.0.0.255.
    If a router tried to match a packet sourced from IP address 1.1.1.1 using this ACL,
    which ACL statement does a router consider the packet to have matched?
    a. First
    b. Second
    c. Third
    d. Implied deny at the end of the ACL
    6. Which of the following access-list commands matches all packets sent from hosts in
    subnet 172.16.4.0/23?
    a. access-list 1 permit 172.16.0.5 0.0.255.0
    b. access-list 1 permit 172.16.4.0 0.0.1.255
    c. access-list 1 permit 172.16.5.0
    d. access-list 1 permit 172.16.5.0 0.0.0.127
    26 CCNA 200-301 Official Cert Guide, Volume 2

    Foundation Topics
    IPv4 Access Control List Basics
    IPv4 access control lists (IP ACL) give network engineers a way to identify different types
    of packets. To do so, the ACL configuration lists values that the router can see in the IP,
    TCP, UDP, and other headers. For example, an ACL can match packets whose source
    IP address is 1.1.1.1, or packets whose destination IP address is some address in subnet
    10.1.1.0/24, or packets with a destination port of TCP port 23 (Telnet).
    IPv4 ACLs perform many functions in Cisco routers, with the most common use as a packet
    filter. Engineers can enable ACLs on a router so that the ACL sits in the forwarding path of
    packets as they pass through the router. After it is enabled, the router considers whether
    each IP packet will either be discarded or allowed to continue as if the ACL did not exist.
    However, ACLs can be used for many other IOS features as well. As an example, ACLs can
    be used to match packets for applying Quality of Service (QoS) features. QoS allows a rout-
    er to give some packets better service, and other packets worse service. For example, pack-
    ets that hold digitized voice need to have very low delay, so ACLs can match voice packets,
    with QoS logic in turn forwarding voice packets more quickly than data packets.
    This first section introduces IP ACLs as used for packet filtering, focusing on these aspects
    of ACLs: the locations and direction in which to enable ACLs, matching packets by examin-
    ing headers, and taking action after a packet has been matched.

    ACL Location and Direction


    Cisco routers can apply ACL logic to packets at the point at which the IP packets enter an
    interface, or the point at which they exit an interface. In other words, the ACL becomes
    associated with an interface and for a direction of packet flow (either in or out). That is, the
    ACL can be applied inbound to the router, before the router makes its forwarding (routing)
    decision, or outbound, after the router makes its forwarding decision and has determined
    the exit interface to use.
    The arrows in Figure 2-1 show the locations at which you could filter packets flowing left
    to right in the topology. For example, imagine that you wanted to allow packets sent by
    host A to server S1, but to discard packets sent by host B to server S1. Each arrowed line
    represents a location and direction at which a router could apply an ACL, filtering the pack-
    ets sent by host B.
    The four arrowed lines in the figure point out the location and direction for the router
    interfaces used to forward the packet from host B to server S1. In this particular example,
    those interfaces and direction are inbound on R1’s F0/0 interface, outbound on R1’s S0/0/0
    interface, inbound on R2’s S0/0/1 interface, and outbound on R2’s F0/0 interface. If, for
    example, you enabled an ACL on R2’s F0/1 interface, in either direction, that ACL could
    not possibly filter the packet sent from host B to server S1, because R2’s F0/1 interface is
    not part of the route from B to S1.

    Answers to the “Do I Know This Already?” quiz:


    1 A, C 2 A, D 3 D 4 E 5 A 6 B

    You might also like