As with any skill, repetition makes mastery. As I’ve said before, you must type on a router every example I give, do as many labs as possible, and then make up your own examples. You need to be fast and you need to be accurate, both in the exam and in the real world.
The standard and extended ACLs presented in the next sections are numbered ACLs. These represent the classic way of configuring ACLs. Named ACLs are the other way of configuring ACLs and they are presented in a subsequent section.
Standard ACLs
Standard numbered ACLs are the easiest to configure, so this is the best place to start. Standard ACLs can only filter based on a source network or IP address.
Figure 9.5 – Incoming Packet with Source and Destination
In Figure 9.5 above, the incoming packet has a source and destination address, but your standard ACL will only look at the source address. Your ACL would permit or deny this source address (see Figure 9.6):
Router(config)#access-list 1 permit host 172.16.1.1
Figure 9.6 – Network with Multiple Hosts/Networks
Router(config)#access-list 1 permit host 172.16.1.1
Router(config)#access-list 1 permit host 192.168.1.1
Router(config)#access-list 1 permit 10.1.0.0 0.0.255.255
This would be applied to the server side router. Remember that there will be an implicit “deny all” at the end of this list, so all other traffic will be blocked.
Extended ACLs
Far more granularity is built into extended numbered ACLs; however, this makes them trickier to configure. You can filter source or destination networks, ports, protocols, and services.
Generally, you can look at the configuration syntax for extended ACLs, as follows:
access list# permit/deny [service/protocol] [source network/IP] [destination network/IP] [port#]
For example:
access-list 101 deny tcp 10.1.0.0 0.0.255.255 host 172.30.1.1 eq telnet
access-list 100 permit tcp 10.1.0.0 0.0.255.255 host 172.30.1.1 eq ftp
access-list 100 permit icmp any any
Figure 9.7 – Blocking Server Access Example
An ACL you could configure for the network above, featuring e-mail, web, and file servers, would be as follows (applied on the server side):
access-list 100 permit tcp host 172.16.1.1 host 172.20.1.1 eq smtp
access-list 100 permit tcp 10.1.0.0 0.0.255.255 host 172.30.1.1 eq ftp
access-list 100 permit tcp host 192.168.1.1 host 172.40.1.1 eq www
Or, it could be the next ACL, if you had different requirements:
access-list 101 deny icmp any 172.20.0.0 0.0.255.255
access-list 101 deny tcp 10.1.0.0 0.0.255.255 host 172.30.1.1 eq telnet
Or, it could be as follows:
access-list 102 permit tcp any host 172.30.1.1 eq ftp established
The [established] keyword tells the router to permit the traffic only if it was originated by hosts on the inside. The three-way handshake flags (ACK or RST bit) will indicate this.
Named ACLs
Unlike numbered ACLs, named ACLs can be easily identified based on their descriptive name, and this is useful especially in large configurations. They were introduced to add flexibility and ease of management of ACLs. Named ACLs can be considered more of a configuration enhancement, as it does not modify the core ACL structure (it just modifies the way we refer to an ACL).
The syntax is similar to the numbered ACLs, with the major difference of using names instead of numbers to identify ACLs. Just like in the case of numbered ACLs, you can configure standard or extended named ACLs.
Another difference when configuring named ACLs is that you always have to use the ip access-list command, unlike with numbered ACLs, where you could also use the simple access-list command.
Router(config)#access-list ?
<1-99> IP standard access list
<100-199> IP extended access list
<1100-1199> Extended 48-bit MAC address access list
<1300-1999> IP standard access list (expanded range)
<200-299> Protocol type-code access list
<2000-2699> IP extended access list (expanded range)
<700-799> 48-bit MAC address access list
dynamic-extended Extend the dynamic ACL absolute timer
rate-limit Simple rate-limit specific access list
Router(config)#ip access-list ?
extended Extended access list
log-update Control access list log updates
logging Control access list logging
resequence Resequence access list
standard Standard access list
R1(config)#ip access-list standard ?
<1-99> Standard IP access-list number
<1300-1999> Standard IP access-list number (expanded range)
WORD Access-list name
R1(config)#ip access-list extended ?
<100-199> Extended IP access-list number
<2000-2699> Extended IP access-list number (expanded range)
WORD Access-list name
Named ACLs have a slightly different syntax than the other types of ACLs do (standard numbered and extended numbered). You can also edit live named ACLs, which is a useful feature. You simply need to tell the router that you want to configure a named ACL, and whether you want it to be standard or extended. You can also edit numbered ACLs with later IOS releases, so please check the documentation for your platform.
When creating a named ACL using the ip access-list command, Cisco IOS will place you in the ACL configuration mode where you can enter or remove ACL entries (denied or permitted access conditions). Figure 9.8 below shows an example of a named ACL, followed by the corresponding output:
Figure 9.8 – Named ACL
Router(config)#ip access-list extended BlockWEB
Router(config-ext-nacl)#?
Ext Access List configuration commands:
<1-2147483647> Sequence Number
default Set a command to its defaults
deny Specify packets to reject
dynamic Specify a DYNAMIC list of PERMITs or DENYs
evaluate Evaluate an access list
exit Exit from access-list configuration mode
no Negate a command or set its defaults
permit Specify packets to forward
remark Access list entry comment
Router(config-ext-nacl)#deny tcp any any eq 80
Router(config-ext-nacl)#permit ip any any
Named ACL verification can be done using the following commands:
- show ip access-lists: shows all ACLs created on the device.
- show ip access-lists <acl_name>: shows a particular named ACL
Router(config)#do show ip access-lists
Standard IP access list test
30 permit 10.1.1.1
20 permit 192.168.1.1
15 permit 172.20.1.1
10 permit 172.16.1.1
To learn how you can add or delete ACL entries in a named ACL, please refer to the “ACL Sequence Numbers” section below.
Applying ACLs
In order to come into effect, you must apply your ACL to an interface or router port. I say this because I’ve seen many novice Cisco engineers type the ACL and then wonder why it isn’t working! Or they configure it but apply the wrong ACL number or name to the interface.
If you are applying an ACL to a line, you have to specify it with the access-class command, and to an interface, it is the ip access-group command. Why Cisco have you do this, I will never know!
Here are three examples of ACLs being applied to a port or interface.
Interface:
Router(config)#int FastEthernet0/0
Router(config-if)#ip access-group 101 in
Line:
Router(config)#line vty 0 15
Router(config-line)#access-class 101 in
Interface:
Router(config)#int FastEthernet0/0
Router(config-if)#ip access-group BlockWEB in