Access Lists

Question 1

Access Lists
Goals:
Standard Access Lists tasks
Modus Operandi:

Answer 1

Goals:
§ Control inbound and outbound traffic
§ At the IP level (Layer 3)
§ At the transport level (Layer 4)
§ Standard Access Lists tasks
§ Limit network traffic
§ Provide traffic flow control
§ Filter traffic based on traffic type
§ Screen hosts to permit or block traffic
§ Provide a basic level of security

Modus Operandi:
§ Define legitimate & blocked traffic based on:
§ Source & destination IPs
§ Source & destination Ports
§ Transport protocols

Question 2

Standard Access Lists Command

Answer 2

Syntax: Router(config)# access-list access-listnumber { deny | permit | remark } source [ source-wildcard ][ log ]

listnumber : 1 to 99, 1300 to 1999

source-wildcard = masque, log : send a log message to the console when a packet matches the entry

remark : add a remark (commentaire), make the list easier to understand and scan

on peut permit any

Question 3

Named Standard Access Lists

Answer 3

Instead of using “numbers”, ACLs can also be named to improve readability

(config) ip access-list { standard | extended } name

(config-std-nacl)# { permit | deny | remark } {source [source-wildcard]} [log]

(config-if)# ip access-group name { in | out }

Question 4

Extended Access Lists

IP based ACL

Answer 4

access-list access-list-number [dynamic dynamic-name [timeout minutes]] {deny |
permit} protocol source source-wildcard destination destination-wildcard
[precedence precedence] [tos tos] [log | log-input]
[time-range time-range-name][fragments]

Question 5

Extended Access Lists

Internet Control Message Protocol (ICMP) based ACL

Answer 5

access-list access-list-number [dynamic dynamic-name [timeout minutes]] {deny |
permit} icmp source source-wildcard destination destination-wildcard
[[icmp-type] [icmp-code] | [icmp-message]] [precedence precedence] [tos tos] [log |
log-input]
[time-range time-range-name][fragments]

Question 6

Extended Access Lists

Transport Control Protocol (TCP) based ACL

Answer 6

access-list access-list-number [dynamic dynamic-name [timeout minutes]] {deny |
permit} tcp source source-wildcard [operator [port]] destination destination-wildcard
[operator [port]]
[established] [precedence precedence] [tos tos] [log | log-input]
[time-range time-range-name][fragments]

Question 7

User Datagram Protocol (UDP) based ACL

Answer 7

access-list access-list-number [dynamic dynamic-name [timeout minutes]] {deny |
permit} udp source source-wildcard [operator [port]] destination destinationwildcard [operator [port]]
[precedence precedence] [tos tos] [log | log-input] [time-range time-rangename][fragments]