Welcome back.
My name is David Bumble s.c.i eleven thousand twenty three.
And in this section we're going to look at X-ists lists.
I'd like to show you how to implement security using Access Control lists which are one of the most
basic building blocks for implementing security in the Cisco network.
These days there are multiple ways to implement security but access lists are one of the most fundamental
and a lot of the new technologies are based on them.
So it's important that you have a good understanding of how access lists work and how to implement them.
So we can look at the purpose of access control lists.
I'd like to show you how they are bound to interfaces.
They're either bound inbound or outbound.
I'd like to show you various tops of access lists including numbered X-ists lists named X-ists lists
as well as stand in an extended access control lists or ACLC.
I'd like to explain what a wild card mosque does and how you can match individual hosts subnets all
hosts by changing the wildcard mosque.
I'd also like to explain htan based reflexive and dynamic ACLC Now before getting into a discussion
of access control lists or ACLC.
Let's review some of the information covered in ice in D1 course.
You will not be able to implement ACL without a good understanding of protocols.
Port numbers and other options are available in the TCAP Ah-Q protocol stack and other protocols.
If you have them running on your network see as an example if we have a PC connecting to a server and
the PC connects using HGP and that traffic is same across the network router one will see a packet with
a source address of 10 1 1 1 with the source port number greater than 1023.
So in this example let's say 1024.
In this case because you are using UDP it's going to well-known port number 80 so the destination IP
address is 10 1 to 1 and the destination port number is 80.
Now with access lists direction is of great importance on this interface.
The rat is receiving the packet inbound but on this interface the packet is being transmitted outbound.
It's important that you look at this from the rowdiest point of view.
The packet arrives inbound and is sent outbound.
So in other words if you configure an access list outbound on the seem to face it would have no effect
on traffic from the PC to the server.
Because I'm out on access list only checks traffic outbound from the Buddhist point of view.
So if you configured an inbound Access Control List on the left hand side packets would have to pass
that exit control list before being permitted and once again if you configure it an on Access Control
list on this interface traffic samed would have to pass the access list will be permitted by the access
list.
Otherwise the traffic will be dropped.
When the service since traffic in reply the source address will now be ten one to one with a source
port of 80 and the destination IP address will be 10 1 1 1 and the destination port number will be 1024.
In this case an outbound access list on this interface would come into effect all traffic from the server
to the PC because the traffic is going out from the router point of view.
So an excellent configured outbound and this interface would have fixed this traffic and this traffic
would have to pass the criteria set in the access list before being permitted by the same token an inbound
access list on this interface would affect the traffic and the traffic would have to pass the criteria
set in that Access Control List.
Yes another example.
This MacBook is telnetting to switch one via the router.
So for argument's sake let's assume the MacBook chooses port 50000.
The source address all frames from the MacBook to the switch would be 10 one on one with the source
port of 50000.
The destination would be 10 1 to 1 with the destination port number 23.
So once again from his point of view it's receiving frames on this interface with a sort of tame one
on one source for fifty thousand and it's transmitting those packets out of this interface with the
same details.
Packets sent in reply from the switch of a source address of 10 1 to 1 source port of 23 and a destination
IP address of 10 1 1 1 the destination port of 50000.
Once again it's important that you understand your protocols and port numbers because without that understanding
you'll not be able to configure ACLC always look at the direction of the traffic to determine whether
an excess should be banned inbound or outbound on specific interfaces.
You are some examples of some well-known TZP protocols with the relevant port numbers.
If DP uses port 21 for control and 24 data telnet uses port 23 sickish shell uses port 22.
It's empty.
Use port 25 HVD Pease's port 80.
POP 3 uses port 1 1 0.
SS Elissa's port 443.
So those are examples of some well-known TZP port numbers that you should remember for the real world.
Just google my on port numbers to see a list of the Internet assign numbers of 30 port numbers.
The I on is in charge of port numbers and determines the allocation.
As an example just type on the port numbers
and your very first hit will be a list of court numbers and they explain quite nicely.
About the well-known port numbers registered port numbers and dynamic and private port numbers.
So as an example if you just do a search or telnet you'll see which port number telnet uses.
He has a nice list if you're not sure which port numbers are used by specific protocols.
Here's an example of protocols that use UDP and they rely on port numbers.
So as an example DHP uses port number 67 and 68 TFT Pease's port 69 and as an MP uses port 161.
Once again on that same list on the Ayana you could do a search for specific protocols and there's an
example of TFT DNS is a special case.
It is just part number 53 that uses both TCAP and UDP.
So both for study purposes and the real world.
Remember that protocols like telnet use port 23 and tell users TZP.
Whereas for example DFT uses port 69 using UDP.
Now why would you use ACLC up to this point in the course we've been enabling access between different
parts of the network no shutting interfaces grading into Bil'in routing setting up routing protocols
like your job you know SPF will enable access throughout the network.
However you might not want everyone to be able to access every part of the network.
This is especially true when you connect to the Internet.
You don't necessarily want everyone on the Internet to be able to access your corporate servers or corporate
network.
So access lists are one of the first lines of defense to stop or deny traffic from one part of the network
to another so they can be used to permit or deny traffic moving through a router.
So as an example we might allow this MacBook to gain access to the Internet that we might deny traffic
from the internet into our corporate environment.
So we would permit or deny traffic on a per interface basis and thus deny traffic moving through the
router.
You could put a password on a Viti wireline on a router to force a level of security.
However you might say that only administrative subnets Wayne since this machine on an administrative
subnet is allowed to access the Viti while lines whereas this machine is not allowed to access the BT
wire lines.
In this case the access list will not even permit telnet or S-sh traffic to the Viti Why lines on the
router.
So rather than just having one line of defense a password you implement two lines of defense only permitting
certain subnets to the Etowah lines as well as putting a password on the BT y lines whenever it comes
to security.
You've got to think of the risk dependent on the risk you will implement more security.
In this case you might deem the risk of users accessing network equipment to be high.
So you only allow certain subnets to connect to the BT y lines or the router or switch.
So once again with our ACL is all packets could be transmitted to all parts of the network.
And that might not be desirable.
So you might want to deny certain parts of the network from gaining access to other parts of the network.
The whole idea here is that you're starting to implement security locking down parts of the network
so that they cannot be accessed by all individuals inside and outside of your organization.
ACLC How have I not just used for permitting or denying traffic they can also be used for classification
when setting up an basic VPN or virtual private network between two sites.
You need to tell the router which traffic needs to be encrypted.
You might not want all traffic encrypted from your local LAN because you might want traffic from your
local LAN to an Internet server to be sent unencrypted but traffic from your local LAN to the land on
the other side of the VPN tunnel needs to be encrypted so you create an access list determining what
traffic is interesting.
In other words needs to be encrypted.
What traffic is not interesting in other words does not need to be encrypted ACL can also be used in
redistribution where you are taking routes from one routing protocol and redistributing them or pumping
them in to another routing protocol.
So you might not want OSPF to learn about all your GOP routes and therefore you can use Access Control
lists to limit or only permit certain routes to be redistributed access lists are also used with net
or network address translation the access list will determine which packets need to be translated and
which packets do not need to be translated.
So you would create an excess list permitting only certain subnets which would allow for those packets
to be translated packets denied by the access list are not denied access or dropped but they are not
translated using network address translation or net when using ACLC to permit or deny packets moving
through a router.
There are two main steps.
So firstly in global configuration mode you create the access list using the common access list and
then filling in various options.
So the access command is used to create the access list and then secondly you apply the access list
either inbound and outbound on an interface by using the Access Group.
C'mon.
So access this command creates the excess list Access Group.
C'mon binds the access list.
And when you bind it either specify inbound or outbound.
In other words determining the direction that the access list is bound.
It's important to note that an ACL does not take effect until it's applied somewhere.
So if you have access lists in the running configuration of a router and they haven't been applied there
have no effect.
There are two steps you create the access list and then you apply it some way for instance inbound on
Fosset.
Isn't it seriously Zera.
So once again Imraan ACLC are applied inbound on an interface the ICL will be processed before the traffic
will be routed.
In other words if the ICL denies the traffic and the traffic is discarded the router will not have to
process the packets by looking in its writing table and determining the outbound interface.
The package will be discarded or dropped before the rotting engine needs to process them.
If they are permitted they will be processed for writing and the router will determine the outgoing
interface.
If discarded there is no additional overhead on the router because the router does not need to do a
writing table lookup to determine the a graceful outgoing interface if the traffic is permitted the
writing process will then do the writing table lookup to determine the outgoing interface without that
ACLC.
Rotting is performed first and then the packet is directed to an outbound interface and then based on
the ACL the packets will be permitted.
In other words transmitted or denied it is therefore more efficient to bind an access list inbound on
an interface because packets that are dropped or denied will not need to be processed.
While the writing process on the router.
If an ACL is applied outbound the Rada still has to process all the packets which may then be denied
or dropped on the outbound interface.
So where possible bind ACLC inbound on interfaces rather than outbound.
Or more efficient processing an access list is a sequential list of statements where packets are evaluated
from the first statement to the last.
In other words there is top down processing.
If a packet is matched by an individual statement in the access list that packet will either be permitted
or denied depending on whether the permit or deny keyword is used in that specific statement.
All remaining lines of the access list are ignored for that specific packet.
So in other words as soon as there's a match on a line all remaining lines are ignored if the traffic
does not match that specific line or statement then the next line in the ACL is checked.
So Nexxus list is a sequential list of statements and the Rada will check from the first line to the
last until it gets a match.
As soon as there's a match.
All subsequent lines are ignored.
If there is no match for any statement in the ACL the packet is dropped because of what's called the
implicit denie at the end at the end of every access list.
There's an implicit denial which means if you're not explicitly permitted by an access list you're implicitly
denied all traffic not permitted some somewhere in that access list with the use of a permit statement
will be dropped.
That means therefore that you must have at least one permit statement some way in practice list.
Otherwise you might as well unplug the cable.
Now there are two main tops of access lists that we concentrate on in this course.
The first is a standard ACL and the second is an extended ACL standard ACLJ only check on Source IP
addresses.
They do not check on individual port numbers or individual protocols that either permit or deny the
entire protocol suite based on the source IP address or source network.
Nothing else in the source IP address or source network can be specified extended ACLC check on both
the source and destination address and allows you to permit or deny specific protocols and applications.
In other words you could permit or deny based on IP TZP UDP ICMP and many other protocols and you can
also permit or deny based on source port numbers and destination port numbers extended access lists
are they for a lot more granular and tend to be used in the real world.
But for completeness we need to cover both standard and extended access lists in this course.