Are also two methods to identify whether an ACL is a standard ACL or extended ACL access list either
configured as numbered access lists or named access lists with numbered ACLC the number of the ACL determines
what type of ACL it is.
So for example ACL in the range 1 299 or what's called the expanded range 2400 to one triple nine would
be used for standard IP ACLC So as an example one Arata in global configuration mode I can top the C'mon
X-ists list.
Question mark.
And as you can see here 1 to 99 is used for IP stented access lists the expanded range is also listed
4300 to 1 triple nine.
Now the reason for the expanded range is that initially about 100 ACLC seen more than enough.
But as we all know as time goes by what was deemed to be enough is not necessarily enough.
And these days we can use both 1 to 99 or the expanded range if the requirement for more than 100 access
list is there might be extended access lists on the range one hundred to one ninety nine as well as
the expanded range which is 2002 2 6 9 9 depending on your Iowas you will see other types of ACLC listed
for instance support epal talk ACL in the range 600 to six ninety nine can be used or to support IPX.
You could for instance use a cells in the range 800 to eight nine nine or extended IPX X-ists lists
in the range 900 to 9 nine nine.
Notice for example ACLJ in the range 700 to 7 9 9 are useful MAC address access lists in this course
we fortunately only concentrate on IP access lists so we will concentrate on both.
I'd be stented access lists an IP extended access lists that be a way of please that there are other
number ranges used for other protocols like IPX Apple talk and so forth.
The second type is named X-ists lists which are more descriptive because they use alphanumeric characters
as names.
So rather than X's list 100 for instance emitting telnet traffic to switch you could call TACL hemat
telnet and give it a name with more meaning.
That also allows you to create many many more ACLC on a router than the list specified by the numbered
ACL ACLC originally named ACLJ also gave you more flexibility when it came to editing individual lines
or deleting individual lines in an ACL.
But these days that flexibility is available for both named as well as numbered a seal's just to demonstrate
a little bit more if I specify one as my ACL number.
Notice it gives me three options deny commit all remark.
Now let's start with the last one.
The remote option allows you to add a description to your heels.
This is very useful because when you return to an ACL that you configured months ago rather than having
to decipher the lines of the ACL the remark or in other words the description can let you know what
that ACL is attempting to accomplish.
So it's recommended that you use the remark statement to add descriptions to seals to make them more
user friendly and understandable both for yourself and for others.
Do I choose the option to meet noticed because this is the standard IP access list the only options
here are permitting either a hostname or IP address permitting any which permits everyone or anything
and the host option.
So I could for example put in a dress like 10 wondered wondered 1 and then noticed the next option is
to put in Wild Card bets or to hit enter or I can log this information to say is this logged server
or another logging device on my network.
So if I put in the Option 0 the 0.00 that is specifying that I will permit traffic from a specific host
10 dot one dot 1.1.
Now ICL don't use standard network mosques.
They use Inv. mosques whereas zero in binary means they must be a match and a one in binary means it
doesn't have to be a match.
So just to reiterate you need to look at this in binary if you're not sure a zero in binary in the mosque
means that there must be a match on the host or network a one in the mosque means that we ignore the
host or network Valley.
So as an example if I want to match a specific IP address I can tap the C'mon X-ists list one one denoting
that this is a standard Ickey access list.
I'm permitting traffic that matches 10 dot one dot 1.1 exactly the zeros in the mosque mean that the
first octet must be at 10.
The second lock tape must be a one the third octet must be a one and a fourth octet must be a 1 and
0 in the mosque means an exact match a one in the mosque means it doesn't have to match.
So this statement will only match for specific host with the IP address 10.0 1.1 one now rather than
doing it that way you can configure the access list as follows.
You can topic them on access list one permit.
And in this case we're looking for a specific host.
So you can use the keyword host and in specifying the host IP address either will do.
It's like saying tomato versus to Meda depending on which you prefer will depend on which one you configure.
The opposite of specifying an individual host would be matching anything or everything.
So you could create an access list access list one per minute and notice in the address portion we have
put 0 0 0 0.
And this could essentially be made anything in the Moscow but we've put 2 4 5 2 4 5 2 4 5 2 4 5.
I remember a one in binary in the mosque means ignored this failure.
In other words it can be anything at zero in the mosque means an exact match.
So if we look at the IP address it's 0.0 0.0 in decimal which is equal to all zeros in binary.
This get in the binary address obviously doesn't exist.
I've just put a cheerful readability.
So looking at the address in binary it's eight zeros the mosque.
In other words in the first octet the mosque is set to 255 which is equal to eight binary ones.
So what are we saying by putting 2:55 in the first octet in the mosque.
Is that the first octet in the address is irrelevant.
We are just ignoring all the bits.
We've done the same with opted to three and four.
So this is essentially making anything or everything.
And we are not matching any specific host or network.
Alternately you could also use the syntax access list one that any.
So once again tomato versus tomato you decide which you prefer.
Both will work and both have the same result.
If you want to match an individual subnet rather than an individual host or any traffic you could use
a combination of zeros and ones in the mosque.
So as an example X-ists list one has met 10 and notice in the mosque we have a zero in the first octet
which means that we are matching on the 10 10 dot 1. 1.0.
And in the mosque we have 0 0 0 255.
Now in the first octet in the mosque we have got binary zeros which means that there must be an exact
match on this address.
In other words we are specifically matching the first octet.
It must be equal to a 10.
The second octet must be 1 because we've got to zero in the mosque.
The third octet must be one because we have a zero in the mosque.
But notice in the fourth octet this can be set to anything because we've got binary ones in the fourth
octet 255 if you remember is eight binary ones.
In other words we are saying we don't care what the last octet does City this statement will match any
host or any address where the first three octets are set to 10.
Not one dot one.
The fourth octet can be anything.
So just to sum up if we were using the dotted decimal notation it matches specific IP address like 10
1 1 1.
We would full the mosque would Ciro's.
Once again this is an inverse mosque.
A zero in the mosque means that we are looking for a specific value in the host portion of the address.
A one in the mosque means we ignore what the host portion is city.
So this matches a specific IP address to match a specific subnet let's say 10 1 1 0.
We could configure the access list is 10 1 1 0 with the first three octets equal to zero.
And the last octet equal to 255.
Or if we wanted to match anything we could say the host portion to actually any number and the mosque
255 255 255 255 so as an example on a Rodda I could top the on access list to met and then specify anything
I wanted to.
But if the mosque is set to all one's flattop up the can mine show IP access list.
Notice the rotters changed that to say permit any.
We taught this on the router but the router has changed it to permit any I can do the C'mon show run
include access list to see all my ex's live statements configured on the router and you can see once
again the router has changed the format of the access lists there's a more complicated example.
If we had an access list it's Exorcist 1 10 1 1 0 and the mosque is 0 0 0 15.
What we saying is ignore the last four births of the last octet.
So notice the address is 10 1 1 0.
And the mosque is 0 0 0 15.
Now the first three octets are fairly easy to work out.
What we are saying is that the first octet must be 10 the second octet must be one the third octet must
be one.
But it gets a little bit more complicated.
Looking at the last octet in decimal it's a lot easier if you convert it to binary for binary zeros
followed by four binary ones zero in binary equals eight binary zeros.
Once again the gap in the model in these octets is just for readability so that it's easier to see what's
going on.
So what we are saying is that the last four bits and address can be set to anything similar with these
last four binary Burts could be set to either 0 0 or 1 but the first four binary bits must be equal
to zero because the address portion has a 0 in it.
And the first four bits of the mosque are set to zero.
It means that the first four bits of an address must be equal to this value.
In other words zero.
So let's show you some examples.
If I had an address of 10 one wondered wondered one would it be matched by this statement.
Permit 10 1 1 0 0 0 0 15.
And the answer would be yes.
I've only converted the last octet into binary as the first three octets are easy to work out what are
you saying is that the first three octets must be equal to 10 1 1 1 which it is for this address but
the last octet converted to binary will look as follows.
We would have 7 binary zeros followed by binary 1.
15.
In binary once again is four binary zeros followed by all binary ones.
So what we saying is notice the first four bits in the address must because of the zeros in the mosque
being equal to 0 0 0 0 which for 1 is true.
The first four bits are set to zeros.
It doesn't matter what the last 4 bits of city because we have binary ones in the mosque.
So there is a match on 10 1 1 1.
But does this access statement match 10 1 1 1:29.
And the answer is No.
Because in the first four bits of the address it must be equal to 4 binary zeros.
And if you convert 1:29 into binary it consists of 1 Henri 1 followed by six binary zeros followed by
binary 1.
In other words the first four binary bits do not equal four zeros.
So this is not a match.
In this example we have some hosts on subnet 10 1 1 0.
So as an example this PC and this MacBook we also have servers server one with IP address 10 1 to 1
and server 2 with IP address 10 1 3 1.
In this example we want to permit host 10 1 1 1 access to the servers but deny everyone else.
Please note these examples are just to help teach you the syntax of access lists and how they can be
used in various scenarios.
These examples are not based practice so please don't try and understand the why of these examples.
They just yet try and help you understand X-ists lists can be applied obviously in the real world and
in exam situations you might be presented with various scenarios and in those cases you will need to
know how X-ists lists work to be able to meet the requirements of the cinerea.
The first decision you need to make is on which interface are you going to apply the access list.
In this example we are going to use a standard IP X-ists list.
We are not going to use extended access lists so it makes sense to apply the access list inbound in
this interface that will accomplish what we set out to do.
You could also apply the access list both if 0 1 and 0 2 but it would be more efficient to apply inbound
rather than outbound.
It also means that you only have to apply the access list on one interface rather than on two interfaces
so an Narada could configure the access list.
But before doing that I'm going to type the command show access lists just to see which access lists
have already been configured so that I don't advertently edit an access list that already exists in
this example you can see that there are no access lists so I can go into global config mode.
The topic on access list and then specify a number and let's say in this example we have to use a standard
IP access list so I'm going to just choose a number let's say one and then I'm going to say permit
host 10.
Or one that wanted one and hit enter.
Also Noria states that we need to permit this host access to the servers.
Now stented the access list does not allow you to specify destinations.
You can only specify the source.
Now it's worth remembering the implicit deny any at the end of every IP access list.
Our criteria in this example is just to permit that specific host 10 1 1 1 and deny everyone else.
So this single line access list will accomplish what we set out to do.
The next step is to bind the access list on an interface so an interface if serious error atop the common
IP access group and notice it prompts me to put in the number or word of the access list so one and
then it prompts me to specify the direction and I'm going to say inbound that just by doing that I've
accomplished what I set out to do.
We are permitting this host 10 1 1 1 and denying every one else.
You obviously need to be careful with access lists because if another interface were configured on this
router no traffic except for this host would be allowed to send traffic through interface if seriously
zero.
But in this scenario we have met the requirements.
One last thing to show you is find top the C'mon show the interface and the relevant interface the Rato
will show me which X-ists list is bound outbound and which X-ists list is bound inbound on the specific
interface.
And as you can see here access list one is bound inbound and no access list is bound outbound.
So as an example I could create another access list let's say access list to permit any and then go
into that interface and taught IP access group.
Two out
do the same show command again show the interface if is flesh zero and you'll be able to see that access
list is bound outbound an access list one is bound inbound.
If I made the following mistake and bound access list to inbound rather than outbound
the following would take place.
The router does not warn me about anything but notice the inbound access list has been replaced with
access list too.
So the previous access this one was removed off the interface and replaced with access list too.
There is no need to firstly remove the old access list before applying the new access list.
The old one is implicitly removed and the new one is applied.
Also notice that you can apply the same access list in and out at the same time.