Now let's implement some examples of extended IP access lists.
In this example we are saying permit HDP traffic from 10 1 1 1 to 10 1 to 1.
In other words this host should be permitted to talk to the server but only using a sheepy.
We need to deny all other traffic from subnet 10 1 1 0 Sless 24 going to the server.
In other words anyone asked them the subnet should be denied access to the specific server.
We want to permit all other traffic from the subnet anywhere else.
In other words this host for example should be able to connect to this router to be able to connect
to the router should be able to send traffic to this MacBook.
Now once again it's very important to look at the direction of the traffic so the traffic flow is from
left to right now as per base practices and extended IP access list should be placed as close to the
source as possible.
And thus we going to apply the access list inbound on.
Ethan It's 0 0.
The advantage of doing this as well is that the Ratta does not need to process packets unnecessarily
which is just going to be dropped elsewhere in the network.
So we will apply the access list as close to the source as we can.
And the closest interface is F-Series flesh Zira.
So the first statement should permit HD traffic from 10 1 1 1 to 10 1 to 1 on the Rodda going into global
configuration mode.
I can talk to him on this list and notice once again is a range of numbers.
We are going to choose one in this range 100 to 199 because we are creating an extended IP access list.
So let's pick 100 that were going to say permit and notice here we can permit multiple protocols.
Now this is where it becomes important knowing what lower level protocols Hialeah protocols like HTP
use.
So in this example we are looking to permit HGP HGP relies on TCAP at least for the same model.
So we are going to specify TZP and Boadicea we can specify a source.
So I'm going to do it this way.
And notice I can put in my wildcard Beths.
So that was the source.
And now we need to specify a destination.
In this case the destination is 10 1 to 1 so doing it another way.
I'm going to specify a host 10 1 2 to 1 and that is if I press question mark at the end it gives me
many options here including equal which allows me to match on a specific port number for greater than
which allows me to look at port numbers greater than a certain number.
All less then which allows me to look at port numbers less than a specific number.
All range which allows me to look at port numbers in a specific range.
But in this case we're looking for HTP.
So I'm going to topic them on equal.
Chris question mark and notice I can enter a specific port number if I know the number or I can use
the word and notice the many words here.
But notice as an example HGP use of the word GWW.
So I could either put in 80 or I could put in w WW.
Once again notice the dollar sign is just telling me that there's more to the left.
So if I put in the command control a They'll take me to the beginning of the line or control he takes
me to the end of the line that dollars just telling me that there's more ticks than what can fit on
the specific output.
So just hidden some of the text to make it easier to read.
So I can hit enter so that completes the first part of the access list.
Now we have to deny all of the traffic from that specific subnet to the server.
So I could come on this list 100 and in this case specified deny.
Now we have to specify protocol so we can just deny everything.
In other words deny all IP the source is tendered 1. 1.0 put in the wildcard mos.
The destination is aspecific host which is 10.0 1.2 to 12:58 it enter.
So that line denies all other traffic.
So in other words all IP traffic is denied from subnet 10 1 1 0 10 1 1 0 with the relevant mosque going
to host 10 1 to 1 which is what we've got configured here.
So we have successfully created the second part of the access list the third parties saying permit all
other traffic from subnet anywhere else so I could literally just say access list 100 Myrt IP and we're
going to specify that specific subnet Tendo squandered 1.0 with a mosque.
And in this case I can say any way.
So any the last step is to bind the access list on the interface so IP access group 100 in.
Now just to show you what we've configured show access list shows me in this case that I've got an extended
IP access list.
The first line is the meeting TCAP from that host 10 1 1 1 to host 10 1 to 1.
I noticed that rodders automatically changed the port number into the name description w WW.
The second line is denying traffic from that subnet to the host 10 1 to 1 and the third line is permitting
traffic from that subnet anyway.
Show IP interface 0 0 shows me an example that that access list is bound inbound on Fosset.
Ethan It's Aeros flesh sirra.
So we have accomplished what we set out to do based on those criteria.
In this example we want to permit both HGP and TFT traffic from the subnet 10 1 1 0 slice 24 to the
server.
In other words devices on the subnet should be able to open HTP sessions and DFT sessions to the server.
We then want to deny all of the traffic from the subnet to the server.
In other words we only want to allow HTP and TFT traffic to the server and no other traffic.
But we also want to permit all other traffic from the subnet anywhere else.
In other words these devices and the subnet should be able to access this server to HTP and TFT be they
should not be able to use any other protocols to access the server.
But they should be able to connect for instance to this MacBook using any protocol.
So the first thing we need to look at is the direction and once again the traffic is flowing from the
left hand side to the right hand side.
Once again as per our base practices we will apply the access list inbound on FASA.
Ethan It's 0 0 on our one because this is the interface closest to the source of traffic.
So to do that on our road to go into global config configurator gang top access list choose a number.
In this case a choose 101 because it's an extended IP access list.
I mean it's the next one available choose commed and this case which is our protocol we are going to
be permitting both HTP and TFT P from the subnet to the server.
Remember HTP uses TZP Atlay for that TFT P uses UDP Atlay for sufficiently TCAP the source network has
10 1 1 0 the wildcard mosque 000 2:55.
So that's our source.
And now we have to specify the destination.
The destination is awesome.
10.0 1.2 to one.
And now we can choose either equal or greater than less than or range and so forth.
In this case we're going to say equal to port 80.
In other words HTP the next line would be 40 50 p that before we do that let's put a remark in just
to make it easier to understand.
So I'd say Remarque SMRT London site to New York server for example
and they will say is this 101.
Met.
In this case you have to specify UDP because TFT uses UDP.
The source
subnet going to the destination.
In this case I'll just change it around just to show you that both options will work.
I can specify the server with a mosque and this case I'm set equal and notice now please the protocols
are different because we are using UDP as an example you won't see HGP in this list but you will see
TFT the rod is clever enough to know which highly of protocols use UDP or TZP.
And in this example we specified UDP.
So I'm just going to say 69.
It's also a remark to make this more descriptors Exorcist 101
remark met TFT from London site to New York City for example.
That remark is obviously just for us as humans to know what's going on and has no effect on the router.
So we have permitted sheepy and TFT traffic from that subnet to the server and now we are told to deny
all other traffic from the subnet to the server.
So access list 101 deny and because this is an IP based access let's begin to deny IP 10.0 wondered
1.0 0.0 added 0 to 255 and we're told to only deny traffic from that submit to the server.
So the destination will be host tendered one or two to one.
So we've met the second criteria.
The last step is to permit all other traffic from the subnet anywhere else.
So we would say access list 101 commit 10 dot dot 1.0 with a mosque anywhere the last step is to bind
it on to the interface interface.
Seriously Sarah as per our best practices begin to bind it in-bound and this interface so IP X-ists
group 101 in and that's.
In this example we want to ProMED HGP and TFT be traffic from any way to the server 10 1 to 1 but we're
going to deny all other traffic to the server.
So now things are a little bit different.
We are only allowing UDP and TFT from anywhere to the server.
So traffic from this host as well as these hosts needs to have access to the server but only HTP and
TFG traffic.
If we were asked to only apply a single access list we would need to apply it outbound then if Sarah
is left.
However we were given the option to apply multiple access control lists we would for instance apply
it on 0 1 on our t as well as serious 0 0 or 1 which would have the effect that traffic that is going
to be dropped will be dropped sooner and quicker rather than traversing the when link and then being
dropped as when using this setup.
It's easy to read between the lines and determine what you are being asked to do and what restrictions
have been placed on your solutions.
So on the route of before we go any further let's see what access lists have been configured so I can
do the C'mon show run quite include access list which will just show me the access list part of the
configuration on this router.
As you can see here we created X-ists last three ACL for ACL five
extended ACL 100 and extended ACL 101.
Notice it's easier to see what's going on when the remarks or descriptions have been added to the access
list to going into level configuration mode.
I can top the C'mon access list one or two per murd TZP.
Any host 10 to 1 or 2 to 1 or Ra of the
equal 80.
Once again be very careful what I've just done there.
That statement no access list one or two would have removed the entire access list.
I'll show you in a moment how you can edit individual lines on an access list and an access list 100
to permit UDP.
Any host 10 or 1 or 2 to 1 equal 69 that will accomplish what we set out to do with this first statement
and then we need to deny all other traffic on that server to access list 1 to deny IP any and don't
forget you have to put the source and destination I can now that's a mistake.
Now if I do the can Monge do show access list on a two.
You'll notice these line numbers 10 20 30 later versions of the Iowas the right to automatically puts
line numbers on each line created which is great because it allows us to edit individual lines if I
tap the command no X's list wanted to deny IP any any to try and remove this last line.
It will remove the entire access list.
So rather than doing that I can do the common IP access list extended because this is an extended IP
access list and then I put the number in.
And then I can type No.13 to remove like 30 stopping the command do show access list one or two will
show you that that last line has been removed and I could add the line back by saying 30 deny any hosts
10 1 to 2 to 1.
Or rather the night IP any host 10 1 to 1 and not doing a show came on.
Shows me that that line has been added correctly so that makes life a lot easier.
Rather than having to delete the access list and then recreate it from scratch or editing a notepad
you could edit it directly on the rod at the last step once again would be to bind it on the interface
if seriously zero outbound.