Roy's CCNA Notes

Day 34 - Standard ACLs

Mar 08, 20254 min read

Jeremy’s IT Lab lecture video:

Day 34 - Standard ACLs

Commands

ACL Information

What Are Access Control Lists (ACLs)?

Access Control Lists (ACLs) are traffic filters which contain ordered lists of rules called ‘Access Control Entries’ (ACEs).

  • ACLs function as a packet filter, as they instruct the router to permit or deny traffic based on the defined ACEs.
  • ACLs can filter traffic based on source/destination IP addresses, source/destination Layer 4 ports, and etc.

ACL Config General Info

  • ACLs are configured globally on the router (global configuration mode), but they must be applied onto an interface in order to take effect.
  • ACLs are applied either inbound or outbound on interfaces.
  • When the router checks a packet against the configured ACL, it processes the ACEs in order, from top to bottom.
  • If the packet matches one of the ACEs in the ACL, the router will take action (apply the ACE rule) and stops processing the ACL (all entries below the matching entry will be ignored).

Implicit Deny

Implicit Deny is a feature that is present in all ACLs. The implicit deny tells the router to deny all traffic that doesn’t match any of the configured ACEs in the ACL.

ACL Types

There are two types of ACLs with both containing two subtypes:

  1. Standard ACLs
    • Standard ACLs match based on source IP address only
    • Standard ACLs can use the number range (1 - 99) and (1300 - 1999)
    • They should be applied as close to the destination as possible.
    • They include two subtypes:
      1. Standard numbered ACLs
      2. Standard named ACLs
  2. Extended ACLs
    • Extended ACLs match based on source/destination IP address, source/destination port address, etc.
    • Extended ACLs can use the number range (100 - 199) and (2000 - 2699)
    • They should be applied as close to the source as possible.
    • They include two subtypes:
      1. Extended numbered ACLs
      2. Extended named ACLs

Numbered ACLs

  • Different types of numbered ACLs have a different range of numbers that they can use.
  • So, each range can be used to identify what type of numbered ACL we’re looking it.

Standard ACL Types

1. Standard Numbered ACLs

Standard numbered ACLs are one of the Standard ACL subtypes. They are identified with a number.

  • (Ex. ACL 1, ACL 2)

2. Standard Named ACLs

Standard named ACLs are one of the Standard ACL subtypes. They are identified with a name.

  • (Ex. FIRST_ACL, CCNA_ACL)

Standard ACL Configuration

There are two ways to create a standard ACLs:

  1. Global configuration / directly
    • This method only allows you to create numbered ACLs
    • Done through the command:
      • access-list STANDARD-ACL-NUMBER { deny | permit } IP WILDCARD-MASK
    • Examples:
      • access-list 1 deny 1.1.1.1 0.0.0.0
      • access-list 1 deny 1.1.1.1 <-- (only possible in Standard ACLs)
      • access-list 1 deny host 1.1.1.1
      • access-list 1 permit any
      • access-list 1 permit 0.0.0.0 255.255.255.255
  2. ACL configuration mode
    • Done through the command:
      • ip access-list standard NAME/NUMBER
    • Which puts you in Standard ACL configuration mode. ACEs can be set through the following command format:
      • [entry-number] { deny | permit } ip wildcard-mask

Access-list arguments

After the ’{ deny | permit }’ part of your command, you usually specify the ip and wildcard-mask. But, there are some arguments you could use as well:

  1. host
  • Instead of specifying a wildcard-mask for a host address (/32) like this:
    • access-list 1 deny 1.1.1.1 0.0.0.0
  • You can use the host argument and the router will automatically translate it into a host address (/32):
    • access-list 1 deny host 1.1.1.1
  1. any
  • Instead of specifying an ip and wildcard-mask to match/deny all traffic like this:
    • access-list 1 permit 0.0.0.0 255.255.255.255
  • You could use the any argument, which will match/deny all traffic:
    • access-list 1 permit any

Notes on how routers handle ACLs

  • The router may re-order the /32 entries.
  • This improves the efficiency of processing the ACL.
  • It does not change the effect of the ACL.
  • This applies to both standard named and standard numbered ACLs.

Graph View

Backlinks

  • No backlinks found