Accesscontrollist

1
Rules of Access List

All deny statements have to be given First
There should be at least one Permit statement
An implicit deny blocks all traffic by default when
there is no match (an invisible statement).
Can have one access-list per interface per direction.
(i.e.) Two access-list per interface, one in inbound
direction and one in outbound direction.
Works in Sequential order
Editing of access-lists is not possible (i.e) Selectively
adding or removing access-list statements is not
possible.
Standard ACL - Network Diagram
10.0.0.1/8
S0
HYD
1.2
S1
10.0.0.2/8
1.3
LAN - 192.168.1.0/24
is
isdone
doneClosest
Closest
to
tothe
the
11.0.0.1/8
S0
E0
192.168.1.150/24
1.1
Creation
Creationand
and
Implementation
Implementation
2.1
CHE
Destination.
Destination.
S1
11.0.0.2/8
E0
192.168.2.150/24
2.2
2.3
LAN - 192.168.2.0/24
3.1
BAN
E0
192.168.3.150/2
3.2
3.3
LAN - 192.168.3.0/24
1.1
1.1 &
& 1.2
1.2 should
should not
not communicate
communicate with
with 2.0
2.0 network
network
How Standard ACL Works ?
10.0.0.1/8
S0
HYD
11.0.0.1/8
S0
S1
10.0.0.2/8
E0
192.168.1.150/24
1.1
1.2
1.3
LAN - 192.168.1.0/24
2.1
CHE
S1
11.0.0.2/8
E0
192.168.2.150/24
2.2
2.3
LAN - 192.168.2.0/24
1.1
1.1 is
is accessing
accessing 2.1
2.1
3.1
BAN
E0
192.168.3.150/2
3.2
3.3
LAN - 192.168.3.0/24
1.1
Source IP
192.168.1.1
2.1
Destination IP
192.168.2.1
access-list 1 deny 192.168.1.1 0.0.0.0

access-list 1 deny 192.168.1.2 0.0.0.0
access-list 1 permit any
1.1
Source IP
192.168.1.1
2.1
Destination IP
192.168.2.1
access-list 1 deny 192.168.1.1 0.0.0.0

access-list 1 deny 192.168.1.2 0.0.0.0
10.0.0.1/8
S0
HYD
11.0.0.1/8
S0
S1
10.0.0.2/8
E0
192.168.1.150/24
1.1
1.2
1.3
1.3
LAN - 192.168.1.0/24
2.1
CHE
S1
11.0.0.2/8
E0
192.168.2.150/24
2.2
2.3
LAN - 192.168.2.0/24
1.3
1.3 is
is accessing
accessing 2.1
2.1
3.1
BAN
E0
192.168.3.150/2
3.2
3.3
LAN - 192.168.3.0/24
1.1
Source IP
192.168.1.3
2.1
Destination IP
192.168.2.1
access-list 1 deny 192.168.1.1 0.0.0.0
access-list 1 deny 192.168.1.2 0.0.0.0

1.1
Source IP
192.168.1.3
2.1
Destination IP
192.168.2.1
access-list 1 deny 192.168.1.1 0.0.0.0

access-list 1 deny 192.168.1.2 0.0.0.0
1.1
Source IP
192.168.1.3
2.1
Destination IP
192.168.2.1
access-list 1 deny 192.168.1.1 0.0.0.0

access-list 1 deny 192.168.1.2 0.0.0.0
10
1.1
Source IP
192.168.1.1
192.168.1.3
2.1
Destination IP
192.168.2.1
access-list 1 deny 192.168.1.1 0.0.0.0

access-list 1 deny 192.168.1.2 0.0.0.0
11
Standard ACL - Network Diagram
10.0.0.1/8
S0
HYD
1.2
S1
10.0.0.2/8
1.3
LAN - 192.168.1.0/24
is
isdone
doneClosest
Closest
to
tothe
the
11.0.0.1/8
S0
E0
192.168.1.150/24
1.1
Creation
Creationand
and
Implementation
Implementation
2.1
CHE
Destination.
Destination.
S1
11.0.0.2/8
E0
192.168.2.150/24
2.2
2.3
LAN - 192.168.2.0/24
3.1
BAN
E0
192.168.3.150/2
3.2
3.3
LAN - 192.168.3.0/24
1.1
1.1 &
& 3.0
3.0 should
should not
not communicate
communicate with
with 2.0
2.0 network
network
12
10.0.0.1/8
S0
HYD
11.0.0.1/8
S0
S1
10.0.0.2/8
E0
192.168.1.150/24
1.1
1.2
1.3
LAN - 192.168.1.0/24
2.1
CHE
S1
11.0.0.2/8
E0
192.168.2.150/24
2.2
2.3
LAN - 192.168.2.0/24
1.1
1.1 is
is accessing
accessing 2.1
2.1
3.1
BAN
E0
192.168.3.150/2
3.2
3.3
LAN - 192.168.3.0/24
13
1.1
Source IP
192.168.1.1
2.1
Destination IP
192.168.2.1
access-list 5 deny 192.168.1.1 0.0.0.0

access-list 5 deny 192.168.3.0 0.0.0.255
14
1.1
Source IP
192.168.1.1
2.1
Destination IP
192.168.2.1
access-list 5 deny 192.168.1.1 0.0.0.0

access-list 5 deny 192.168.3.0 0.0.0.255
15
10.0.0.1/8
S0
HYD
11.0.0.1/8
S0
S1
10.0.0.2/8
E0
192.168.1.150/24
1.1
1.2
1.3
1.3
LAN - 192.168.1.0/24
2.1
CHE
S1
11.0.0.2/8
E0
192.168.2.150/24
2.2
2.3
LAN - 192.168.2.0/24
1.3
1.3 is
is accessing
accessing 2.1
2.1
3.1
BAN
E0
192.168.3.150/2
3.2
3.3
LAN - 192.168.3.0/24
16
1.3
Source IP
192.168.1.3
2.1
Destination IP
192.168.2.1
access-list 5 deny 192.168.1.1 0.0.0.0
access-list 5 deny 192.168.3.0 0.0.0.255

17
1.3
Source IP
192.168.1.3
2.1
Destination IP
192.168.2.1
access-list 5 deny 192.168.1.1 0.0.0.0

access-list 5 deny 192.168.3.0 0.0.0.255 x
18
1.3
Source IP
192.168.1.3
2.1
Destination IP
192.168.2.1
access-list 5 deny 192.168.1.1 0.0.0.0

access-list 5 deny 192.168.3.0 0.0.0.255
19
1.3
Source IP
192.168.1.1
192.168.1.3
2.1
Destination IP
192.168.2.1
access-list 5 deny 192.168.1.1 0.0.0.0

access-list 5 deny 192.168.3.0 0.0.0.255
20
10.0.0.1/8
S0
HYD
11.0.0.1/8
S0
S1
10.0.0.2/8
E0
192.168.1.150/24
1.1
1.2
1.3
LAN - 192.168.1.0/24
2.1
CHE
S1
11.0.0.2/8
E0
192.168.2.150/24
2.2
2.3
LAN - 192.168.2.0/24
3.1
3.1 is
is accessing
accessing 2.1
2.1
3.1
BAN
E0
192.168.3.150/2
3.2
3.3
LAN - 192.168.3.0/24
21
3.1
Source IP
192.168.3.1
2.1
Destination IP
192.168.2.1
access-list 5 deny 192.168.1.1 0.0.0.0
access-list 5 deny 192.168.3.0 0.0.0.255

22
3.1
Source IP
192.168.3.1
2.1
Destination IP
192.168.2.1
access-list 5 deny 192.168.1.1 0.0.0.0

access-list 5 deny 192.168.3.0 0.0.0.255
23
3.1
Source IP
192.168.3.1
2.1
Destination IP
192.168.2.1
access-list 5 deny 192.168.1.1 0.0.0.0

access-list 5 deny 192.168.3.0 0.0.0.255
24
Extended ACL - Network Diagram

Creation
Creationand
and
Implementation
Implementation
10.0.0.1/8
S0
HYD
S1
10.0.0.2/8
E0
192.168.1.150/24
1.1
1.2
1.3
LAN - 192.168.1.0/24
is
isdone
doneClosest
Closest
to
tothe
theSource.
Source.
11.0.0.1/8
S0
2.1
CHE
S1
11.0.0.2/8
E0
192.168.2.150/24
2.2
2.3
LAN - 192.168.2.0/24
3.1
BAN
E0
192.168.3.150/2
3.2
3.3
LAN - 192.168.3.0/24
2.0
2.0 should
should not
not access
access with
with 3.1
3.1 (Web
(Web Service)
Service)
25
How Extended ACL Works ?
10.0.0.1/8
S0
HYD
11.0.0.1/8
S0
S1
10.0.0.2/8
E0
192.168.1.150/24
1.1
1.2
1.3
LAN - 192.168.1.0/24
2.1
CHE
S1
11.0.0.2/8
E0
192.168.2.150/24
2.2
2.3
LAN - 192.168.2.0/24
3.1
BAN
E0
192.168.3.150/2
3.2
3.3
LAN - 192.168.3.0/24
2.1
2.1 is
is accessing
accessing 3.1
3.1 -- Web
Web Service
Service
26
2.1
Source IP
192.168.2.1
Destination IP
192.168.3.1
Port - 80
3.1
access-list 101 deny tcp 192.168.2.0 0.0.0.255 192.168.3.1 0.0.0.0 eq 80

access-list 101 permit ip any any
27
2.1
Source IP
192.168.2.1
Destination IP
192.168.3.1
Port - 80
3.1

28
10.0.0.1/8
S0
HYD
11.0.0.1/8
S0
S1
10.0.0.2/8
E0
192.168.1.150/24
1.1
1.2
1.3
LAN - 192.168.1.0/24
2.1
CHE
S1
11.0.0.2/8
E0
192.168.2.150/24
2.2
2.3
LAN - 192.168.2.0/24
3.1
BAN
E0
192.168.3.150/2
3.2
3.3
LAN - 192.168.3.0/24
2.1
2.1 is
is accessing
accessing 3.1
3.1 Telnet
Telnet Service
Service
29
2.1
Source IP
192.168.2.1
Destination IP
192.168.3.1
Port - 23
3.1

30
2.1
Source IP
192.168.2.1
Destination IP
192.168.3.1
Port - 23
3.1

31
2.1
Source IP
192.168.1.1
192.168.2.1
Destination IP
192.168.3.1
Port - 23
3.1

32
10.0.0.1/8
S0
HYD
11.0.0.1/8
S0
S1
10.0.0.2/8
E0
192.168.1.150/24
1.1
1.2
1.3
LAN - 192.168.1.0/24
2.1
CHE
S1
11.0.0.2/8
E0
192.168.2.150/24
2.2
2.3
LAN - 192.168.2.0/24
3.1
BAN
E0
192.168.3.150/2
3.2
3.3
LAN - 192.168.3.0/24
2.1
2.1 is
is accessing
accessing 1.1
1.1 -- Web
Web Service
Service
33
2.1
Source IP
192.168.2.1
Destination IP
192.168.1.1
192.168.1.1
Port - 80
1.1

34
2.1
Source IP
192.168.2.1
Destination IP
192.168.1.1
Port - 80
1.1

35
2.1
Source IP
192.168.1.1
192.168.2.1
Destination IP
192.168.1.1
Port - 80
1.1

36
Named Access List

Access-lists are identified using Names
rather than Numbers.
Names are Case-Sensitive
No limitation of Numbers here.
One Main Advantage is Editing of ACL is Possible (i.e)
Removing a specific statement from the ACL is
possible.
(IOS version 11.2 or later allows Named ACL)
37
Standard Named Access List
Creation
Creationof
ofStandard
StandardNamed
NamedAccess
AccessList
List
Router(config)#
Router(config)#ip
ipaccess-list
access-liststandard
standard<name>
<name>
Router(config-std-nacl)#
Router(config-std-nacl)#<permit/deny>
<permit/deny><source
<sourceaddress>
address>
<source
<sourcewildcard
wildcardmask>
mask>
Implementation
Implementationof
ofStandard
StandardNamed
NamedAccess
AccessList
List
Router(config)#interface
Router(config)#interface<interface
<interfacetype><interface
type><interfaceno>
no>
Router(config-if)#ip
Router(config-if)#ipaccess-group
access-group<name>
<name><out/in>
<out/in>
38
Extended Named Access List
Creation
Creationof
ofExtended
ExtendedNamed
NamedAccess
AccessList
List
Router(config)#
Router(config)#ip
ipaccess-list
access-listextended
extended<name>
<name>
Router(config-ext-nacl)#
Router(config-ext-nacl)#<permit/deny>
<permit/deny><protocol>
<protocol>
<source
<sourceaddress>
address><source
<sourcewildcard
wildcardmask>
mask><destination
<destination
address>
address><
<destination
destinationwildcard
wildcardmask>
mask><operator>
<operator>
<service>
<service>
Implementation
Implementationof
ofExtended
ExtendedNamed
NamedAccess
AccessList
List
type><interfaceno>
no>
access-group<name>
<name><out/in>
<out/in>
39
40
Microsoft Windows 2000 [Version 5.00.2195]

(C) Copyright 1985-2000 Microsoft Corp.
telnet 192.168.1.150
C:\>
Connecting .....
================================
Welcome to Hyderabad Router
================================
User Access Verification
password : ****
Hyderabad> enable
password : ****
Hyderabad# show ip route
Gateway of last resort is not set
C
10.0.0.0/8 is directly connected, Serial0
R
11.0.0.0/8 [120/1] via 10.0.0.2, 00:00:25, Serial0
C
192.168.1.0/24 is directly connected, Ethernet0
R
192.168.2.0/24 [120/1] via 10.0.0.2, 00:00:25, Serial0
R
192.168.3.0/24 [120/2] via 10.0.0.2, 00:00:25, Serial0
Hyderabad#
41

telnet 192.168.2.150
C:\>
Connecting .....
================================
Welcome to Chennai Router
================================
password : ****
Chennai> enable
password : ****
Chennai# show ip route
C
C
R
192.168.1.0/24 [120/1] via 10.0.0.1, 00:00:01, Serial1
C
R
192.168.3.0/24 [120/1] via 11.0.0.2, 00:00:12, Serial0
Chennai#
42

telnet 192.168.3.150
C:\>
Connecting .....
================================
Welcome to Banglore Router
================================
password : ****
Banglore> enable
password : ****
Banglore# show ip route
R
10.0.0.0/8 [120/1] via 11.0.0.1, 00:00:04, Serial1
C
R
192.168.1.0/24 [120/2] via 11.0.0.1, 00:00:04, Serial1
R
192.168.2.0/24 [120/1] via 11.0.0.1, 00:00:04, Serial1
C
Banglore#
43

telnet 192.168.2.150
C:\>
Connecting .....
================================
Welcome to Chennai Router
================================
password : ****
Chennai> enable
password : ****
Chennai# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Chennai(config)# interface serial 1
Chennai(config-if)# ip address 10.0.0.2 255.0.0.0
Chennai(config-if)# no shut
Chennai(config-if)# encapsulation hdlc
Chennai(config-if)# interface serial 0
Chennai(config-if)# ip address 11.0.0.1 255.0.0.0
Chennai(config-if)# no shut
Chennai(config-if)# encapsulation hdlc
44

Chennai(config)# access-list 1 deny 192.168.1.1 0.0.0.0
Chennai(config)# access-list 1 permit any
Creation
of
Access
Creation
ofStandard
Standard
AccessList
List
Chennai(config)# interface
ethernet
0
Router(config)#
access-list
Chennai(config-if)#
Router(config)#
ip access-group
access-list1 <acl
out
<acl no>
no> <permit/deny>
<permit/deny>
<source
<sourceaddress>
address><source
<sourcewildcard
wildcardmask>
mask>
Chennai(config-if)#
Implementation
Implementationof
ofStandard
StandardAccess
AccessList
List
type><interfaceno>
no>
access-group<number>
<number><out/in>
<out/in>
45

Chennai(config)# interface ethernet 0
Chennai(config-if)# ip access-group 1 out
Chennai(config-if)# ^Z
Chennai# show ip access-list
Standard IP access list 1
deny
192.168.1.1
deny
192.168.1.2
permit any
Chennai#
46
Chennai# show ip int e0

Ethernet0 is up, line protocol is up
Internet address is 192.168.2.150/24
Broadcast address is 255.255.255.255
Address determined by non-volatile memory
MTU is 1500 bytes
Helper address is not set
Directed broadcast forwarding is enabled
Multicast reserved groups joined: 224.0.0.9
Outgoing access list is 1
Inbound access list is not set
Proxy ARP is enabled
Security level is default
Split horizon is enabled
ICMP redirects are always sent
ICMP unreachables are always sent
ICMP mask replies are never sent
IP fast switching is enabled
IP fast switching on the same interface is disabled
IP multicast fast switching is disabled
Router Discovery is disabled
IP output packet accounting is disabled
IP access violation accounting is disabled
TCP/IP header compression is disabled
Probe proxy name replies are disabled
Gateway Discovery is disabled
Policy routing is disabled
Network address translation is disabled
Chennai#
47

Chennai(config-if)# ip access-group 5 out
Standard
deny
deny
permit
Chennai#
IP access list 5
192.168.1.1
192.168.3.0
any
48

MTU is 1500 bytes
Outgoing access list is 5
Inbound access list is not set
Chennai#
49

Creation
of
Access
Creation
ofStandard
Standard
AccessList
List
Chennai(config)# interface
ethernet
0
Router(config)#
access-list
Chennai(config-if)#
Router(config)#
ip access-group
access-list5 <acl
out
<acl no>
no> <permit/deny>
<permit/deny>
<source
<sourceaddress>
address><source
<sourcewildcard
wildcardmask>
mask>
Chennai(config-if)#
Implementation
Implementationof
ofStandard
StandardAccess
AccessList
List
type><interfaceno>
no>
<number><out/in>
<out/in>
50

Chennai(config)# access-list 101 deny tcp 192.168.2.0
0.0.0.255 192.168.3.1 0.0.0.0 eq 80
Chennai(config)# access-list
101 Extended
permit ip any any
Creation
Creationof
of ExtendedAccess
AccessList
List
Router(config)#
access-list
<acl
no>
Router(config)#
access-list101
<acl
no> <permit/deny>
<permit/deny>
Chennai(config-if)#
ip
access-group
in
<protocol>
<source
address>
<source
wildcard
mask>
<protocol>
<source
address>
<source
wildcard
mask>
Chennai(config-if)#
<destination
<destination address>
address> <
< destination
destination wildcard
wildcard mask>
mask>
<operator>
<service>
Implementation
<operator>
<service> of
Implementation
ofExtended
ExtendedAccess
AccessList
List
type><interfaceno>
no>
<number><out/in>
<out/in>
51

Chennai(config)# access-list 101 deny tcp 192.168.2.0
0.0.0.255 192.168.3.1 0.0.0.0 eq 80
Chennai(config)# access-list 101 permit ip any any
Chennai(config-if)# ip access-group 101 in
Extended IP access list 101
deny
tcp 192.168.2.0 0.0.0.255 host 192.168.3.1 eq www
permit ip any any
Chennai#
52

MTU is 1500 bytes
Outgoing access list is not set
Inbound access list is 101
Chennai#
53

Accesscontrollist

Hochgeladen von

Dokumentinformationen

Originaltitel

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

Accesscontrollist

Hochgeladen von

Copyright:

Verfügbare Formate

1

Rules of Access List

Standard ACL - Network Diagram

How Standard ACL Works ?

How Standard ACL Works ?

access-list 1 deny 192.168.1.1 0.0.0.0

How Standard ACL Works ?

access-list 1 deny 192.168.1.1 0.0.0.0

How Standard ACL Works ?

How Standard ACL Works ?

access-list 1 deny 192.168.1.1 0.0.0.0

access-list 1 deny 192.168.1.2 0.0.0.0

How Standard ACL Works ?

access-list 1 deny 192.168.1.1 0.0.0.0

access-list 1 permit any

How Standard ACL Works ?

access-list 1 deny 192.168.1.1 0.0.0.0

access-list 1 deny 192.168.1.1 0.0.0.0

Standard ACL - Network Diagram

How Standard ACL Works ?

How Standard ACL Works ?

access-list 5 deny 192.168.1.1 0.0.0.0

How Standard ACL Works ?

access-list 5 deny 192.168.1.1 0.0.0.0

How Standard ACL Works ?

How Standard ACL Works ?

access-list 5 deny 192.168.1.1 0.0.0.0

access-list 5 deny 192.168.3.0 0.0.0.255

How Standard ACL Works ?

access-list 5 deny 192.168.1.1 0.0.0.0

How Standard ACL Works ?

access-list 5 deny 192.168.1.1 0.0.0.0

access-list 5 deny 192.168.1.1 0.0.0.0

How Standard ACL Works ?

How Standard ACL Works ?

access-list 5 deny 192.168.1.1 0.0.0.0

access-list 5 deny 192.168.3.0 0.0.0.255

How Standard ACL Works ?

access-list 5 deny 192.168.1.1 0.0.0.0

How Standard ACL Works ?

access-list 5 deny 192.168.1.1 0.0.0.0

Extended ACL - Network Diagram

How Extended ACL Works ?

How Extended ACL Works ?

access-list 101 deny tcp 192.168.2.0 0.0.0.255 192.168.3.1 0.0.0.0 eq 80

How Extended ACL Works ?

access-list 101 deny tcp 192.168.2.0 0.0.0.255 192.168.3.1 0.0.0.0 eq 80

How Extended ACL Works ?

How Extended ACL Works ?

access-list 101 deny tcp 192.168.2.0 0.0.0.255 192.168.3.1 0.0.0.0 eq 80

How Extended ACL Works ?

access-list 101 deny tcp 192.168.2.0 0.0.0.255 192.168.3.1 0.0.0.0 eq 80

How Extended ACL Works ?

access-list 101 deny tcp 192.168.2.0 0.0.0.255 192.168.3.1 0.0.0.0 eq 80

How Extended ACL Works ?

How Extended ACL Works ?

access-list 101 deny tcp 192.168.2.0 0.0.0.255 192.168.3.1 0.0.0.0 eq 80

How Extended ACL Works ?

access-list 101 deny tcp 192.168.2.0 0.0.0.255 192.168.3.1 0.0.0.0 eq 80

How Extended ACL Works ?

access-list 101 deny tcp 192.168.2.0 0.0.0.255 192.168.3.1 0.0.0.0 eq 80

Named Access List

Standard Named Access List