Sie sind auf Seite 1von 128

Distance Vector vs.

Link State

Distance Vector ’ 

Link State

Distance Vector vs. Link State
Distance Vector Link State
ƥ Updates frequently ƥ Updates are event
ƥ Each router is
"aware" only of its ƥ Each router is
"aware" of all other
immediate neighbors routers in the "area"
ƥ Slow convergence ƥ Fast convergence
ƥ Prone to routing loops ƥ Less subject to
ƥ Easy to configure routing loops
ƥ More difficult to
configure ë
Comparison Continued
Distance Vector Link State
ÿ    ÿ    
ÿ    ÿ  
ÿ      ÿ  


Link State Routing

Link State




ëpen Shortest Path First (ëSPF)

ëSPF is an open standards routing protocol

This works by using the Dijkstra algorithm
ëSPF provides the following features:
Minimizes routing update traffic
Allows scalability (e.g. RIP is limited to 15 hops)
Has unlimited hop count
Supports VLSM/CIDR
Allows multi-vendor deployment (open standard)

Link State
 There are two types of Packets

ëSPF Hello

ƥ When router A starts it send Hello packet ƛ uses

ƥ Hello packets are received by all neighbors
ƥ B will write Aƞs name in its neighbor table
ƥ C also process the same way

uHellou Packets
ƥ Small frequently issued packets
ƥ Discover neighbours and negotiate "adjacencies"
ƥ Verify continued availability of adjacent neighbours
ƥ Hello packets and Link State Advertisements (LSAs) build
and maintain the topological database
ƥ Hello packets are addressed to

Link State Advertisement
An ëSPF data packet containing link state and routing
information that is shared among ëSPF routers

LSAs are shared only with routers with whom it has

formed adjacencies

LSA packets are used to update and maintain the

topology database.

Link State
 There are three type of tables

 Contain information about the neighbors
 Neighbor is a router which shares a link on same
 Another relationship is adjacency
 Not necessarily all neighbors
 LSA updates are only when adjacency is established

 Contain information about all network and path to
reach any network
 All LSAƞs are entered in to topology table
 When topology changes LSAƞs are generated and send
new LSAƞs
 ën topology table an algorithm is run to create a
shortest path, this algorithm is known as SPF or
dijkstra algorithm

 Routing ×able
 Also knows as forwarding database
 Generated when an algorithm is run on the topology
 Routing table for each router is unique

ëSPF ×erms
 Link  Backbone area
 Router ID  Internal routers
 Neighbours  Area Border Router
 Adjacency (ABR)
 ëSPF Area  Autonomous System
Boundary Router

A network or router interface assigned to a
given network
Link (interface) will have "state" information
associated with it
Status (up or down)
IP Address
Network type (e.g. Fast Ethernet)
Addresses of other routers attached to this
ëSPF ×erm: Link

A link is a network or router interface assigned to any given

×his link, or interface, will have state information associated
with it (up or down) as well as one or more IP addresses
ëSPF ×erm: Link State

Status of a link between two routers

Information is shared between directly connected routers.
×his information propagates throughout the network unchanged and
is also used to create a shortest path first (SPF) tree. c‰
Router ID
 The Router ID (RID) is an IP address used to identify the router

 Cisco chooses the Router ID by using the highest IP address of all

configured loopback interfaces

 If no loopback interfaces are configured with addresses, ëSPF will

choose the highest IP address of all active physical interfaces.

 You can manually assign the router ID.

 The RID interface MUST always be up, therefore loopbacks are


Neighbours are two or more routers that
have an interface on a common network
E.g. two routers connected on a serial link
E.g. several routers connected on a common
Ethernet or Frame relay network
Communication takes place between /
among neighbours
neighbours form "adjacencies"
A relationship between two routers that
permits the direct exchange of route
Not all neighbours will form adjacencies
This is done for reasons of efficiency ƛ more

ëSPF Design

Ôach router connects to the backbone called area 0, or the backbone area.

Routers that connect other areas to the backbone within an AS are called Area Border Routers (ABRs). ëne
interface must be in area 0.

ëSPF runs inside an autonomous system, but can also connect multiple autonomous systems together. ×he
router that connects these ASes together is called an Autonomous System Boundary Router (ASBR). ëè
ëSPF Areas
An ëSPF area is a grouping of contiguous networks and
Share a common Y eY 
A router can be a member of more than one area (area
border router)
All routers in the same area have the same topology
When multiple areas exist, there must always be an area
0 (the backbone) to which other areas connect

 hy areas?
Decreases routing overhead
 Compare to multiple smaller broadcast domains
instead of one large one

Speeds convergence

Confines network instability (e.g. route "flapping") to

single area of the network

Adds considerably to the complexity of setting up ëSPF

 CCNA certification deals only with single-area ëSPF
Area ×erminology

LSAƍs in Area
ƥ LSAs communicate with adjacent routers in the same
ëSPF area

ƥ Subsequently, a change in a link state is "flooded" to all

area routers via LSAs

ƥ In larger networks, multiple areas may be created

ƛ LSAs are sent only to adjacent routers in the same
ƛ "Area border routers" connect areas, passing
summarized route information between

Path Calculation
 Changes to the topological database of a router trigger a
recalculation to re-establish the best route(s) to known
Uses the SPF (shortest path first) algorithm developed
by a computer scientist named Dijkstra
This is done by each individual router using its
detailed "knowledge" of the whole network
Leads to rapid and accurate convergence
Based on detailed knowledge of every link in the area
and the ëSPF "cost" of each
builds an ë  t ee with itself at the route
×erminology: Cost
ƥ Various criteria can be selected by
the administrator to determine the
ƥ Usually,
ëSPF cost=108/bandwidth

Do not forget to
configure the
command on serial
links to ensure
default ëSPF cost

Pros and Cons
 Note that ëSPF is a more sophisticated routing protocol
Converges rapidly and accurately
Can use a metric calculation that effectively selects
the "best" route(s) primarily based on bandwidth,
although an ëSPF cost can be administratively
 Use of ëSPF requires
More powerful routing hardware
More detailed knowledge by the administrator,
especially when large multi-area networks are used

×ypes of åeighbors
ƥ ëSPF can be defined for three type of neighbors
ƛ Broadcast Multi Access (BMA) ex- Ethernet
ƛ Point to Point
ƛ Non-Broadcast Multi Access (NBMA)

ëSPF åetwork ×ypes

 Point to Point all routers form adjacencies
 BMA & NBMA one router is elected as DR
 DR establish adjacency with every neighbor router
 LSA updates are exchanged only to DR
 DR is the router which has highest priority
 All CISCë routers has priority 1
 If priority is same then router id is seen
 The RID is highest IP address of all interfaces

Point-to-Point Links

Usually a serial interface running either PPP

No DR or BDR election required
ëSPF autodetects this interface type
ëSPF packets are sent using multicast
All routers form adjacencies

Ñulti-access Broadcast åetwork

ƥ Generally LAN technologies like Ethernet and Token Ring

ƥ DR and BDR selection required
ƥ All neighbor routers form full adjacencies with the DR and
BDR only
ƥ Packets to the DR use
ƥ Packets from DR to all other routers use
Ôlecting the DR and BDR

Hello packets are exchanged via IP multicast.

The router with the highest priority is
selected as the DR.
If Priority is same then Router ID is seen
Use the ëSPF router ID as the tie breaker.
×erminology: DRs and BDRs
router (DR) is
responsible for
LSAs on
behalf of all
connected to
the same

DR Responsibility
When a router sees a new or changed link-state, it sends
an LSA to its DR using a particular multicast address

The DR then forwards the LSA to all the other routers

with whom it is adjacent
Minimizes the number of formal adjacencies that
must be formed and therefore the amount of LSU
(link state update) packet traffic in a multi-router

ëSPF Summary
 AD -100
 Hop count is unlimited
 Metric = Cost ƛ 108/BW
 Classless, VLSM
 Load balance up to SIX routers
 Require more processing power

Basic ëSPF Configuration
ess-id # that
 The number 1 in this example is a î ess-
begins an ëSPF process in the router
More than one process can be launched in a router,
but this is rarely necessary
Usually the same process-id is used throughout the
entire network, but this is not required
The process-id # can actually be any value from 1 to
"very large integerƠ
The process-id # cannot be ZERë
This is NëT the same as the AS# used in IGRP and

Configuring ëSPF Areas
 After identifying the ëSPF process, you need to identify the interfaces that
you want to activate ëSPF communications
Lab_A#config t
Lab_A(config)#router ospf 1
area ?
<0-4294967295> ëSPF area ID as a decimal value
A.B.C.D ëSPF area ID in IP address format
area 0
ƥ Every ëSPF network must have an area 0 (the backbone area) to which
other areas connect
So in a multiple area network, there must be an area 0
The wildcard mask represents the set of hosts supported by the
network and is really just the inverse of the subnet mask.
ëSPF Configuration
ƥ ëSPF Process ID number is irrelevant. It can be the same on every
router on the network
ƥ The arguments of the network command are the network number
( and the wildcard mask (
ƥ Wildcards - A 0 octet in the wildcard mask indicates that the
corresponding octet in the network must match exactly
ƥ A 255 indicates that you donƞt care what the corresponding octet is
in the network number
ƥ A network and wildcard mask combination of would
match only, and nothing else.
ƥ The network and wildcard mask combination of
would match anything in the rangeƛ1.1.255.255

ëSPF Configuration -1
S0 S

0.0.0. 0.0.0.
’ ’
S0 0.0.0.
0.0.0. 0.0.0.
0.0.0. 0


ëSPF Configuration -1
S0 S

0.0.0. 0.0.0.
’ ’
0.0.0. 0.0.0.
0.0.0. 0 0.0.0.

R1#config t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#router ospf 1
R1(config-router)#network area 0
R1(config-router)#network area 0

ëSPF Configuration -2
S0 S
00.0.0. 0
’ ’

00.0.0.  00.0.0.  

ëSPF Configuration -2
S0 S 00.0.0.
. . . ’ . . .
’ ’
S0 00.0.0. 00.0.0.
00.0.0. 0
. . . 
. . . 0 00.0.0. 00.0.0.

ëSPF Configuration -2
S0 S 00.0.0.
. . . ’ . . .
’ ’
00.0.0. 00.0.0.
00.0.0. 0
. . . 
. . . 0 00.0.0. 00.0.0.

R3#config t
R1#config t Enter configuration commands, one per line. End with CNTL/Z.
Enter configuration commands, one per line. End with CNTL/Z. R3(config)#router ospf 1
R1(config)#router ospf 1 R3(config-router)#network 200.0.0. 32 area 0
R1(config-router)#network area 0 R3(config-router)#network 200.0.0. 12 area 0
R1(config-router)#network 200.0.0. 8 area 0 R3(config-router)#^Z

ëSPF and Loopback Interfaces
Configuring loopback interfaces when using the ëSPF routing
protocol is important
Cisco suggests using them whenever you configure ëSPF on a
Loopback interfaces are logical interfaces, which are virtual,
software-only interfaces; they are not real router interfaces
Using loopback interfaces with your ëSPF configuration ensures that
an interface is always active for ëSPF processes.
The highest IP address on a router will become that routerƞs RID
The RID is used to advertise the routes as well as elect the DR and
If you configure serial interface of your router with highest IP
Address this Address becomes RID of t is the RID of the router
because e router
If this interface goes down, then a re-election must occur
It can have an big impact when the above link is flapping
Configuring Loopback Interfaces

R1#config t
Enter configuration commands, one per line. End
with CNTL/Z.
R1(config)#int loopback 0
R1(config-if)#ip address
R1(config-if)#no shut

Verifying ëSPF ëperation

ÿ Verifies the configured IP routing protocol

processes, parameters and statistics

ÿ Displays all OSPF routes learned by the router


ÿ Displays the OSPF router ID, area ID and

adjacency information ]!
Verifying ëSPF ëperation


ÿ Displays the OSPF router ID, timers, and statistics


ÿ Displays information about the OSPF neighbors,

including Designated ’outer (D’
and ackup
Designated ’outer ( D’
information on
broadcast networks
×he show ip route ospf

             ’! ’  ’! "  #  

$  $ ! %  & ’! &'  & ’! ( )  )!*
  )!*   &  )!* ( + 
&,  )!* ( + , &  & !   -  
. -,   ., /    


0101010 ,221,221,2210   , 
) 01,110 030 .  0145101, 000020 &0

×he show ip ospf interface

’       0

  01451013,5  0
!  %  ’  % 0145101 6 7 8+ $’)%8   0
8#  %+     %’)89&’ !  + 
 ’  % 0145101,   0145101,
$7 %
   % 0145101   0145101
8 # .  
 9 0 % 50 :  50 ’#  2
9   000005
  0145101, %

×he show ip ospf neighbor
’ $     

  % !  % 8 #  
014511  *<--3$%’ 0000= 014511 &0
01,11  *<--3 0000=> 01,11  0

show ip ospf neighbor detail

show ip ospf database

Setting Priority for DR Ôlection

    + p 

This interface configuration command assigns the ëSPF

priority to an interface.
Different interfaces on a router may be assigned different
The default priority is 1. The range is from 0 to 255.
0 means the router is a DRëTHER; it canƞt be the DR or

ƛ DV
ƛ LS
ƛ Easy to configure
ƛ Neighbor ƛ Incremental Updates
ƛ Advanced Metric ƛ Multicast
ƛ Periodic ƛ ëpen Standard
ƛ Broadcast

ƛ Hybrid
ƛ Topology Database
ƛ Rapid Convergence
ƛ Reliable

Enhanced Interior Gateway Routing Protocol (EIGRP) is a Cisco-

proprietary routing protocol based on Interior Gateway Routing Protocol

Released in 1994ü Unlike IGRP, which is a classful routing protocol,

EIGRP supports CIDR and VLSM.

it is probably one of the two most popular routing protocols in use


Compared to IGRP, EIGRP boasts faster convergence times, improved

scalability, and superior handling of routing loops.

EIGRP is often described as a hybrid routing protocol, offering the

best of distance vector and link-state algorithms. ]‰
Comparing ÔIGRP with IGRP

IGRP and EIGRP are compatible with each other.

EIGRP offers multiprotocol support, but IGRP does not.
Communication via Reliable Transport Protocol (RTP)
Best path selection via Diffusing Update Algorithm (DUAL)
Improved convergence time
Reduced network overhead

Introducing ÔIGRP

ÔIGRP supports:
 Rapid convergence
 Reduced bandwidth usage
 Multiple network-layer protocols
ÔIGRP ×ables
ƥ EIGRP maintains 3 tables

ƛ Neighbor table
ƛ Topology table
ƛ Routing table

åeighbor Discovery
    " #
X xS

l1 Ɗ B 
l2- Delay
Ñetric Calculation
 The metrics used by EIGRP in making routing decisions are (lower the metric the

 By default, EIGRP uses only:


x Yes:
Think of bY dwdth as the width of the pipe
deYy as the length of the pipe.

 Bandwidth is the carrying capacity

 Delay is the end-to-end travel time. Ú
åeighbor ×able
The neighbor table is the most important table in EIGRP

Stores address and interface of neighbor

×opology ×able


×opology ×able
The topology table is made up of all the EIGRP routing tables in the
autonomous system.

DUAL takes the information and calculates the lowest cost routes to each

By tracking this information, EIGRP routers can identify and switch to

alternate routes quickly.

The information that the router learns from the DUAL is used to determine
the successor route, which is the term used to identify the primary or best

Every EIGRP router maintains a topology table. All learned routes to a

destination are maintained in the topology table.
Routing ×ables
A successor is a route selected as the primary route to
use to reach a destination.
DUAL calculates Successor (Primary Route) and places it
in the routing table (and topology table)
Can have up to 4 successors of equal or unequal value
DUAL calculates Feasible Successor (Backup Route) and
places it in the Topology Table.
Promoted to successor if the route goes down if it has a
lower cost than current successor
If no FS in Table - Send query
Multiple feasible successors for a destination can be
retained in the topology table although it is not
ÔIGRP Concepts & ×erminology
 EIGRP routers that belong to different autonomous
systems (ASes) donƞt automatically share routing

 The only time EIGRP advertises its entire routing table is

when it discovers a new neighbor and forms an
adjacency with it through the exchange of Hello packets

 When this happens, both neighbors advertise their entire

routing tables to one another

 After each has learned its neighborƞs routes, only

changes to the routing table are propagated
Dist to =100 Dist to  ..00.0 =00



10Ñbps Ɗ 100
1,544Ñbps Ɗ 250
56lbps -1000

Dist to =350

Chennai receives an update from Mumbai with a cost of 100, which is Mumbai's cost to reach, This
cost is referred to as the reported distance (RD)
Bangalore will report its cost to reach Bangalore's RD is 350
Chennai will compute its cost to reach via Mumbai and Bangalore and compare the metrics for the two
Chennai's cost via Mumbai is 1100. Chennai's cost via Bangalore is 600. The lowest cost to reach a destination is
referred to as the feasible distance (FD) for that destination
Chennai's FD to is 600. The next-hop router in the lowest-cost path to the destination is referred to as
the successor. m!
A feasible successor is a path whose reported distance is less than the feasible distance, and it is considered a
backup route.
ÔIGRP ×erms
 Feasible distance (FD) - ×his is the lowest calculated metric to
reach destination. ×his is the route that you will find in the
routing table, because it is considered the best path

 Reported distance (RD) - ×he distance reported by an

adjacent neighbor to a specific destination.

 Interface information - ×he interface through which the

destination can be reached.

 Route status - ×he status of a route. Routes are identified as

being either passive, which means that the route is stable and
ready for use, or active, which means that the route is in the
process of being recomputed by DAL

ÔIGRP ×erminology and
 ess Current Route
 A successor is a route selected as the primary route to use to reach
a destination.
 Successors are the entries kept in the routing table.

be e

 w A backup route
 A feasible successor is a backup route.
 These routes are selected at the same time the successors are
identified, but they are kept in the topology table.
 Multiple feasible successors for a destination can be retained in the
topology table.

Reliable ×ransport Protocol (R×P)
 Used by EIGRP for its routing updates in place of TCP
 EIGRP can call on RTP to provide reliable or unreliable service
 EIGRP uses reliable service for route updates
 Unreliable for Hellos

 Reliable Transport Protocol (RTP) is a transport layer protocol that

guarantees ordered delivery of EIGRP packets to all neighbors.
 ën an IP network, hosts use TCP to sequence packets and ensure
their timely delivery. RIP uses UDP
 However, EIGRP is protocol-independent and does not rely on TCP/IP
to exchange routing information the way that RIP, IGRP, and ëSPF
 EIGRP uses RTP as its own proprietary transport layer protocol to
guarantee delivery of routing information.
 With RTP, EIGRP can multicast and unicast to different peers

Diffusing pdate Algorithm
 All route computations in EIGRP are handled by DUAL
 ëne of DUAL's tasks is maintaining a table of loop-free paths to
every destination.
 This table is referred to as the topology table
 DUAL saves all paths in the topology table
 The least-cost path(s) is copied from the topology table to the
routing table
 In the event of a failure, the topology table allows for very quick
convergence if another loop-free path is available
 If a loop-free path is not found in the topology table, a route
recomputation must occur
 DUAL queries its neighbors, who, in turn, may query their
neighbors, and so on...
 Hence the name "Diffusing" Update Algorithm
VLSÑ Support
ƥ EIGRP supports the use of Variable- Length Subnet

ƥ Can use 30-bit subnet masks for point-to-point networks

ƥ Because the subnet mask is propagated with every route

update, EIGRP also supports the use of discontiguous

ƥ Discontiguous network is the one that has two or more

subnetworks of a classful network connected together by
different classful networks

Discontiguous åetwork

EIGRP & IGRP Metric Calculation

Configuring ÔIGRP

 Y p

ÿ Defines IG’P as the IP routing protocol

   7 p p 

ÿ Selects participating attached networks

ÔIGRP Configuration Ô ample
ÔIGRP Configuration
S0 S 00.0.0.
. . . ’ . . .
’ ’
00.0.0. 00.0.0.
00.0.0. 0
. . . 
. . . 0 00.0.0. 00.0.0.

R3#config t
R1#config t Enter configuration commands, one per line. End with CNTL/Z.
Enter configuration commands, one per line. End with CNTL/Z. R3(config)#router eigrp 10
R1(config)#router eigrp 10 R3(config-router)#network 200.0.0. 32
R1(config-router)#network R3(config-router)#network 200.0.0. 12
R1(config-router)#network 200.0.0. 8 R3(config-router)#^Z

Verifying the ÔIGRP Configuration

  Ô $’ 



show ip eigrp topology

show ip eigrp topology

[active | pending | successors]

show ip eigrp topology

show ip eigrp traffic

Administrative Distances

 Getting information about remote device
 Can connect to remote device and configure a device
 Password must be set
R1(config)# line vty 0 4
Password cisco

Discovering åeighbors on the

€ 00 , isco Systems, Inc. xll rights reserved. 

Cisco Discovery Protocol

 CDP is a proprietary utility that gives you a summary of directly

connected switches, routers, and other Cisco devices.
 CDP discovers neighboring devices regardless of which protocol
suite they are running.
 Runs on the Data link layer
 Physical media must support the Subnetwork Access Protocol
(SNAP) encapsulation.
 ënly give directly connected device
 By default enabled, you can enable or disable
Discovering åeighbors with
 CDP runs on routers with Cisco IëS®
software Release 10.3 or later and on Cisco
 Show CDP ?
 Summary information
 Device ID
 Local Interface
 Port ID
 Capabilities list
 ¦  er s how ofen ¦  packes are ansed o
all acve nefaces.

’ " 
#&cdp timer 90

 ¦   e s e aun f e a e evce w

 packes receve fr negbr evces.
’ " 
#&cdp holdtime 0

sing CDP

sing the show cdp
neighbors Command

×he show cdp neighbor command (sh cdp nei for short) delivers
information about directly connected devices.
show cdp neighbor detail



sing the show cdp entry

×he show cdp entry * command displays the same information as the show cdp
neighbor details command.
Additional CDP Commands

×he show cdp traffic command displays information about

interface traffic, including the number of CDP packets sent and
received and the errors with CDP.
CDP Commands
 To disable the CDP on particular interface use
the "no cdp enable" command

 To disable CDP on the entire router use the "no

cdp run" in global configuration mode.

 Cisco Discovery Protocol is an information-gathering tool used
by network administrators to get information about directly
connected devices.

 CDP exchanges hardware and software device information

with its directly connected CDP neighbors.

 You can enable or disable CDP on a router as a whole or on a

port-by-port basis.

 The show cdp neighbors command displays information about

a routerƞs CDP neighbors.

 The show cdp entry, show cdp traffic, and show cdp interface
commands display detailed CDP information on a Cisco device.
 hy se Access Lists?

 Manage IP traffic as network access grows

 Filter packets as they pass through the router
 hat are ACLs?

ACLs are lists of conditions that are applied to traffic traveling across a
router's interface.

These lists tell the router what types of packets to accept or deny.

Acceptance and denial can be based on specified conditions.

ACLs can be configured at the router to control access to a network or


Some ACL decision points are source and destination addresses,

protocols, and upper-layer port numbers.

Reasons to Create ACLs

×he following are some of the primary reasons to create ACLs:

Limit network traffic and increase network performance.

Provide traffic flow control.
Provide a basic level of security for network access.
Decide which types of traffic are forwarded or blocked at the router
For example: Permit e-mail traffic to be routed, but block all telnet traffic.
If ACLs are not configured on the router, all packets passing through the
router will be allowed onto all parts of the network.

 Different access list for Telnet
 When configuring ISDN you need to use access list
 Implicit deny at bottom
 All restricted statements should be on first
 There are two types

c cc å c cc å
c cc

c c
å å å c c å
IP Packet

SRC IP Address
DÔS× IP Address
Protocol type
SRC Port
DÔS× Port

The first 2 bytes in the TCP/UDP header are the source port number
The next 2 bytes in the TCP/UDP header are the Destination port number
×ypes of Access Lists

Checks source address
Permits or denies entire protocol suite
Checks source and destination address
Generally permits or denies specific protocols
How to Identify Access Lists

 Standard IP lists (1-99) test conditions of all IP packets from

source addresses.
 Extended IP lists (100-199) test conditions of source and destination
addresses, specific TCP/IP protocols, and destination ports.
 Standard IP lists (1300-1999) (expanded range).
 Extended IP lists (2000-2699) (expanded range).
Standard ACLs

The full syntax of the standard ACL command is:

Router(config)#access-list Y essw
w be de y | pe
o  e
o  ewd Yd ]

The no form of this command is used to remove a standard ACL. This is

the syntax:
Router(config)#no access-list Y e

w be

Config# Access-list 1 deny

Config# access-list 1 permit any

 ildcard Ñask
Access-list 99 permit wildcard mask
All 32 bits of an IP Address can be filtered
 ildcard inverse mask
0=must match
1= ignore
!%!%!%!" # c‰ë%cÚ[%c%c
!%!%!%ë]] c‰ë%cÚ[%c%!ë]]
!%!%ë]]%ë]] c‰ë%cÚ[%!ë]]%!ë]]
!%ë]]%ë]]%ë]] c‰ë%!ë]]%!ë]]%!ë]]
ë]]%ë]]%ë]]%ë]] !ë]]%!ë]]%!ë]]%!ë]]" # c!m
×he Aå and HëS× keyword
Access-list 1 permit
permit any

Access-list 1 permit

permit host

×esting Packets with
Standard Access Lists
ëutbound ACL ëperation

ÿ If no access list statement matches, then discard the packet.

Reading an ACL
 First Hit or Best Fit?
1. Access-list 99 deny host
access-list 99 permit any

2. Access-list 99 permit

Access-list 99 deny host
access-list 99 permit any

3. Access-list 99 deny host

 Implicit deny at the end of every ACL

Creating ACLs
ACLs are created in the global configuration mode. There are many
different types of ACLs including standard, extended, IPX, AppleTalk, and
others. When configuring ACLs on a router, each ACL must be uniquely
identified by assigning a number to it. This number identifies the type of
access list created and must fall within the specific range of numbers that
is valid for that type of list.

Since IP is by far the most

popular routed protocol,
addition ACL numbers have
been added to newer router
Standard IP: 1300-1999
Ô tended IP: 2000-2699

The ip access-group command

Rin 'out (

Ô ercise Ɗ Standard Access List
0 S0 S S0 0
x S0

Account should be denied access to Sales

To steps to configure
ƥCreate a standard Access list
ƥApply ACL to proper interface inbound or outbound

Ô ercise Ɗ Standard Access List
0 S0 S S0 0
x S0

Config# Access-list 1 deny

Config# access-list 1 permit any

Config#int e 0
Config-if# ip access-group 1 out
Ô tended ACLs
Extended ACLs are used more often than standard ACLs because they provide a
greater range of control.

Extended ACLs check the source and destination packet addresses as well as being
able to check for protocols and port numbers.

At the end of the extended ACL statement, additional precision is gained from a
field that specifies the optional Transmission Control Protocol (TCP) or User
Datagram Protocol (UDP) port number.

Logical operations may be specified such as, equal (eq), not equal (neq), greater
than (gt), and less than (lt), that the extended ACL will perform on specific

Extended ACLs use an access-list-number in the range 100 to 199 (also from 2000
to 2699 in recent IëS).
ÿ x&R ) (
ÿ  *
ÿ  *
ÿ Protocol
Å  ’       
Å Ô $’
ÿ Operator


×esting Packets with
Ô tended Access Lists
Ô tended ACL Synta

Ô tended ACL LAB

Fa00 Fa0

 Account should be denied Sales Web site

Config# Access-list 100 deny tcp eq www
Config# access-list 100 permit IP any any

Config#int Fastethernet 0/0

Config-if# ip access-group 100 Iå
Ô tended ACL LAB -2
S0 S0
S0 0 0
x should be denied F×P of should be denied website of

ën Router R1 ën Router R3
Config# Access-list 100 deny tcp Config# Access-list 100 deny tcp 192.168. 0.18 eq 21 eq 80
Config# access-list 100 permit IP any any Config# access-list 100 permit IP any any

Config#int s0 Config#int s0
Config-if# ip access-group 100 IN Config-if# ip access-group 100 IN
Deny F×P
access-list 101 deny tcp any any eq 21

access-list 101 permit ip any any


access-list 101 deny tcp any any eq ftp

access-list 101 permit ip any any

 For extended access list apply near to the
 For standard access list apply near to the

åamed ACLs
IP named ACLs were introduced in Cisco IëS Software Release 11.2,
allowing standard and extended ACLs to be given names instead of

The characteristics of named accesslist:

 Identify an ACL using an alphanumeric name.
 You can delete individual statements in a named access list
 Named access lists must be specified as standard or extended
 You can use the ip access-list command to create named
access lists.

Named ACLs are not compatible with Cisco IëS releases prior to Release

The same name may not be used for multiple ACLs.

åamed ACLƍs
 Numbered Access list did not give you any hint, What is

 Named ACLƞs are both basic and advanced filtering tool

 Name cannot start with a number or !

 Cannot have space in the name

 Should not have ? Character anywhere in the name

 Name is case sensitive

åamed ACL Ô ample
##ip access-list standard blocksales
ÿ ’c" 
 #& cmë%cÚ%!%!!%!%!%ë]]
ÿ ’c" 
ÿ ’c" 
ÿ ’c" 
ÿ ’c&

#Int e 0
#Ip access-group blocksales out

Verify Access List

Basic Rules for ACLs
 Standard IP access lists should be applied closest to the destination.
 Extended IP access lists should be applied closest to the source.
 Use the inbound or outbound interface reference as if looking at the port
from inside the router.
 Statements are processed sequentially from the top of list to the bottom
until a match is found, if no match is found then the packet is denied.
 There is an implicit deny at the end of all access lists. This will not appear
in the configuration listing.
 Access list entries should filter in the order from specific to general.
Specific hosts should be denied first, and groups or general filters should
come last.
 Never work with an access list that is actively applied.
 New lines are always added to the end of the access list.
 A no access-list x command will remove the whole list. It is not possible
to selectively add and remove lines with numbered ACLs.
 ëutbound filters do not affect traffic originating from the local router.