Our next topic of discussion, which ties into, therefore,
is access control lists,
access control list control, traffic passing through the router or to the router.
Locally generated traffic or traffic that you generate on the local router after creating an access control list is not affected by access control. List
access control less. Have the ability to either permit certain traffic or deny certain traffic
entries in the access control list. I read top to bottoms again sequentially, and the first matching entry is used.
An access control list once created has this last entry as an implicit deny any or deny all.
You should always remember this, even though this last deny any entry is not visible by default.
Now there are two types of access control lists,
standard and extended.
Let's go over standard First
standard access list can permit and deny traffic
Onley based on the source address
only based on the source address.
So once again, standard access list can permit traffic or deny traffic based on the source. I pee in the packet once it's matched against the access list entry
now with standard access Liz there to sub types, you have your old way of doing it, your standard access list and the new new way of doing it, which is the named standard access list
with the old way of doing and you simply typed in access list,
then a number between one and 99.
Then either the keyword permit or deny. Remember the straight line between permit and deny means, or
then the source network
and then the wild card for that network, which will work the same way as it did for E I, G R P and O SPF.
Or you could create a name the standard access list. Now the problem with regular standard access list was, What if I create an access? Well, let's say I couldn't access this access list. 10.
some network ends with some wild card, and then I create another entry in the same access this access list. 10. Permit or deny something,
and then, at some point I have 50 entries.
Now, let's say at some later date I wanted to delete entry number 49 so I went ahead and tighten no access list. 10. What would happen is I would blow away the whole access list. It would disappear. The router would read no access list 10
and not wait to read the rest of the entry and just get rid of that access list as a whole
so you would lose. All 50 entries
would named access list. If you type in I p access list standard and then give it a name, let's say See, CNN, you go into a sub configuration mood when your prom will change to configure named S C L O R N a. C l or sodium chloride. Now that's a joke.
Then you consider permit or deny a network,
address for that network and the wild card.
configuration mode, you can take away entries and add entries, and it won't delete the whole access list until and unless you goes, do the execute, the command No. I P access list standard and then the name.
Next, we have your extended access list, and you you can see the command for the extended access list is quite Lindy,
because extended access list can permit or deny traffic based on boots, the source address
and the destination address.
You create an extended access list. You see
in the old in the old fashioned In the old manner, you can simply say access list and then pick a number between 101 99 which tells the router that this is going to be an extended access list.
Then you either permit or deny your traffic.
Then there's the protocol field, where you even get to pick which protocol you're going to permit or deny.
Then the source Network
and the source wild card,
then the source port,
then the definition network and the destination while card and the destination port. So as you see extended access, this give you a lot more flexibility with what you can do
now. Extended access list also come in the named flavor of a ride.
You create a named extended access list.
You say I P access list extended and then give it a name. Let's say we say ccn again or Cisco.
Then it goes when you hit Enter your problem will change through the config and a C l prompt,
and from here you can add and delete entries without taking away the whole access list. So the rest of the fields are the same permit deny the protocol type source network, the source wild card and the sore sport than the destination network, the definition wild card and the destination port.
Now let's get our labs and see how this actually works before we get on our labs. One little tidbit left.
This is how you create access list.
To apply an access list, you actually have to go into an interface.
So on a router, I would love into our enter
And then the interface
I d which would be fast Ethernet 00 or serial 010 whatever it is,
and from under the interface,
you would do the command. I be
then the name or number,
and then the key words
in or out kind of ran out of space here.
So you would say I p access group
and then the name of the access group if we had named at CCN, eh? You put in c CNN or if you had decided to do a numbered access list, let's say 10 and then either inbound or outbound,
whether this access this is gonna be applied for inbound traffic or outbound traffic.
Now, let's go ahead and see how this works on our lab