Configuring and
Troubleshooting
ACLs
Access Control Lists
[Link]
ICND1 v1.01-1
Testing Packets with
Numbered Standard IPv4 ACLs
[Link]
ICND1 v1.01-2
Numbered Standard IPv4 ACL
Configuration
RouterX(config)#
access-list access-list-number
|access-list-number.
deny | remark} source
{permit
Uses 1 to 99 for the
[mask]
The first entry is assigned a sequence number of 10, and successive entries
are incremented by 10.
Default wildcard mask is [Link] (only standard ACL).
no access-list access-list-number removes the entire ACL.
remark lets you add a description to the ACL.
RouterX(config-if)#
ip access-group access-list Activates the list on an interface.
number {in | out}
Sets inbound or outbound testing.
no ip access-group access-list-number {in | out} removes the ACL from the interface.
[Link]
ICND1 v1.01-3
Numbered Standard IPv4 ACL
Example 1
RouterX(config)# access-list 1 permit [Link]
(implicit deny all - not visible in the list)
(access-list 1 deny [Link]
[Link])
RouterX(config)# interface ethernet
RouterX(config-if)# ip access-group
RouterX(config)# interface ethernet
RouterX(config-if)# ip access-group
[Link]
0
1 out
1
1 out
Permit my network only
[Link]
ICND1 v1.01-4
Numbered Standard IPv4 ACL
Example 2
RouterX(config)# access-list 1 deny [Link] [Link]
RouterX(config)# access-list 1 permit [Link] [Link]
(implicit deny all)
(access-list 1 deny [Link]
[Link])
RouterX(config)# interface ethernet 0
RouterX(config-if)# ip access-group 1 out
Deny a specific host
[Link]
ICND1 v1.01-5
Numbered Standard IPv4 ACL
Example 3
RouterX(config)# access-list 1 deny [Link]
RouterX(config)# access-list 1 permit any
(implicit deny all)
(access-list 1 deny [Link]
[Link])
[Link]
RouterX(config)# interface ethernet 0
RouterX(config-if)# ip access-group 1 out
Deny a specific subnet
[Link]
ICND1 v1.01-6
Standard ACLs to Control vty Access
RouterX(config-line)#
access-class access-list-number {in |
Restricts incoming or outgoing connections between a particular
vty and the addresses in an ACL
Example:
access-list 12 permit [Link] 0.0
(implicit deny any)
!
vtyhosts
0 in4 network [Link] [Link] to connect
line
Permits only
to the router vty lines
access-class 12 in
[Link]
ICND1 v1.01-7
Testing Packets with
Numbered Extended IPv4 ACLs
[Link]
ICND1 v1.01-8
Numbered Extended IPv4 ACL
Configuration
RouterX(config)#
access-list access-list-number
{permit | deny}
protocol source source-wildcard
Sets parameters for this list entry
[operator port]
destination destination-wildcard
RouterX(config-if)#
[operator
port] access-listip access-group
[established]
Activates the extended list[log]
on an interface
number
{in | out}
[Link]
ICND1 v1.01-9
Numbered Extended IPv4 ACL
Example 1
RouterX(config)# access-list 101
RouterX(config)# access-list 101
RouterX(config)# access-list 101
(implicit deny all)
(access-list 101 deny ip [Link]
deny tcp [Link] [Link] [Link] [Link] eq 21
deny tcp [Link] [Link] [Link] [Link] eq 20
permit ip any any
[Link] [Link] [Link])
RouterX(config)# interface ethernet 0
RouterX(config-if)# ip access-group 101 out
Deny FTP traffic from subnet [Link] to subnet [Link] out E0
Permit all other traffic
[Link]
ICND1 v1.01-10
Numbered Extended IPv4 ACL
Example 2
RouterX(config)# access-list 101 deny tcp [Link]
RouterX(config)# access-list 101 permit ip any any
(implicit deny all)
[Link]
any eq 23
RouterX(config)# interface ethernet 0
RouterX(config-if)# ip access-group 101 out
Deny only Telnet traffic from subnet [Link] out E0
Permit all other traffic
[Link]
ICND1 v1.01-11
Named IP ACL Configuration
RouterX(config)#
ip access-list {standard | extended} name
Alphanumeric name string must be unique
RouterX(config {std- | ext-}nacl)#
[sequence-number] {permit | deny} {ip access list test conditions}
{permit | deny} {ip access list test conditions}
If not configured, sequence numbers are generated automatically starting at 10 and
incrementing by 10
no sequence number removes the specific test from the named ACL
RouterX(config-if)#
ip access-group name {in | out}
Activates the named IP ACL on an interface
[Link]
ICND1 v1.01-12
Named Standard IPv4 ACL Example
RouterX(config)#ip access-list standard troublemaker
RouterX(config-std-nacl)#deny host [Link]
RouterX(config-std-nacl)#permit [Link] [Link]
RouterX(config-std-nacl)#interface e0
RouterX(config-if)#ip access-group troublemaker out
Deny a specific host
[Link]
ICND1 v1.01-13
Named Extended IPv4 ACL Example
RouterX(config)#ip access-list extended badgroup
RouterX(config-ext-nacl)#deny tcp [Link] [Link] any eq 23
RouterX(config-ext-nacl)#permit ip any any
RouterX(config-ext-nacl)#interface e0
RouterX(config-if)#ip access-group badgroup out
Deny Telnet from a specific subnet
[Link]
ICND1 v1.01-14
Commenting ACL Statements
RouterX(config)#
ip access-list {standard|extended} na
Creates a named ACL
RouterX(config {std- | ext-}nacl)#
remark remark
Creates a named ACL comment
Or
RouterX(config)#
access-list access-list-number remark
Creates a numbered ACL comment
[Link]
ICND1 v1.01-15
Monitoring ACL Statements
RouterX# show access-lists {access-list number|name}
RouterX# show access-lists
Standard IP access list SALES
10 deny
[Link], wildcard bits
20 permit [Link]
30 permit [Link]
40 permit [Link]
Extended IP access list ENG
10 permit tcp host [Link] any
20 permit tcp host [Link] any
30 permit tcp host [Link] any
[Link]
eq telnet (25 matches)
eq ftp
eq ftp-data
Displays all access lists
[Link]
ICND1 v1.01-16
Verifying ACLs
RouterX# show ip interfaces e0
Ethernet0 is up, line protocol is up
Internet address is [Link]/24
Broadcast address is [Link]
Address determined by setup command
MTU is 1500 bytes
Helper address is not set
Directed broadcast forwarding is disabled
Outgoing access list is not set
Inbound access list is 1
Proxy ARP is enabled
Security level is default
Split horizon is enabled
ICMP redirects are always sent
ICMP unreachables are always sent
ICMP mask replies are never sent
IP fast switching is enabled
IP fast switching on the same interface is disabled
IP Feature Fast switching turbo vector
IP multicast fast switching is enabled
IP multicast distributed fast switching is disabled
<text ommitted>
[Link]
ICND1 v1.01-17
Troubleshooting Common ACL Errors
Error 1: Host [Link] has no connectivity with [Link].
[Link]
ICND1 v1.01-18
Troubleshooting Common ACL Errors
(Cont.)
Error 2: The [Link] network cannot use TFTP to connect to
[Link].
[Link]
ICND1 v1.01-19
Troubleshooting Common ACL Errors
(Cont.)
Error 3: [Link] network can use Telnet to connect to [Link],
but this connection should not be allowed.
[Link]
ICND1 v1.01-20
Troubleshooting Common ACL Errors
(Cont.)
Error 4: Host [Link] can use Telnet to connect to [Link],
but this connection should not be allowed.
[Link]
ICND1 v1.01-21
Troubleshooting Common ACL Errors
(Cont.)
Error 5: Host [Link] can use Telnet to connect to [Link],
but this connection should not be allowed.
[Link]
ICND1 v1.01-22
Troubleshooting Common ACL Errors
(Cont.)
Error 6: Host [Link] can use Telnet to connect into router B,
but this connection should not be allowed.
[Link]
ICND1 v1.01-23
Visual Objective 6-1: Implementing
and Troubleshooting ACLs
WG Router s0/0/0 Router fa0/0 Switch
A
B
C
D
E
F
G
H
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
SwitchH
[Link]
ICND1 v1.01-24
Summary
Standard IPv4 ACLs allow you to filter based on source IP
address.
Extended ACLs allow you to filter based on source IP address,
destination IP address, protocol, and port number.
Named ACLs allow you to delete individual statements from
an ACL.
You can use the show access-lists and show ip interface
commands to troubleshoot common ACL configuration errors.
[Link]
ICND1 v1.01-25