Access control list
Type of ACL
- Standard acl numbered in range 1-99
- Simple and operate only on source address
- Extended acl numbered in range 100-199
-
Operate on a combination of
- Source address - Permit/deny a particular source ip
- Destination address - Permit/deny a particular dest ip
- Protocol - Permit/deny ip/tcp/udp/icmp
- Application - Permit/deny a particular port ie 80 (htttp)
- Named acl
- A more elegant standard/extended acl
The syntax of extended acl statement definition
Access-list <n> <permit|deny> <source ip> <ip mask>
Examples
- Router(config)# access-list 101 deny icmp 10.50.7.0 0.0.0.255 any
- extended format
- Router# show access-lists
- Router(config)# ip access-list extended 101
- a use of named format
- Router(config-ext-nacl)# permit tcp any any
- povolení spojení ze všech tcp source IP na všechny destination IP
- Router(config-ext-nacl)# no permit tcp any any
- zrušení předešlého pravidla
- Router(config)#no ip access-list extended 102 or no ip access-list standard 102
-
- smazání extended access-listu s cislem 102
- Router(config)#int fa0/0
-
- nastavení interface
- ip access-group 101 out
- nastavení pravidla 101 na vystup rozhraní fa0/0
Example: deny ping
- Router(config)# ip access-list extended 101
- a use of named format
- deny icmp 10.50.1.64 0.0.0.31 any echo pro síť 10.50.1.64 255.255.255.224
- permit icmp any any
- permit ip any any
PPP CHAP http://completenetworkingnotes.com/certification/ccna/configure_hdlc_ppp.htm
IPSEC http://www.cisco.com/en/US/docs/ios/12_1/security/configuration/guide/scdipsec.html#wp1001813
© 2010 Marmil (Martin Milička)
