Access Control Lists (ACL) Flashcards
What are ACLS ?
Access Control Lists
They control what devices have access to which parts of the network. They instruct the router to permit or discard specific traffic. ACLS can filter traffic based on source IP address, destination IP address, protocol type, and port numbers etc. They are made up of one ore more Access Control Entries.
Where are ACLs configured ?
Global Config mode on the router and must be applied top an interface. They are applied inbound or outbound.
Does the order of Access Control Entries (ACE) in the ACLs matter?
Yes, they are checked from top to bottom. If a condition is met, the router takes the action in the ACE, the other entries are ignored.
How many ACLs are allowed on one interface ?
A maximum of one ACL can be applied to a single interface per direction (one inbound, one outbound). If you apply more than one, the next ACL will replace the previous.
What happens if a packet doesn’t match any condition in the ACEs ?
It is implicitly denied. There is an implicit deny at the end of every ACL.
What are the 2 main types of ACLs ?
Standard ACLS (Match on Source IP only)
* Standard Numbered ACLs
* Standard Named ACLs
Extended ACLs (Match on Source/Dest IP, Source/Dest port, etc)
* Extended Numbered ACLs
* Extended Named ACLs
What numbered range can Standard ACLs use ?
1-99 and 1300-1999
What numbered range can Extended ACLs use ?
100-199 and 2000-2699
What command is used to configure a standard numbered ACL ?
for network:
R1(config)# access-list [number] {deny | permit} [IP] [wildcard-mask]
for specific host:
R1(config)# access-list [number] {deny | permit} host [IP]
or
R1(config)# access-list [number] {deny | permit} [host IP]
how to add a description to an ACL ?
using a remark
R1(config)# access-list [number] remark [description]
Command to view your ACLs ?
R1(config)# do show access-lists
Command to apply your ACLs to an interface ?
R1(config)# ip access-group [number] {in | out}
What command is used to configure a standard named ACL ?
R1(config)# ip access-list standard [ACL-name]
R1(config-std-nacl)# [entry-number] {deny | permit} [IP] [wildcard-mask]
If you want to delete a specific ACE in an ACL how do you do it ?
Use named ACL config mode
R1(config-std-nacl)# no [ACE number]
If you dont use named ACL config mode you’ll end up deleting the entire ACL and having to recreate it.
How to add a new entry to an ACL ?
Use named ACL config mode
R1(config-std-nacl)# [ACE number] [ACE]
Can only be done in named ACL config mode.
How to re-sequence an ACL ?
R1(config)# ip access-list resequence [ACL ID] [starting sequence number] [increment]
It changes the starting sequence number and the amount each consecutive entry is incremented by
How to configure a layer 4 protocol/port, source and destination address ?
numbered:
R1(config)# access-list [number] [permit | deny] [protocol] [src-ip] [dest-ip]
named:
R1(config)# ip access-list extended [name]
R1(config-ext-nacl)# [seq-number] [permit | deny] [protocol] [src-ip] [dest-ip]
What extended ACL entry would allow all traffic ?
R1(config-ext-nacl)# permit ip any any
How to specify port numbers in and extended ACL ?
R1(config-ext-nacl)# [permit | deny] [protocol] [src-ip] [eq | gt | lt | neq | range] [src-port-num] [dest-ip]
eq = equal
gt = greater than
lt = less than
neq = not equal
range = range
