Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CCNA > Chapter 31 - Basic IPv4 Access Control Lists > Flashcards

Chapter 31 - Basic IPv4 Access Control Lists Flashcards

1
Q

What are ACLs used for?

A
  • To match traffic based various headers and perform an action on them.
  • Some of those actions can be for:
    - Allowing and blocking certain traffic
    - Performing QoS
    - Performing NAT
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

True or False. ACLs are enabled per interface.

A
  • True. However, they are initially created in global config.
  • It must be enabled for the direction that the specified traffic will flow through the interface.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the different types of ACLs and their numbers where required?

A
  • Standard Numbered ACLs - 1-99
  • Extended Numbered ACLs - 100-199
  • Additional Standard Numbered ACLs - 1300-1999
  • Additional Extended Numbered ACLs - 2000-2699
  • Named ACLs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Features of Standard Numbered ACLs

A
  • Matching Source IP
  • ID with Number
  • Created from Global Commands (Can also be created from subcommands)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Features of Standard Named ACLs

A
  • Matching Source IP
  • ID with Name
  • Created from Subcommands
  • Can manually set the order of entries by entering the order number of the entry before the statement in Standard Named ACL config mode
  • Allows ACL editing so that individual lines can be deleted
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Features of Extended Numbered ACLs

A
  • Matching Source and Dest IP
  • Matching Source and Dest Port
  • ID with Number
  • Created from Global Commands (Can also be created from subcommands)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Features of Extended Named ACLs

A
  • Matching Source and Dest IP
  • Matching Source and Dest Port
  • ID with Name
  • Created from Subcommands
  • Allows ACL editing so that individual lines can be deleted
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

In an ACL, how does the router decide which rule to match a packet against?

A
  • Uses first-match logic
  • As soon as a packet matches one line of the ACL, the relevant action in that line is taken on that packet and the router stops looking through the ACL for that packet
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What happens to a packet that matches no statements of an ACL?

A
  • It is discarded
  • Once the router reaches the end of an ACL when checking a packet, there is an implied ‘deny all’ rule that matches any packets that have not already been matched.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the name for a statement in an ACL?

A

ACE (Access Control Entry)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

How do you match just a single IP address in an ACL statement?

A
  • Simply entering ‘access-list <number> <permit/deny> <ip>'</ip></number>
  • Entering ‘access-list <number> <permit/deny> host <ip>' in older versions of IOS</ip></number>
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What can you use to match multiple addresses in a given subnet in an ACL?

A

Wildcard masks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What keyword can you use in place of an IP address to match all traffic against an ACL statement?

A
  • ‘any’
  • ‘access-list <number> <permit/deny> any</number>
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How do you enable an ACL on an interface?

A

In interface config mode, use ‘ip access-group <ACL> <direction></direction></ACL>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Rules of thumb for ACLs

A
  • Standard ACLs should be placed as close to the destination as possible so as to not match traffic that you don’t mean to. However, Extended ACLs should be placed as close to the source as possible to avoid using as much bandwidth.
  • For standard ACLs, the traffic is matched against the source address. Because of this it needs to be enabled on the interface in the direction the traffic is flowing in.
  • ACL statements are matched sequentially so need to be placed in the correct order.
  • Place more specific statements early in the ACL.
  • Disable an ACL from the interface it is on using ‘no ip access-group’ before making changes to it. Then reenable once done.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How can you see information about IPv4 specific ACLs?

A
  • Use the ‘show ip access-lists’ command
  • The ‘show access-lists’ command will show all other lists (e.g. IPv6)
17
Q

How could you make a note about what an ACL statement does?

A

Use the ‘access-list <number> remark <remark>' command</remark></number>

18
Q

True or False. ACL statements apply to traffic generated by the router.

A

False.

19
Q

How can you see specifically what traffic is being caught by an ACL?

A

Use the ‘access-list <number> log' command</number>

20
Q

True or False. Wildcard masks used in ACLs can interleave 1s and 0s (0.255.255.0)

A

True unlike wildcard masks used for things such as OSPF.

21
Q

True or False. You can’t have multiple ACLs applied to a single interface in a single direction.

A

True. You can have one ACL for outbound and one ACL for inbound.

22
Q

What command do you use to configure a Standard Named ACL?

A

‘ip access-list standard <name>'</name>

This will put you into the config mode for this named ACL where you add the ACEs.

23
Q

How do you delete particular ACEs from ACLs?

A
  • Enter IP ACL config mode for the ACL you wish to edit
  • Enter ‘no’ and then the rest of the line you want to delete
    OR
  • For numbered ACLs use the ‘no <sequence>' command</sequence>
24
Q

What extra functionality did IP ACL sequence numbers bring in?

A
  • New configuration style for numbered ACLs - Allows numbered ACLs to be edited in a similar way to named ACLs such as:
    - Deleting single lines
    - Inserting new lnes by adding a sequence number at the beginning of a new ACE
25
Q

True or False. ‘show running-config’ lists ACEs with sequence numbers next to them.

A

False. However ‘show access-lists’ and ‘show <protocol> access-lists' do.</protocol>

26
Q

What is ACL resequencing?

A
  • Allows you to change the sequencing order of all current ACEs in an ACL.
  • Done using the ‘ip access-list resequence <name/number> <starting> <increment></increment></starting>
  • For example ‘ip access-list resequence 1 20 20’ would change all entries in ACL 1 so that they start at sequence number 20 and then increase by 20 for each next ACE.
27
Q

What are examples of IP Protocol field numbers that can be included when setting up ACL statements?

A
  • 1 - ICMP
  • 6 - TCP
  • 17 - UDP
  • 88 - EIGRP
  • 89 - OSPF

CCNA (50 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions