Volume 2 - Chapter 7: Named and Extended IP ACLs

Question 1

What is the command to configure a named access-list?

Answer 1

ip access-list standard/extended name

Question 2

What are the 3 rules for naming an access-list?

Answer 2

An named ACL can be created with a name that matches the following:
* Name must begin with an alphabetic character
* Name cannot use spaces or quotations
* Names are case sensitive

Question 3

What are the 2 ways that an ACE entry can be removed from a named ACL?

Answer 3

By entering “no”, followed by the entire ACE entry:
* no deny 10.1.2.0 0.0.0.255

By entering “no”, followed by the ACE (sequence) number:
* no 20

Question 4

What commands are required to modify an ACL with the name “Eric” and insert a new ACE into sequence 40 to deny the entire 192.168.192.0 /24 subnet?

Answer 4

ip access-list extended Eric

40 deny 192.168.192.0 0.0.0.255

Question 5

What is the steps required to remove an ACE entry from a numbered ACL with a sequence of 25?

Answer 5

1. Run the command “show access-lists number”
2. Find the sequence number that was automatically created by IOS
3. Enter in the ACL configuration mode “ip access-list standard number
4. Delete the ACE “no sequencenumber

Question 6

What are the minimum required fields for an extended ACE?

Answer 6

permit/deny protocol sourceIP destinationIP

For example:

permit tcp 192.168.1.0 0.0.0.255

Question 7

Describe how extended ACLs differ from standard ACLs when matching a single IP address?

Answer 7

Extended ACLs must use one of the following:
* permit ip address 0.0.0.0
* permit ip host address

Standard ACLs support the methods above, but also support just listing the single address without the host or wildcard:
* permit address

Question 8

What are the options available for matching an application port in an extended ACL?

Answer 8

eq (equals)
ne (not equals)
lt (less than)
gt (greater than)
range (a range of values)

Question 9

When creating an extended ACL, what is the command to identify FTP data as the application port to match?

Answer 9

eq ftp-data

Port 20/TCP

Question 10

When creating an extended ACL, what is the command to identify FTP control as the application port to match?

Answer 10

eq ftp

Port 21/TCP

Question 11

When creating an extended ACL, what is the command to identify telnet as the application port to match?

Answer 11

eq telnet

Port 23/TCP

Question 12

When creating an extended ACL, what is the command to identify DNS as the application port to match?

Answer 12

eq domain

Port 53/UDP

Question 13

When creating an extended ACL, what is the command to identify a DHCP server as the application port to match?

Answer 13

eq bootps

Port 67/UDP

Question 14

When creating an extended ACL, what is the command to identify a DHCP client as the application port to match?

Answer 14

eq bootpc

Port 68/UDP

Question 15

When creating an extended ACL, what is the command to identify TFTP as the application port to match?

Answer 15

eq tftp

Port 69/UDP

Question 16

When creating an extended ACL, what is the command to identify SNMP as the application port to match?

Answer 16

eq tftp

Port 161/UDP

Question 17

When creating an extended ACL, what is the command to identify SMTP as the application port to match?

Answer 17

eq smtp

Port 25/TCP

Question 18

When creating an extended ACL, what is the command to identify HTTP as the application port to match?

Answer 18

eq www

Port 80/TCP

Question 19

When creating an extended ACL, what is the command to identify HTTPS as the application port to match?

Answer 19

There is not keyword in IOS currently that supports this. In order to match HTTPs you would have to configure TCP and port 443 manually. For example:

permit tcp any 192.168.0.0 0.0.255.255 eq 443

Question 20

When creating an extended ACL, what is the command to identify POP3 as the application port to match?

Answer 20

eq pop3

Port 110/TCP

Question 21

A network engineer enters the following command into the router:

permit tcp any any eq 80

What will be displayed when the engineer prints the current running configuration using “show run”

Answer 21

Since port 80/TCP has a keyword, it will be automatically corrected to the following:

permit tcp any any eq www

Question 22

What option can be configured at the end of an extended ACE to add a log entry when it is matched by a packet?

Answer 22

log

For example:

access-list 150 deny ip any any log

Question 23

In order to match a source or destination port in an extended ACL, what options must be configured for the transport protocol?

Answer 23

Either TCP or UDP, for example:

permit tcp any any eq www
permit udp any any eq domain

permit ip any any eq smtp This will not work

Question 24

In terms of ACL placement within the network. Where are ACLs recommended to be configured?

Answer 24

Extended ACLs should be as close to the source as possible to conserve bandwidth

Standard ACLs should be configured towards the edge of the network to avoid matching too many packets which will cause alot of traffic to be dropped or permitted.