Scribd
Upload
27 views

10 CCNA ICND2 - Configuring and Understanding ACL

This document discusses configuring and understanding access control lists (ACLs) in Cisco routers. It provides examples of configuring standard and extended ACLs to permit or deny traffic based on source IP addresses, destination addresses, and port numbers. It also gives scenarios of applying ACLs to block specific hosts from accessing other hosts or networks.

Uploaded by

a_abrar10
Copyright
© Attribution Non-Commercial (BY-NC)
Available Formats
Download as PPT, PDF, TXT or read online on Scribd
27 views

10 CCNA ICND2 - Configuring and Understanding ACL

This document discusses configuring and understanding access control lists (ACLs) in Cisco routers. It provides examples of configuring standard and extended ACLs to permit or deny traffic based on source IP addresses, destination addresses, and port numbers. It also gives scenarios of applying ACLs to block specific hosts from accessing other hosts or networks.

Uploaded by

a_abrar10
Copyright
© Attribution Non-Commercial (BY-NC)
Available Formats
Download as PPT, PDF, TXT or read online on Scribd
You are on page 1/ 16

International Horn University

CCNA (ICND V2)

** Configuring and Understanding ACL**

Ahmed Nurani
Access Control List???
Access Control Lists (ACLs) allow a router
to permit or deny packets based on a
variety of criteria
ACL is configured on Global Mode
ACL does not take effect before applying
to any interface
If a packet enters or exits an interface with
an ACL applied, the packet is compared
against the criteria of the ACL.
List is read from top to bottom
All un-matched ACL’s are dropped by a
default deny
With a standard ACL is only concerned
with one aspect and that’s the source IP
address of the packet.
For an extended ACL both the destination
and source of the packet is considered as
well as it’s port numbers.
Configuring standard ACL
- Denying a single host
Option 1
Config# access-list 1 deny 192.168.5.100

Option 2
Config# access-list 1 deny 192.168.5.100 0.0.0.0

Option 3
Config# access-list 1 deny host 192.168.5.100
Configuring standard ACL
- Permitting single host
Option 1 – Permitting a single host
Config# access-list 1 permit 192.168.5.100

Option 2 – permitting a single host


Config# access-list 1 permit host 192.168.5.100

- Permitting a subnet
Config# access-list 1 permit 192.168.5.100
0.0.255.255
Scenario 1 - Use a standard ACL to block
Host A from accessing Host B

- Router 3
Config# access-list 1 deny 192.168.10.50
Config# access-list permit any
Config# interface fastethernet 0/0
Config-IF# ip access-group 1 out
Scenario 2 - Use a standard ACL to prevent
Host A from Telnet-ting or SSHing R1

- Router 1
Config# access-list 70 deny 192.168.10.50
Config# access-list permit any
Config# line vty 0 4
Config-line# access-class 70 in
Scenario 3 - Use an extended ACL to
prevent Host A from accessing R2 WAN link

- Router 2

Config# access-list 150 deny ip host


192.168.10.50 192.168.2.0 0.0.0.255
Config# access-list 150 permit ip any any
Config# interface fa0/0.10
Config-in# ip access-group 150 in
Scenario 4 - Use an extended ACL to
prevent Host A from accessing the internet

Config# access-list 150 deny tcp host


192.168.10.50 host 192.168.5.80 eq 80
Config# access-list 150 deny ip host
192.168.10.50 192.168.2.0 0.0.0.255
Config# access-list 150 permit ip any any

You might also like