程序代写代做代考 IOS ITE PC v4.0 Chapter 1

ITE PC v4.0 Chapter 1

Chapter 7: Access Control Lists
Routing and Switching Essentials v6.0

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
1
Cisco Networking Academy Program
Routing and Switching Essentials v6.0
Chapter 7: Access Control Lists

Chapter 7 – Sections & Objectives
7.1 ACL Operation
Explain how ACLs filter traffic.
Explain how ACLs use wildcard masks.
Explain how to create ACLs.
Explain how to place ACLs.
7.2 Standard IPv4 ACLs
Configure standard IPv4 ACLs to filter traffic to meet networking requirements.
Use sequence numbers to edit existing standard IPv4 ACLs.
Configure a standard ACL to secure vty access.
7.3 Troubleshoot ACLs
Explain how a router processes packets when an ACL is applied.
Troubleshoot common standard IPv4 ACL errors using CLI commands.

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
2

7.1 ACL Operation

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
3
Cisco Networking Academy Program
Routing and Switching Essentials v6.0
Chapter 7: Access Control Lists

Purpose of ACLs
What is an ACL?

By default, a router does not have ACLs configured; therefore, by default a router does not filter traffic.

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
4
7.1 – ACL Operation
7.1.1 – Purpose of ACLs
7.1.1.1 – What is an ACL?

Purpose of ACLs
Packet Filtering
Packet filtering, sometimes called static packet filtering, controls access to a network by analyzing the incoming and outgoing packets and passing or dropping them based on given criteria, such as the source IP address, destination IP addresses, and the protocol carried within the packet.
A router acts as a packet filter when it forwards or denies packets according to filtering rules.
An ACL is a sequential list of permit or deny statements, known as access control entries (ACEs).

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
5
7.1 – ACL Operation
7.1.1 – Purpose of ACLs
7.1.1.2 – Packet Filtering

Purpose of ACLs
ACL Operation

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
6
7.1 – ACL Operation
7.1.1 – Purpose of ACLs
7.1.1.3 – ACL Operation

Wildcard Masks in ACLs
Introducing ACL Wildcard Masking

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
7
7.1 – ACL Operation
7.1.2 – Wildcard Masks in ACLs
7.1.2.1 – Introducing ACL Wildcard Masking

Wildcard Masks in ACLs
Introducing ACL Wildcard Masking (cont.)

Example

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
8
7.1 – ACL Operation
7.1.2 – Wildcard Masks in ACLs
7.1.2.1 – Introducing ACL Wildcard Masking (cont.)

Wildcard Masks in ACLs
Wildcard Mask Examples

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
9
7.1 – ACL Operation
7.1.2 – Wildcard Masks in ACLs
7.1.2.2 – Wildcard Mask Examples

Wildcard Masks in ACLs
Wildcard Mask Examples (cont.)

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
10
7.1 – ACL Operation
7.1.2 – Wildcard Masks in ACLs
7.1.2.2 – Wildcard Mask Examples

Wildcard Masks in ACLs
Calculating the Wildcard Mask
Calculating wildcard masks can be challenging. One shortcut method is to subtract the subnet mask from 255.255.255.255.

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
11
7.1 – ACL Operation
7.1.2 – Wildcard Masks in ACLs
7.1.2.3 – Calculating the Wildcard Mask

Wildcard Masks in ACLs
Wildcard Mask Keywords

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
12
7.1 – ACL Operation
7.1.2 – Wildcard Masks in ACLs
7.1.2.4 – Wildcard Mask Keywords

Wildcard Masks in ACLs
Wildcard Mask Keyword Examples

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
13
7.1 – ACL Operation
7.1.2 – Wildcard Masks in ACLs
7.1.2.5 – Wildcard Mask Keyword Examples

Guidelines for ACL Creation
General Guidelines for Creating ACLS

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
14
7.1 – ACL Operation
7.1.3 – Guidelines for ACL Creation
7.1.3.1 – General Guidelines for Creating ACLS

Guidelines for ACL Creation
ACL Best Practices

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
15
7.1 – ACL Operation
7.1.3 – Guidelines for ACL Creation
7.1.3.2 – ACL Best Practices

Guidelines for ACL Placement
Where to Place ACLs

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
16
7.1 – ACL Operation
7.1.4 – Guidelines for ACL Placement
7.1.4.1 – Where to Place ACLs

Guidelines for ACL Placement
Where to Place ACLs (cont.)
Every ACL should be placed where it has the greatest impact on efficiency. The basic rules are:
Extended ACLs – Locate extended ACLs as close as possible to the source of the traffic to be filtered.
Standard ACLs – Because standard ACLs do not specify destination addresses, place them as close to the destination as possible.
Placement of the ACL, and therefore the type of ACL used, may also depend on: the extent of the network administrator’s control, bandwidth of the networks involved, and ease of configuration.

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
17
7.1 – ACL Operation
7.1.4 – Guidelines for ACL Placement
7.1.4.1 – Where to Place ACLs

Guidelines for ACL Placement
Standard ACL Placement
The administrator wants to prevent traffic originating in the 192.168.10.0/24 network from reaching the 192.168.30.0/24 network.

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
18
7.1 – ACL Operation
7.1.4 – Guidelines for ACL Placement
7.1.4.2 – Standard ACL Placement

7.2 Standard IPv4 ACLs

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
19
Cisco Networking Academy Program
Routing and Switching Essentials v6.0
Chapter 7: VLANs

Configure Standard IPv4 ACLs
Numbered Standard IPv4 ACL Syntax
Router(config)# access-list access-list-number { deny | permit | remark } source [ source-wildcard ] [ log ]

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
20
7.2 – Standard IPv4 ACLs
7.2.1 – Configure Standard IPv4 ACLs
7.2.1.1 – Numbered Standard IPv4 ACL Syntax

Configure Standard IPv4 ACLs
Applying Standard IPv4 ACLs to Interfaces

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
21
7.2 – Standard IPv4 ACLs
7.2.1 – Configure Standard IPv4 ACLs
7.2.1.2 – Applying Standard IPv4 ACLs to Interfaces

Configure Standard IPv4 ACLs
Applying Standard IPv4 ACLs to Interfaces (cont.)

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
22
7.2 – Standard IPv4 ACLs
7.2.1 – Configure Standard IPv4 ACLs
7.2.1.2 – Applying Standard IPv4 ACLs to Interfaces

Configure Standard IPv4 ACLs
Numbered Standard IPv4 ACL Examples

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
23
7.2 – Standard IPv4 ACLs
7.2.1 – Configure Standard IPv4 ACLs
7.2.1.3 – Numbered Standard IPv4 ACL Examples

Configure Standard IPv4 ACLs
Numbered Standard IPv4 ACL Examples (cont.)

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
24
7.2 – Standard IPv4 ACLs
7.2.1 – Configure Standard IPv4 ACLs
7.2.1.3 – Numbered Standard IPv4 ACL Examples

Configure Standard IPv4 ACLs
Named Standard IPv4 ACL Syntax

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
25
7.2 – Standard IPv4 ACLs
7.2.1 – Configure Standard IPv4 ACLs
7.2.1.4 – Named Standard IPv4 ACL Syntax

Configure Standard IPv4 ACLs
Named Standard IPv4 ACL Syntax (cont.)

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
26
7.2 – Standard IPv4 ACLs
7.2.1 – Configure Standard IPv4 ACLs
7.2.1.4 – Named Standard IPv4 ACL Syntax

Modify IPv4 ACLs
Method 1 – Use a Text Editor

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
27
7.2 – Standard IPv4 ACLs
7.2.2 – Modify IPv4 ACLs
7.2.2.1 – Method 1 – Use a Text Editor

Modify IPv4 ACLs
Method 2 – Use Sequence Numbers

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
28
7.2 – Standard IPv4 ACLs
7.2.2 – Modify IPv4 ACLs
7.2.2.2 – Method 2 – Use Sequence Numbers

Modify IPv4 ACLs
Editing Standard Named ACLs

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
29
7.2 – Standard IPv4 ACLs
7.2.2 – Modify IPv4 ACLs
7.2.2.3 – Editing Standard Named ACLs

Modify IPv4 ACLs
Verifying ACLs

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
30
7.2 – Standard IPv4 ACLs
7.2.2 – Modify IPv4 ACLs
7.2.2.4 – Verifying ACLs

Modify IPv4 ACLs
ACL Statistics

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
31
7.2 – Standard IPv4 ACLs
7.2.2 – Modify IPv4 ACLs
7.2.2.5 – ACL Statistics

Securing VTY Ports with a Standard IPv4 ACL
The access-class Command
The access-class command configured in line configuration mode restricts incoming and outgoing connections between a particular VTY (into a Cisco device) and the addresses in an access list.

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
32
7.2 – Standard IPv4 ACLs
7.2.3 – Securing VTY Ports with a Standard IPv4 ACL
7.2.3.1 – The access-class Command

Securing VTY Ports with a Standard IPv4 ACL
Verifying the VTY Port is Secured

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
33
7.2 – Standard IPv4 ACLs
7.2.3 – Securing VTY Ports with a Standard IPv4 ACL
7.2.3.2 – Verifying the VTY Port is Secured

7.3 Troubleshoot ACLs

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
34
Cisco Networking Academy Program
Routing and Switching Essentials v6.0
Chapter 7: Access Control Lists

Processing Packet with ACLs
The Implicit Deny Any
At least one permit ACE must be configured in an ACL or all traffic is blocked.
For the network in the figure, applying either ACL 1 or ACL 2 to the S0/0/0 interface of R1 in the outbound direction will have the same effect.

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
35
7.3 – Troubleshoot ACLs
7.3.1 – Processing Packets with ACLs
7.3.1.1 – The Implicit Deny Any

Processing Packet with ACLs
The Order of ACEs in an ACL

Processing Packet with ACLs
The Order of ACEs in an ACL (cont.)

Processing Packet with ACLs
Cisco IOS Reorders Standard ACLs

Notice that the statements are listed in a different order than they were entered.

Processing Packet with ACLs
Cisco IOS Reorders Standard ACLs (cont.)
The order in which the standard ACEs are listed is the sequence used by the IOS to process the list.

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
39
7.3 – Troubleshoot ACLs
7.3.1 – Processing Packets with ACLs
7.3.1.3 – Cisco IOS Reorders Standard ACLs (cont.)

Processing Packet with ACLs
Routing Processes and ACLs
As a frame enters an interface, the router checks to see whether the destination Layer 2 address matches its interface Layer 2 address, or whether the frame is a broadcast frame.
If the frame address is accepted, the frame information is stripped off and the router checks for an ACL on the inbound interface.
If an ACL exists, the packet is tested against the statements in the list.
If the packet matches a statement, the packet is either permitted or denied.
If the packet is accepted, it is then checked against routing table entries to determine the destination interface.
If a routing table entry exists for the destination, the packet is then switched to the outgoing interface, otherwise the packet is dropped.
Next, the router checks whether the outgoing interface has an ACL. If an ACL exists, the packet is tested against the statements in the list. If the packet matches a statement, it is either permitted or denied.
If there is no ACL or the packet is permitted, the packet is encapsulated in the new Layer 2 protocol and forwarded out the interface to the next device.

Common Standard IPv4 ACL Errors
Troubleshooting Standard IPv4 ACLs – Example 1

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
41
7.3 – Troubleshoot ACLs
7.3.2 – Common Standard IPv4 ACL Errors
7.3.2.1 – Troubleshooting Standard IPv4 ACLs – Example 1

Common Standard IPv4 ACL Errors
Troubleshooting Standard IPv4 ACLs – Example 1 (cont.)

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
42
7.3 – Troubleshoot ACLs
7.3.2 – Common Standard IPv4 ACL Errors
7.3.2.1 – Troubleshooting Standard IPv4 ACLs – Example 1 (cont.)

Common Standard IPv4 ACL Errors
Troubleshooting Standard IPv4 ACLs – Example 2

Security Policy: The 192.168.11.0/24 network should not be able to access the 192.168.10.0/24 network.

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
43
7.3 – Troubleshoot ACLs
7.3.2 – Common Standard IPv4 ACL Errors
7.3.2.2 – Troubleshooting Standard IPv4 ACLs – Example 2

Common Standard IPv4 ACL Errors
Troubleshooting Standard IPv4 ACLs – Example 2 (cont.)

ACL 20 was applied to the wrong interface and in the wrong direction. All traffic from the 192.168.11.0/24 is denied inbound access through the G0/1 interface.

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
44
7.3 – Troubleshoot ACLs
7.3.2 – Common Standard IPv4 ACL Errors
7.3.2.2 – Troubleshooting Standard IPv4 ACLs – Example 2 (cont.)

Common Standard IPv4 ACL Errors
Troubleshooting Standard IPv4 ACLs – Example 2 (cont.)

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
45
7.3 – Troubleshoot ACLs
7.3.2 – Common Standard IPv4 ACL Errors
7.3.2.2 – Troubleshooting Standard IPv4 ACLs – Example 2 (cont.)

Common Standard IPv4 ACL Errors
Troubleshooting Standard IPv4 ACLs – Example 3

Problem
Security Policy: Only PC1 is allowed SSH remote access to R1.

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
46
7.3 – Troubleshoot ACLs
7.3.2 – Common Standard IPv4 ACL Errors
7.3.2.3 – Troubleshooting Standard IPv4 ACLs – Example 3

Common Standard IPv4 ACL Errors
Troubleshooting Standard IPv4 ACLs – Example 3 (cont.)
Solution!
Security Policy: Only PC1 is allowed SSH remote access to R1.

Presentation_ID
‹#›
© 2008 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
47
7.3 – Troubleshoot ACLs
7.3.2 – Common Standard IPv4 ACL Errors
7.3.2.3 – Troubleshooting Standard IPv4 ACLs – Example 3 (cont.)

7.4 Summary

Explain how ACLs filter traffic.
Explain how ACLs use wildcard masks.
Explain how to create ACLs.
Explain how to place ACLs.
Configure standard IPv4 ACLs to filter traffic to meet networking requirements.
Use sequence numbers to edit existing standard IPv4 ACLs.
Configure a standard ACL to secure vty access.
Explain how a router processes packets when an ACL is applied.
Troubleshoot common standard IPv4 ACL errors using CLI commands.
Chapter Summary
Summary

/docProps/thumbnail.jpeg

Related Posts