© 2006 Cisco Systems, Inc. All rights reserved. ICND v Managing IP Traffic with ACLs Introducing ACLs

© 2006 Cisco Systems, Inc. All rights reserved. ICND v Outline Overview ACL Overview ACL Applications Types of ACLs ACL Operations ACL Statement Processing Wildcard Masking Process Summary

© 2006 Cisco Systems, Inc. All rights reserved. ICND v Manage IP traffic as network access grows Filter packets as they pass through the router Why Use ACLs?

© 2006 Cisco Systems, Inc. All rights reserved. ICND v Permit or deny packets moving through the router. Permit or deny vty access to or from the router. Without ACLs, all packets could be transmitted onto all parts of your network. ACL Applications

© 2006 Cisco Systems, Inc. All rights reserved. ICND v Special handling for traffic based on packet tests Other ACL Uses

© 2006 Cisco Systems, Inc. All rights reserved. ICND v Standard ACL –Checks source address –Generally permits or denies entire protocol suite Extended ACL –Checks source and destination address –Generally permits or denies specific protocols Types of ACLs

© 2006 Cisco Systems, Inc. All rights reserved. ICND v How to Identify ACLs Standard IP lists (1-99) test conditions of all IP packets from source addresses. Extended IP lists ( ) test conditions of source and destination addresses, specific TCP/IP protocols, and destination ports. Standard IP lists ( ) (expanded range). Extended IP lists ( ) (expanded range). Other ACL number ranges test conditions for other networking protocols. Named ACLs identify IP standard and extended ACLs with an alphanumeric string (name).

© 2006 Cisco Systems, Inc. All rights reserved. ICND v Testing Packets with Standard ACLs

© 2006 Cisco Systems, Inc. All rights reserved. ICND v Testing Packets with Extended ACLs

© 2006 Cisco Systems, Inc. All rights reserved. ICND v Outbound ACL Operation If no ACL statement matches, discard the packet.

© 2006 Cisco Systems, Inc. All rights reserved. ICND v A List of Tests: Deny or Permit

© 2006 Cisco Systems, Inc. All rights reserved. ICND v means check value of corresponding address bit. 1 means ignore value of corresponding address bit. Wildcard Bits: How to Check the Corresponding Address Bits

© 2006 Cisco Systems, Inc. All rights reserved. ICND v checks all of the address bits. Abbreviate this wildcard mask using the IP address preceded by the keyword host (host ). Check all of the address bits (match all). Verify an IP host address, for example: Wildcard Bits to Match a Specific IP Host Address

© 2006 Cisco Systems, Inc. All rights reserved. ICND v Test conditions: Ignore all the address bits (match any). An IP host address, for example: Accept any address: any Abbreviate expression with keyword any Wildcard Bits to Match Any IP Address

© 2006 Cisco Systems, Inc. All rights reserved. ICND v Check for IP subnets /24 to /24. Address and wildcard mask: Wildcard Bits to Match IP Subnets

© 2006 Cisco Systems, Inc. All rights reserved. ICND v Summary ACLs allow the packet flow to be filtered into or out of router interfaces and vty ports to help limit network traffic and restrict network use by certain users or devices. ACLs can be used to classify and differentiate traffic for special handling. Standard ACLs check the source addresses of packets that could be routed. Extended ACLs check both source and destination packet addresses.

© 2006 Cisco Systems, Inc. All rights reserved. ICND v Summary (Cont.) Inbound ACLs process incoming packets as they enter the router. Outbound ACLs process outgoing packets before they leave an outbound interface. ACL statements operate in sequential, logical order. ACL statements evaluate packets from the top down, one statement at a time, until a matching statement is found. ACL address wildcard masking can be used to identify how to check or ignore corresponding IP address bits. Wildcard masking uses the number 1 and the number 0 to identify how to treat the corresponding IP address bits.

© 2006 Cisco Systems, Inc. All rights reserved. ICND v