Access List - Standard
Access List - Configurazione di Access List Standard
Assume that we want to PERMIT the ping from 192.168.2.100 to 192.168.1.0
Assume that we want to DENY the ping from 192.168.2.101 to 192.168.1.0
With using the Standard ACL we are "closest to the destination" and this means that we need to work on:
R0 (closest to the destination)
Gig0/1 on R0 (closest to the destination) outbound
the command to use in order to configure an access list that DENY 192.168.2.101 to reach 192.168.1.0 is:
access-list 1 deny 192.168.2.101 0.0.0.0
Please note that 0.0.0.0 is the wildcard which means basically that we deny ONLY 192.168.2.101;
we could also write this specific command in this way:
access-list 1 deny host 192.168.2.101
in case we want to deny ALL 192.168.2.0 we should put 0.0.0.255
In order to permit everything else:
access-list 1 permit any
R0:
access-list 1 deny 192.168.2.101 0.0.0.0
access-list 1 permit any
It is necessary to associate the created ACL to the correct interface:
interface gigabitEthernet 0/1
ip access-group 1 outbound
In case we want to "append" the deny for host 192.168.2.100 with a similar command like the one before, it won't work
What happens is that all access-list are read from top to bottom therefore the "permit" will mask the last one inserted.
The rule is that once a match occurs the access-list exits
Please consider that at the end of every access-list there's a default deny all
In order to reset the access-list 1 we can type:
no access-list 1