CCNA Tutorials -Access Control List Part 1 - English CISCO ACL
CCNA Tutorials Access Control List Part 1 English
CISCO ACL
Introduction to Access Control Lists - ACL
Perimeter
Firewall
Internal Routers
Trusted Network
DMZ- Demilitarized Zone
Access Control Lists - ACL
Essentially lists of conditions that control access
Control a huge amount of traffic flow throughout the internetwork
Basic statistics on packet flow and security policies can be implemented
permit or deny packets
Once the lists are built, they can be applied to either inbound or outbound traffic on any interface
cause the router to analyze every packet crossing that interface in the specified direction
Rules for Access Control Lists
compared with each line of the access list in sequential order, i.e., it’ll always start with line 1, then go to line 2, then line 3, and so on.
Access list only compares until a match is made Once the packet matches a line of the access list, it’s acted upon, and no further comparisons take place
There is an implicit “deny” at the end of each access list
Types of Access Control Lists
Standard access lists :- These use only the source IP address in an IP packet to filter the network. This basically permits or denies an entire suite of protocols. IP standards can filter on both source and destination IP address.
Extended access lists :- These check for both source and destination IP address, protocol field in the Network layer header, and port number at the Transport layer header. IP extended access lists use source and destination IP addresses, Network layer protocol fields, and socket numbers in the Transport layer header.Once you create an access list, you apply it to an interface.
Named access List :- Named access list are either standard or extended it is not a new type. Only we can recognize the acl with name.
Interface Application
Inbound access lists :- Packets are processed through the access list before being routed to the outbound interface.
Outbound access lists :- Packets are routed to the outbound interface and then processed through the access list.
Guidelines - Access Control List
Per interface, per protocol, or per direction
Specific tests are at the top of the access list as ACL execute sequentially
New list is added to the access list, it will be placed at the bottom of the list
You cannot remove one line from an access list
Create access lists and then apply them to an interface.
They will not filter traffic originated from the router.
Place IP standard access lists as close to the destination as possible.
Place IP extended access lists as close to the source as possible.