- [Instructor] When we're looking at
the security of our infrastructure,
one of the primary methods that we can use for that
are Access Control Lists, or ACLs.
ACLs are a sequential list of rules
that will either permit or deny traffic,
based on the conditions we set.
The rules inside the ACL are called
Access Control Entries, or ACEs,
so ACLs are made up of multiple ACEs.
When we say that these are sequential lists,
we mean that they work from the top down.
When a packet arrives and gets checked against
a certain ACL, it will be compared to each entry,
each ACE in the list, starting at the top of the ACL
and moving down, until a match is identified.
If the packet matches a specific ACE,
the action we've requested will be performed.
That action can be to either permit or to deny
the traffic, based on our parameters.
Now, it's worth mentioning that ACLs
can also provide general packet classification
and grouping for things like QOS as well.
But here, we're looking at ACLs in a way
that they are primarily used, which is
as a basic traffic filtering process for our infrastructure.
So first, let's look at Standard Access Control Lists.
A few important things you want to know
about Standard ACLs are, first:
that they only match source IP address information.
So Standard ACLs are not as extensive
as the options afforded by Extended ACLs.
But Standard ACLs are a really simple, easy setup,
if that works for your needs.
Also, Standard ACLs are going to match traffic
based on the entire protocol suite.
So they are not able to distinguish
between the different types of IP traffic,
things like Telnet, TCP, UDP, and so on.
Standard ACLs fall in the number range of one through 99
for the normal range, and there's also
an expanded range if you need more than that,
ranging from 1,300 through 1,999.
We'll look at named ACLs in a future video,
but you'll also want to know that you can
create Standard ACLs with a name, instead of a number,
if you prefer to do that.
One final consideration for Standard ACLs
is that it's recommended to configure those
as close to the destination as possible.
Since we're blocking traffic based on the source IP address,
if you place the ACL, let's say on the first hop router,
then you're going to block the traffic
from getting anywhere past that first hop.
So even destinations that it should be able to reach
will be blocked.
Let's take a look at our sample topology,
and a configuration example.
So here in our topology, we have two host PCs,
labeled PC1 and PC2, and these are on
the 10.1.1.0/24 network, PC1 being .5, PC2 being .10.
These are connected to a switch,
which is connected to our router.
Now on the other side of that router,
we have a server sitting at the IP address of 192.168.3.50.
What we want to do in this example is we want to
permit all IP traffic from PC1 to the server
and we want to deny all IP traffic from PC2 to the server.
Let's go out to a live interface
and see exactly how we can do that.
First, let's jump on each of our hosts
and see if we can currently reach the server.
So, here, I'm connected to PC1,
and I'm going to try to ping that server at 192.168.3.50.
You can see that that is successful.
Let me jump to PC2, and we'll do the same.
Ping 192.168.3.50, which is the server IP address.
That is also successful.
So let's begin on router one,
with our Standard ACL configuration.
Let's go under Global Configuration Mode,
and the command we want to use is Access-List.
If we look at our contextual help,
you can see all those number ranges
that we have available here.
Again, one through 99 is the normal range.
We also see that expanded range
listed as 1,300 through 1,999.
Usually I'll just start at the very beginning of the range,
so I'm going to choose number one.
And I'll use contextual help again.
And you can see we have three options.
We can use remark if we want to leave a comment
about what we're doing.
Or we can permit or deny.
So the first thing I'll do is I want to
create a permit ACE for PC1.
So I'll do that by saying permit.
Here our contextual help lets us know
that we can permit an entire subnet range
by a single host address or by the host name.
We can also use the any keyword
if we wanted to permit everything.
Now, since I'm focused on a single host,
I can actually use the host keyword,
followed by the IP address of the host,
which is 10.1.1.5, that's the IP address for PC1.
I'll hit enter, and now we have created
an Access Control List with a single ACE inside of there.
The next thing we need to do, is we need to determine
which interface we're going to apply this ACL to,
and in which direction.
Now this is a fairly simple topology here.
We only have a single router,
so we can choose either one of those router interfaces.
If we choose to do that on gig0/1, we'll want to do that
in the inbound direction, because the traffic
coming from the PCs is coming into that interface.
And if we chose to apply that to gig0/2,
we want to do that in the outbound direction,
since this is where traffic would be leaving our router.
I'm going to configure that on gig0/1,
so I'll say interface gig0/1 to go under
interface configuration mode.
And the command we want is IP Access-Group.
Now that may be a little strange.
Maybe that's not what you expected to see.
Maybe you would expect to see IP Access-List instead.
So, the syntax is a little tricky here.
That's something you want to remember.
But nonetheless, this is the option we want,
and we want to follow that with the ACL number
that we want to apply to this interface,
which is, of course, number one,
that's what we just configured.
And finally, we need to specify
the direction in which we want this to be applied,
which is the inbound direction.
So we can use the keyword in
to complete this command and hit enter.
Let's exit, and let's say Show Access-List,
so we can see here that we have
a single Standard Access List,
Standard IP Access List number one,
and it has a single ACE inside of that,
which is our permit command.
And so that's good, that's exactly what we want to see.
Now let's see what effect this has had on our network.
Because, at the end of every single Access Control List,
there is an implicit deny command.
And that means if it isn't explicitly
permitted in our Access Control List,
the traffic is going to be denied.
So this one single ACE should take care of
exactly what we want to do.
Let's jump back over to PC2, and let's, again,
try to ping that server at 192.168.3.50.
And you can see right away,
it's having some trouble doing that.
It's eventually going to time out and our ping is unsuccessful.
So we see a success rate of zero out of five.
So this means that the server was unreachable.
The ICMP message could not get there,
which is exactly what we would want to see,
because we have not permitted that traffic.
For completion's sake, let's make sure
that PC1 is still able to do that.
So, again, we'll say ping 192.168.3.50,
and that is still successful.
So we have done exactly what we wanted to do.
We have blocked all traffic from PC2
from reaching the server, while still allowing
all of PC1's traffic to reach that.
So that's a look at how we can configure
a very basic Standard Access Control List.