- [Instructor] We've looked at creating numbered ACLs,
so let's see how
we can create a Named ACL.
We can create named ACLs
as either standard or extended,
but specifically here
we'll look at an Extended Named ACL.
Now, why would we choose a named ACL
over a numbered of ACL.
There are a few good reasons for that.
The first being that
it is simply more intuitive
as your configuration file grows
and the output of your show running
config command becomes larger
and more and more ACLs are populated there
its much, much easier
to identify the purpose of a named ACL.
You can give them
very specific intuitive naming.
The most important reason
you might want to use this
is that it allows you
to edit an existing ACL.
That's a very helpful feature of named ACL's.
Remember that we want
to insert our more specific ACEs
near the top of an ACL
and we want to place
the more general ACEs at the bottom.
If we want to add a new entry
to a numbered ACL,
if we can figure a new ACE,
that new ACE will be added
at the end as the last rule
in the access control list,
so that might not work well in some cases.
To get around that
you would have to delete
and recreate the number of ACL
with your ACEs in a new order.
Named ACLs on the other hand,
those will allow us to insert ACEs
wherever we want inside of our ACL.
Let's look at our same typology
that we've been using
to see how we can do that.
The configuration we'll start with
is the one we created
in our extended numbered ACL example,
and at the moment all traffic
is allowed from the 10.1.1.0/24 network
to the server except
for Telnet traffic coming from PC one.
In this example,
we're going to create a new named ACL
that matches the same original criteria
and then we're actually
going to edit that
and the edit will be
to not only deny the Telnet traffic
from PC one but to also deny HTTP traffic
from PC one while still allowing all other traffic.
Let's connect to our live interfaces
to see how that's done.
First on router one let's run
the command show access hyphen list,
and here you can see
our numbered extended ACL
that we have in place already ACL 100
and we see our first entry
is to deny Telnet traffic from PC one
going to the server followed
by an entry that's going to allow
all other IP traffic
from the ten.one.one.zero/ 24
network to any destination.
So now what we want to do is
we want to add an entry
that blocks HTTP traffic
from PC one as well.
But what happens if
we can figure another ACE
for this ACL is that
it's going to be upended
at the bottom as processed 30
you can see that our deny statement
is processed 10 permit statement process 20
and so if we add a new ACE
to a numbered ACL,
it's going to be upended at the bottom.
And again,
remember that these are processed
in a top down manner.
So if HTTP traffic
arrives from PC one,
it's going to match the second ACE
that we have and it would be permitted.
And the processing of the ACL
would actually stop right there
before it ever reached
our deny statement at the bottom.
So what we're going to do is
we're going to create
an extended named ACL.
And first we're going to
to configure it exactly like this numbered ACL.
And then I'll show you
how to edit that with a new entry
that's going to achieve
what we want to,
which is blocking HTTP traffic.
So the first thing I want to do,
is I want to remove our existing ACL,
so I can say no access hyphen list 100
so that takes care of that.
And we also need to remove that
from the interface as well.
So if I go under interface gig zero
slash one that is applied
under this interface
in the inbound direction, remember?
So I can say no IP access hyphen group
and that group is 100
and that was in the inbound direction.
If we hit enter,
that takes care of removing everything.
So now let's create
a new extended named ACL.
We can do that
with the command IP access hyphen list.
Notice we say IP access hyphened list
rather than just access hyphened list
this time this is the proper command.
If we want to create a named ACL
and let's use our contextual help
and you can see that
we can call this out
as either a standard ACL
or an extended ACL.
Of course we want to say extended here.
And then let's use
our contextual help once more.
And now we're prompted
with either using
an extended IP access list number
or we can give that a name.
So of course we do want
to give that a name.
You can get as descriptive
as you'd like here.
Whatever helps you to identify
the purpose of an ACL easily.
So I'm going to call
this PC one underscore,
no underscore.
Tell Matt underscore HTTP.
Very, very descriptive.
So again, these are as descriptive
as you want them to be.
Whatever helps you to see and
recognize the purpose of your ACL.
When you're looking through that running
configuration, I'll hit enter there.
And now you notice we're under
extended named ACL configuration mode.
So from here our commands are nearly
identical to our numbered ACL commands.
So let's recreate some of
those original entries.
We'll first say deny TCP host
and PC
one's IP address is ten.one.one dot five
we'll deny that to our server.
So we'll say host will nine two.one six
eight dot three dot 50 and we'll say equal to
and we want to set that to Telnet
because we originally had denied Telnet.
Now we want to add that entry to permit
everything else to permit all other traffic.
So we can say very easily permit IP any, any.
So now that has basically recreated
our access control is that we deleted.
Now we need to apply that to an interface.
So we'll go back under interface gig
zero slash one
and I'll say
IP
access hyphen group
and now we
want to call out the name.
We want to reference the name of
that ACL. So it's PC one underscore,
no underscore Telnet, underscore
HTTP.
And we want to follow that with the
direction that we want that applied to,
which of course is inbound.
So we can use the end key word.
Hit enter and we're finished.
Let's back out of that and
do another show command.
So we'll say show access hyphen list.
And now notice we again see
an extended access list here.
Notice that it's called out by the
name as time, there's no number.
We see the name that we configured there.
We see our first deny statement that
denies the Telnet traffic from our PC,
one to the server,
and then we see the second entry
that permits all other IP traffic.
So you can see both of our ACEs
just as we had in the numbered ACL.
Now let's say we want to edit
this access control lists.
We want to add an entry
to deny that HTTP traffic.
We can do that by going back
under a global configuration mode.
And let's go back under our
extended named ACL configuration.
So we can do that with the command
IP access hyphen list
extended,
and then we want to call out
the name PC one underscore,
no underscore Telnet underscore HTTP.
So that brings us back under extended
named ACL configuration mode.
If we look at contextual help,
one of the things that you
see at the very top notice,
we now have this sequence number option,
so that's going to allow us to place
this specifically in our ACL wherever we
want it to be. We currently
have two ACEs. Remember,
we can actually still see those here.
Process 10 and process 20
since this is a more specific ACE,
we want to place that higher in the list.
So we can choose a sequence
number that's between those.
So I can start with 15 as my sequence
number and I'll say deny TCP host.
I'll say ten.one.one dot five which
is PC one's IP address host again
one nine two.one six eight dot three
dot 50 which is the server's IP address
equal four equals two and we'll say
80 for HTTP traffic because that uses
well-known port 80 I'll hit enter,
we'll back out of that and again let's
say show access hyphen list
and now look,
our new ACE that we configured is higher
up in the list exactly where we would
want it to be,
so now that will get processed
before this catch all permit command.
That lets all other IP
traffic through there.
That's exactly what we want to see.
Let's jump back over to PC one first.
Let's try to ping one nine two one six
eight three dash 50 and that does work.
We would expect that to work so that's good.
Now let's try HTTPS traffic.
HTTPS traffic should be permitted
because we have not blocked that.
We can do that by saying Telnet,
the server's IP address
followed by the port number for HTTPS,
which is four 43 it says it's open,
so that's good. That's working.
And now we can try normal Telnet.
So we'll take the port number off there
and that will default to the normal
Telnet port of 23 and we get the
destination unreachable message.
That's good. We configured it to be
blocked, so that's what we'd want to see.
Now let's see if the entry that
we added in there is also blocked.
So let's try that over.
Port 80 for HTTP traffic.
And sure enough,
we also get the destination
unreachable message for HTTP traffic,
just as we would expect to see.
So that's a look at
how we can create
and edit an extended named ACL.