All language subtitles for Free-CCNA-Standard-ACLs-Day-34-CCNA-200-301-Complete-Course_en

This is a free, complete course for the CCNA.

If you like these videos, please subscribe\n

Also, please like and leave a comment, and\n

In this video we will cover standard ACLs,\naccess control lists.

I’ll be splitting up ACLs into two days,\n

ACLs are in the exam topics under section\n

Specifically, topic 5.6, which says you must\n

It doesn’t specify IPv4 or IPv6, but for\n

Perhaps later I’ll make an extra video introducing\n

Here’s what we’ll cover in today’s video.

I’ll introduce their basic purpose.

I’ll talk about ACL logic, how they are\n

I’ll introduce the basic types of ACLs on\nCisco routers.

After that I’ll show you how to configure\n

As always, watch until the end of the quiz\n

CCNA, the best practice exams for the CCNA,\n

ACLs, Access Control Lists, actually have\nmultiple uses.

The name ‘access control’ tells us that\n

For example, Host A should be allowed to access\n

to access Server A. In Day 34, this video,\n

So, like I just said, controlling which devices\n

However, although that is the main purpose\n

Later in the course you’ll see some other\nuses of ACLs.

But for now, we’ll focus on ACLs from a\n

access to different parts of the network.

So, when using ACLs in this way, ACLs function\n

to permit or discard specific traffic.

As you know, if a router receives a packet\n

it will by default forward the packet according\n

However ACLs let us control that.

Even if the router has a route to the destination,\n

ACLs can filter traffic based on the source\n

For the CCNA, we’ll just focus on those\n

can get more advanced with ACLs also.

Okay, I think showing you will make things\n

So, we have two routers, R1 and R2, with a\n

The 192.168.1.0/24 network is connected to\n

Notice that, instead of including a switch\n

to the switch, I represent the network segment\nlike this.

This is common in network diagrams.

In reality, all of the PCs in the 192.168.1.0/24\n

switch is connected to R1, but we don’t\n

The 192.168.2.0/24 network, with PC3 and PC4,\n

The 10.0.1.0/24 network, with SRV1, is connected\n

I’ll use this network to demonstrate how\nACLs work.

So, without looking at the actual configurations\n

We shouldn’t just configure ACLs randomly,\n

For example, let’s say the network policy\n

able to access the 10.0.1.0/24 network.

They should be able to access files on SRV1,\nfor example.

However, hosts in the 192.168.2.0/24 network\n

PC3 and PC4, for example, should not be able\n

How can we use ACLs to achieve this?

First up, ACLs are configured globally on\n

ACLs are made up of an ordered sequence of\n

For example, to fulfill our requirement, we\n

ACE 1 says if source IP equals 192.168.1.0/24,\n

ACE 2 says if source IP equals 192.168.2.0/24,\ndeny the traffic.

ACE 3 says that all other traffic should be\npermitted.

The order of these entries is very important,\n

Configuring an ACL in global config mode will\n

After being created, the ACL must be applied\nto an interface.

ACLs are applied either inbound or outbound.

Let’s say we configured it on R1.

So it has been created, but it hasn’t been\napplied yet.

Let’s walk through some examples of applying\n

Once again, here are the requirements.

Depending on which interface we apply the\n

we will either succeed in meeting the requirements\nor fail.

For example, what if we applied it outbound\non G0/2.

That means it will only take effect on traffic\nexiting G0/2.

Does that fulfill the requirements?

The answer is no, it doesn’t fulfill the\nrequirement.

Because R1 will only use the ACL to filter\n

If PC3 tries to ping SRV1, when the ping reaches\n

the traffic is entering G0/2, not exiting\nit.

So, R1 will forward the traffic to R2, which\n

Now, when SRV1 sends the reply to PC3, R1\n

should be forwarded out of G0/2 or not.

It will check the entries of ACL1 in sequence.

If source IP = 192.168.1.0/24.

Well, the source is SRV1, so that doesn’t\napply.

If source IP = 192.168.2.0/24.

That doesn’t apply either, the source is\nnot in that subnet.

So, R1 reaches the last entry which says permit\n

PC3 was able to access SRV1, even though hosts\n

Clearly, we didn’t apply this ACL correctly.

What if we applied the ACL inbound on G0/2?

That means R1 will check the ACL for all traffic\nentering G0/2.

So, if PC3 tries to ping SRV1, R1 will check\nthe ACL.

Once again, it will check the entries in order,\n

The source isn’t in that subnet, so it checks\nthe next entry.

The source is 192.168.2.1, which is in 192.168.2.0/24,\n

That means that R1 will take the specified\n

So, R1 drops the traffic, it doesn’t forward\nthe packet.

Once a router finds a match and takes an action,\n

ACL, so this ‘permit all other traffic’\nis ignored.

So, does this fulfill our requirements?

192.168.1.0/24 will be able to access 10.0.1.0/24\n

Also, hosts in 192.168.2.0/24 are prevented\n

R1 dropped the traffic from PC3.

However, by applying the ACL inbound on G0/2\n

This blocks hosts in 192.168.2.0/24 from communicating\n

PC3 and PC4 can communicate with each other,\nbut that’s it.

So, this is not the best way to apply this\nACL.

There are some other possibilities we could\n

R2’s G0/0, but let’s take a look at the\nbest option.

The best location to place this ACL is outbound\n

If PC3 tries to ping SRV1, R2 will check the\n

The first entry says if source IP equals 192.168.1.0/24\n

If source IP is in 192.168.2.0/24, then deny.

The source is in that subnet, so the packet\n

So, that satisfies the second requirement,\n

What if PC1, in 192.168.1.0/24, tried to ping\nSRV1?

Before forwarding the packet out of its G0/1\n

If the source IP is in 192.168.1.0/24, then\npermit.

The source is 192.168.1.1, so the packet is\n

Both requirements have been satisfied, and\n

I hope that demonstration helped you understand\n

If you’re still a little confused, don’t\nworry.

Let me explain a little more about some of\n

So, ACLs are configured in global config mode,\n

When applying it to an interface, you specify\na direction.

This tells the router to either check packets\n

ACLs are made up of one or more ACEs, access\ncontrol entries.

When the router checks a packet against the\n

For example here in ACL 1, the router will\n

then it will check if the packet’s source\n

match either of those it will permit it.

Another point I briefly mentioned before,\n

the ACL, the router takes the action and stops\n

All entries below the matching entry will\nbe ignored.

Here we have a router and another ACL.

The first entry in the ACL says if source\n

However the second entry says if source IP\n

What effect will this have if applied outbound\n

If a packet with a source IP of 192.168.1.1\n

out of G0/0 the router will check it against\nthe ACL.

The source is 192.168.1.1, which matches the\n

This second entry will simply be ignored.

Now I’ve reversed entries 1 and 2 in ACL\n2.

What will the effect be if the same packet\n

It will once again check ACL 2 before forwarding\nthe packet.

The first entry tells the router to deny the\n

Entry 2, which tells the router to permit\n

So, I think you can see how important the\n

Now, here’s one more point about ACLs.

A maximum of one ACL can be applied to a single\n

So, one inbound ACL is allowed and one outbound\n

If you apply a second ACL to an interface\n

Next up, another important part of ACLs, the\n‘implicit deny’.

What happens if a packet doesn’t match any\n

So, here’s the same ACL, and the same router.

This time the router receives a packet with\nsource IP 10.0.0.1.

Before forwarding it out of G0/0, the router\n

And it doesn’t match the second entry either.

The answer is, the router will deny the packet,\n

This is what we call the ‘implicit deny’.

Even though there is no entry in the ACL telling\n

there is an invisible entry at the end, if\n

To summarize this point, there is an implicit\n

This tells the router to deny all traffic\n

Always be aware of the implicit deny when\n

Now that you have an idea of the basic operations\n

of ACLs you will learn about in today’s\nvideo and in Day 35.

There are two main types of ACLs, and those\n

The first type are standard ACLs, these match\n

The two types of standard ACLs are standard\n

And there are also standard named ACLs, which\n

There are also differences in how you configure\n

In addition to standard ACLs, there are also\nextended ACLs.

These are more complex and can match based\n

and/or destination port numbers, as well as\nsome other things.

Like standard ACLs, there are numbered and\n

As I said in the beginning of the video, today\n

All of the examples so far have been standard\n

In Day 35 I’ll tell you all about extended\n

standard ACLs and then see how to actually\nconfigure them.

So let’s get into standard numbered ACLs.

As I just mentioned, standard ACLs match traffic\n

So, standard ACLs are quite simple.

The router doesn’t check the destination\n

It just looks at the source IP address of\n

Numbered ACLs are identified with a number.

You can, of course, configure multiple ACLs\n

Numbered ACLs use a number like ACL 1, ACL\n2, etc.

There are also named ACLs, which I’ll introduce\nlater.

Different types of ACLs have a different range\n

Standard ACLs can use 1 to 99 and 1300 to\n1999.

Originally, standard ACLs could only use 1\n

99 standard ACLs on a single router.

Later this was expanded to include 1300 to 1999.

So, you can’t configure a standard ACL with\n

Here are a bunch of different ACL types, and\n

You don’t have to memorize all of these,\nof course.

For now, just remember the standard ACL ranges,\n

‘IP ACL’ is the type of ACL you have to\nlearn for the CCNA.

I just wanted to show you that there are lots\n

Here’s the basic command to configure a\nstandard numbered ACL.

ACCESS-LIST, followed by the number.

We’re configuring standard ACLs, so this\n

Then you specify either deny or permit, and\n

Hopefully you remember wildcard masks from\n

Don’t try to use a standard subnet mask\nwhen configuring ACLs.

So, this is how you configure a single entry\nin access-list 1.

ACCESS-LIST 1 DENY 1.1.1.1 0.0.0.0.

So, this denies 1.1.1.1/32, meaning only 1.1.1.1,\na single host.

Now, when you specify a /32 mask in an ACL,\n

You can just specify 1.1.1.1, and the router\n

So, these are just two different ways of configuring\n

Now, there is one more method of configuring\na /32 entry.

It’s considered an old method, but it still\n

To specify a single host, you can use the\n

Again, in effect this is exactly the same\n

So, all three of these are the same in effect.

Note that the 2nd and 3rd options here can\n

If you’re matching a /24 network, for example,\n

to specify the wildcard mask of 0.0.0.255.

Okay, so let’s say we used one of those\n

If we leave the ACL as is, all other traffic\n

So, let’s make another entry in this ACL\nto permit traffic.

This tells the router to permit all traffic,\nwith any source IP.

The ANY keyword is convenient, but how can\n

Pause the video and think about it, what IP\n

Okay, the answer is 0.0.0.0 255.255.255.255,\n

So, these two options are exactly the same.

As you can see, ACL configuration can be quite\nflexible.

In these examples I’ll use a variety of\n

but feel free to pick your favorite and just\nuse that.

‘ANY’, for example, is much quicker to\n

Finally, here’s one more thing you can configure\n

This is like an interface description.

It doesn’t have any effect on the ACL, it’s\n

the purpose of the ACL when looking at it\nin the configuration.

Note that the command is ACCESS-LIST 1 REMARK,\n

The hashtags, or pound symbols, whatever you\n

I just use them to make it easier to see when\n

Okay, so I tried actually configuring that\n

For both the deny and permit entries I decided\n

Then I used SHOW ACCESS-LISTS, which displays\n

There are a few things to point out here.

First up, notice that the router automatically\n

The router does this when you use a /32 mask.

Also, PERMIT 0.0.0.0 255.255.255.255 was automatically\n

You probably also noticed that the remark\n

Finally, notice that each entry is given a\n

I configured the DENY statement first, and\n

Remember, the order of these entries is very\nimportant.

If the PERMIT ANY entry was first, all traffic\n

On modern devices, the router should prevent\n

you should still be aware of how important\nthe order is.

Okay, next I used the command SHOW IP ACCESS-LISTS.

Notice that the output is exactly the same\n

As you saw before, there are many kinds of\nACLs.

SHOW ACCESS-LISTS displays all kinds, but\n

the kind we will be configuring in these videos.

You can use either command to check your ACLs,\n

Finally, I used SHOW RUNNING-CONFIG, followed\n

to only show lines in the config that include\nACCESS-LIST.

Notice once again that the deny and permit\n

Also, the remark is displayed this time.

Now, remember I said you have to actually\n

From interface config mode, use IP ACCESS-GROUP,\n

then the ACL number, then IN or OUT.

Now let’s get into a real example of using\n

Here’s the same network as before.

I’ll give some requirements, and we’ll\n

On R1 I’ll configure standard numbered ACLs\n

standard named ACLs and we’ll configure\n

Okay, first here are some requirements which\n

PC1 should be able to access the 192.168.2.0/24\n

be able to access 192.168.2.0/24.

So, here’s how I configured and applied\n

First, I configured ACL 1 with an entry permitting\n

That will achieve the first requirement, allowing\n

Then I configured an entry denying the 192.168.1.0/24\nnetwork.

This will fulfill the second requirement.

The order of these is very important.

If I denied 192.168.1.0/24 first, PC1 would\n

if I put an entry permitting PC1 after the\ndeny entry.

Remember, ACLs are processed in order from\ntop to bottom.

Once a match is found, the action is taken\n

entry are not processed, they are ignored.

Finally, I configured a permit any entry at\nthe end.

Remember the implicit deny that is hidden\n

If I don’t include this permit any at the\n

192.168.1.0/24 network, it will block all\nother traffic.

The only device that will be able to access\n

Every single other device would be blocked.

Our requirements don’t tell us to block\n

Finally I applied the ACL to R1’s G0/2 interface\n

I could have, for example, applied it inbound\non G0/1.

Well, here’s a good rule-of-thumb for applying\n

Standard ACLs should be applied as close to\n

You may be thinking, what do I mean by ‘destination’,\n

Well, in this case we are trying to control\n

If I applied ACL 1 inbound on R1’s G0/1\n

subnet except R1 from accessing anything outside\n

However, if I apply it correctly, outbound\n

tries to access the 192.168.2.0/24 network.

So, remember this rule-of-thumb.

Standards ACLs should be applied as close\n

If you don’t do that, you might block more\n

Now let’s see how that ACL will work.

It doesn’t check the ACL yet, because we\n

R1 looks up the destination in its routing\n

However, ACL 1 is applied outbound on G0/2,\n

It starts at the top, with entry 10, permit\n

The ping’s source is PC1, 192.168.1.1, so\nthat’s a match.

It will take the action, which is to permit\n

PC3 will be able to reply, because there is\n

R1 receives the ping on G0/1, but it doesn’t\n

Once again it checks the routing table and\n

of G0/2, but because ACL 1 is applied outbound\n

It checks the top entry first, permit 192.168.1.1/32.

The source of the ping is 192.168.1.2, so\nit doesn’t match.

Then it checks the next entry, deny 192.168.1.0/24.

PC2’s IP is in this subnet, so it matches\n

It won’t forward the ping to PC3.

Okay, now let’s move on to standard named\nACLs.

Standard named ACLs are still standard ACLs,\n

However, instead of a number they are identified\nwith a name.

You could, for example, name the ACL ‘BLOCK_BOB’.

Standard named ACLs are configured by entering\n

then configuring each entry within that mode.

So, a little different than standard numbered\nACLs.

Here’s how you enter that config mode, IP\n

Remember to use IP in front of the command.

For standard numbered ACLs the command is\n

Then you enter standard named ACL config mode\n

Note that you can now specify an entry number\n

If you don’t entries will be numbered 10,\n

Each entry’s number will be 10 more than\nthe previous one.

But with this function, you can manually specify\n

First I create the ACL BLOCK_BOB and enter\n

Then I configured a statement denying 1.1.1.1/32.

Note that I manually configured the entry\n

Then I configured a permit any entry, with\n

This isn’t necessary, of course, but remarks\n

Then I moved to interface configuration mode,\n

IP ACCESS-GROUP, ACL name, and then IN or\nOUT.

Let’s check with some show commands.

Once again, I used SHOW ACCESS-LISTS.

The ACL is shown, and you can see each entry\n

Then I checked the running config.

Notice I used a different method of filtering\n

This displays just the ACL section of the\nrunning config.

If I used ‘INCLUDE ACCESS-LIST’ like before,\n

However, it wouldn’t actually display any\n

don’t include ACCESS-LIST, even though they\n

When I filter using SECTION, I can view the\nwhole ACL.

You can see each entry including the remark,\n

Okay, let’s try configuring some standard\nnamed ACLs on R2.

So, here are the requirements.

PCs in 192.168.1.0/24 can’t access 10.0.2.0/24.

PC3 can’t access 10.0.1.0/24, but other\n

PC1 can access 10.0.1.0/24, but other PCs\n

We’ll need two ACLs to do this properly.

If you think you can, try to solve this yourself.

But I’ll show you my solution.

So, we’ll configure one ACL to control access\n

Then we’ll configure another ACL to control\n

Here’s the first ACL, I called it TO_10.0.2.0/24.

First I denied the 192.168.1.0/24 network,\n

Then I applied it outbound on G0/2.

So, PC1 and PC2 will be blocked from accessing\n

I called the second ACL TO_10.0.1.0/24.

First I denied PC3, 192.168.2.1.

Then I permitted the rest of the PCs in PC3’s\nnetwork.

I then permitted PC1, but denied the other\nPCs in PC1’s network.

Then I permitted all other traffic.

Finally I applied the ACL outbound on the\nG0/1 interface.

ACL configuration can be flexible sometimes,\n

Let’s check those ACLs with SHOW IP ACCESS-LISTS.

Do you notice something strange about the\nTO_10.0.1.0/24 ACL?

Look at the sequence numbers.

30, then 10, then 20, then 40, then 50.

And look at the order I configured them.

The sequence numbers match the order I configured\n

This is a very advanced question about the\n

are processed, you definitely won’t find\n

The router may re-order the /32 entries, the\n

This improves the efficiency of processing\nthe ACL.

However, it does not change the overall effect\nof the ACL.

So, it makes sense for the router to change\n

more efficiently without affecting the outcome.

Note that this is done for both standard named\n

apply to the simpler examples I showed for\n

Also note that I checked in Packet Tracer,\n

It will simply display the entries in order\n

Before finishing up, I’ll just walk through\n

PC2 wants to access server 1, so it pings\nto test connectivity.

The ping reaches R2, which is directly connected\n

However, the TO_10.0.1.0/24 ACL is applied\n

against that ACL before forwarding it.

The source is 192.168.1.2, so it doesn’t\nmatch the top entry.

It doesn’t match the next one either, or\nthe next one.

However, it matches entry 40, because the\n

So, it denies the packet, it does not forward\nit to SRV1.

Okay, let’s review and then move on to the\nquiz.

In this video I covered what ACLs are.

They are used to identify and control traffic\nin the network.

I introduced ACL logic, how ACLs are processed.

The entries in an ACL are processed from top\n

the action is taken and the remaining entries\nare not processed.

I introduced the ACL types you need to know\nfor the CCNA.

They are standard ACLs and extended ACLs,\n

In this video I covered standard ACLs, which\n

the source IP address of the packet.

I showed two main ways of configuring standard\n

They are both just different ways of configuring\nstandard ACLs.

Standard numbered ACLs are configured like\n

config mode with the ACCESS-LIST command.

For standard named ACLs, you use the IP ACCESS-LIST\n

mode, and then configure the entries.

Make sure to watch until the end of today’s\n

the best practice exams for the CCNA, CCNP,\nand more.

Okay, let’s go to question 1 of the quiz.

Which ACL, when applied outbound on R2’s\n

Here are four ACLs, which one fulfills that\nrequirement?

Pause the video to think about your answer.

Entry 10 permits PC1 and entry 20 permits\nPC4.

The implicit deny will deny all other traffic.

So, ACL 1 fulfills the requirements, and the\nother ACLs do not.

Which interface should the following ACL be\n

Here’s the ACL, and here’s the requirement.

Pause the video to think about your answer.

The interface should be R2’s G0/2 interface,\n

Remember that rule-of-thumb, standard ACLs\n

We are controlling access to 10.0.2.0/24,\n

Therefore the ACL should be applied outbound\non R2’s G0/2.

You issue the following commands on R2.

Which statement about the effect of the configurations\n

Here are the configurations on R2.

A, all traffic will be denied.

B, traffic from the 10.0.0.0/24 network will\nbe denied.

C, traffic from the 172.16.0.0/24 network\nwill be denied.

Or D, traffic from the 192.168.0.0/24 network\nwill be denied.

Pause the video to think about your answer.

The answer is B, traffic from the 10.0.0.0/24\n

Each interface can only have one ACL applied\nin each direction.

If you apply another ACL to the same interface\n

In this case, the last ACL you applied was\n

If this ACL is applied inbound on R1 G0/0,\n

Pause the video to think about your answer.

This is because of where the ACL was applied,\n

When the PCs try to ping SRV2, R1 won’t\n

When the reply from SRV2 arrives on R1’s\n

However, the source of the reply will be SRV2’s\n

by the ‘permit any’ at the end of the\nACL.

So, all PCs will be able to successfully ping\nSRV2.

What happens if a packet doesn’t match any\nentries of an ACL?

A, the packet will be forwarded to the default\ngateway.

B, the packet will be checked using the next\navailable ACL.

Or D, the action of the most specific match\nwill be taken.

Pause the video to think about your answer.

The answer is C, the packet will be dropped.

Every ACL includes an ‘implicit deny’\n

don’t match any of the ACL’s entries.

Okay, that’s all for the quiz.

Now let’s take a look at a bonus question\n

Okay, here's today's Boson ExSim practice\nquestion.

Which of the following statements is true\nregarding ACLs?

A, ACLs are processed from the least specific\n

B, ACLs are processed from the first entry\n

C, ACLs are processed from the last entry\n

Or D, ACLs are processed from the most specific\n

Okay, if you just watched the video you should\n

So, pause the video now to think about the\nanswer.

As I mentioned in the video, ACLs are processed\n

So, B should be the correct answer.

I'll select B and then click on show answer.

So, here's Boson's explanation, quite detailed.

You can pause the video now if you want to\n

These explanations are one of the great things\n

Okay, and there's also a reference to both\n

Cisco Press and a link to some Cisco documentation\n

Configuring IP Access Lists: Process ACLs.

So, this is another great resource.

Okay, so that's Boson ExSim for the CCNA.

These are the practice exams I used to study\n

So if you want to get a copy of Boson ExSim,\n

There are supplementary materials for this\nvideo.

There is a flashcard deck to use with the\nsoftware ‘Anki’.

There will also be a packet tracer practice\n

That will be in the next video.

Sign up for my mailing list via the link in\n

the flashcards and packet tracer lab files\nfor the course.

Before finishing today’s video I want to\n

To join, please click the ‘Join’ button\nunder the video.

Thank you to Junhong, OJ, Magrathea, TheGunguy,\n

Prakaash, Nasir, Erlison, Apogee, Marko, Flodo,\n

Funnydart, Scott, Hassan, Marek, Velvijaykum,\n

Devin, Lito, Yonatan, and Vance.

Sorry if I pronounced your name incorrectly,\n

One of you is still displaying as Channel\n

me know and I’ll see if YouTube can fix\nit.

This is the list of JCNP-level members at\n

If you signed up recently and your name isn’t\n

Please subscribe to the channel, like the\n

with anyone else studying for the CCNA.

If you want to leave a tip, check the links\nin the description.

I'm also a Brave verified publisher and accept\n