All language subtitles for 29 - Routing - Using Access Control Lists-eng

>> Okay I'm going to say
some words and I want you

to tell me how you feel when you think about it.

There's a feeling associated with this, okay?

So here we go.

Fuzzy bunny, okay.

How about this one?

Ice cream cone.

Uh-hmm. You get the feeling around that.

Okay, let me throw one more at you.

Subnetting.

[Laughs] Its like, which one of
this is not like the other right?

Now, now I'm hoping at this does
point you, you've had a chance to go

through this series and you
gone through subnetting.

You're feeling-- you're feeling like a fuzzy
bunny right, when you think about something.

But I would tell, think about how you felt
about it before you gotten those nuggets

and before you had an understanding
of subnetting.

Well, that's how a lot of people feel
when I say the word, Access Control List.

Yes, that's three words.

But when I say that, people go
[inaudible], because it's a big concept.

There's a lot wrapped around it because it's use
for a ton of things inside of the Cisco device

and there is some understanding
that has to go with it.

As in, if you've encountered
Access Control Lists before, you--

a lot of times will walk with if you've
encountered them in the real world,

or heard of them, seen them before.

You walk way go "Whoa!"

That was one of those weird
and I didn't quite get that.

Well, I'm hoping that by the time
we're done here, you will feel the same

about Access Control List
as you do about ice cream

and fuzzy bunnies and even hopefully subnetting.

We're going to look at what these are,

what they're use for 'cause
they're not just for access?

It's not just for turning a router

into a firewall although that's
one thing you can do with them.

We'll look at how to use them
for security how they are use

and then we'll look at types
of access control list.

Let's start of with what they are, definition.

An Access-Lists is nothing more than a list,

that's the name implies of
permit and deny statements.

So you can see right here on the
screen, I've got permit 192.168.2.50,

so immediately the question
is, permit it to what?

Well, we're not going to
talk about that right now.

[Laughs] That got to kind of comes later.

So okay, well what about the-- okay
deny 192.168.1.0, that the whole subnet.

Immediately our mind goes to denied from what?

Well, we're not going to talk right

because that's not what an
Access-List is, that's how it's applied.

Now, I'm being very intentional with
my words here because I really want you

to catch what an Access-List--
let's to do it one more.

Permit TCP Port 80 for this host, okay?

Do you see how it leaves you feeling
incomplete like you're only half way there?

You're like, okay, I get it.

You're permitting that port so-- so what?

To that server from that server, what is
being permitted to do or like you feel,

like I get what the statement says, it's
like if somebody walked up you, you know,

then they're kind of twitching and they're
like, "The brown cow jumped over the bridge."

And you're looking there like, "I have
no contacts to what you're saying.

You are crazy."

Well, that's what an Access-List by itself is.

It's crazy.

It's just a list of permit and deny
statements that do nothing until--

okay, okay so I've given you, this
is the technical definition right?

Here's what it is.

Access-Lists are a matching mechanism, right?

It is a matching mechanism.

So, I'm trying to think of a good analogy.

I can't even-- let's do this.

I'm making this on the fly
so we'll see if it works.

So let's say, let's say that you had
a million dollars and you're like,

I'm going to give this money away.

And so, there's-- there's-- you've put an ad
in the paper and a thousand people come to you

and say, "I want your million dollars."

And so you're like, "Okay.

Well, I can't just give it to all 1000 of you.

I have to filter you down.

I have to kind of, you know, figure
out criteria that I want to make."

I'm like, as I'm thinking,
where is analogy going?

Jeremy [phonetic] is going to
teach us how to discriminate today.

I'm sorry, I don't know how
this is going to work out.

So, let's just say, you're like, okay, everybody
and all thousand people are in front of you.

You're like, "Everybody that has a blue shirt.

I'm sorry you don't get the million dollars.

Just go home.

Okay, everybody that makes this amount of money
or more, you don't need my million dollars.

You make enough.

Go home." So you start filtering all
this things until you finally get what--

what you want, the things that are left.

That's a weird analogy but that's
kind of what an Access-List is.

So, now put in perspective of your router.

It doesn't have a million dollars but it does
have a ton of traffic going in and out of it.

And there's times where you want to much
certain stuff to do something with it.

You want to-- you want to for instance
match your voice over IP traffic.

Why? Because you want to tell the router that's
special, it's very special traffic that goes

above everything else and has the priority
and to do that we use, an Access-List.

Now, it's an Access-List that's applied
in the way of quality of service.

That's one way that we apply.

Or you might say, "Okay, okay,
I've got-- I've got net set up."

So you know, up here is the internet.

And I want to make sure that people can surf
the internet, and I'm going to translate,

then I'm going to apply net,
network address translation

so that the people are able
to access the internet.

Well, when you do net, you have to
specify what traffic gets netted.

So that is done by an Access-List.

It-- It's you know, when you
see this, you're like, "Oh man,

that totally feels like a firewall."

Right? It's like permit and
deny and all-- all that.

It feels like-- feels like a firewall
and that is absolutely one way

that you can use an Access-List is like
a firewall to say, this is allowed,

this is blocked, but there is, so many features
in the Cisco Router that depend on being able

to identify traffic and that's
all an Access-List is.

So, so that's why I left a
very vague at the beginning.

I'm like, "Well, here is a list of
statements", and I said, "Permit this.

Deny that."

But I wouldn't go-- I wouldn't go there.

I wouldn't say, well, here's how it's applied
because how you apply it depends on what kind

of feature you're looking to create.

Now, I put making french toss in there.

That's not literal.

I'm just saying that, I mean, this list can go
on and on and on, any feature in the Cisco IOS,

in the Cisco Router that requires
you to identify a certain set

of traffic is almost always going to
be identifies using an Access-List.

Let me illustrate this by giving you an
example of one of the more common ways

that Access-Lists are used
and that is for security.

This is-- this is when people hear the term
Access-Lists, immediately what their mind goes

to because they're like, oh, that's
sounds like a, you know, access,

security kind of function then they
can definitely be used with that.

So, first thing that we do is go into
global configuration mode and create a list.

Now, you actually identified the
list by either a number or a name.

We'll look at the config in the next nugget.

So, let's just say I create
list number 50 and in that list,

the first statement that
I make is Permit 10.1.5.1.

Maybe that's-- that's specific host
that I'm really want to focus on.

Now, the second one is there's a sky has been
surfing the web all day, I'm done with in.

I'm denying 192.168.1.53.

Then I go down and I say, well, but you know
what the subnet 172.30.0.0 /16 so that means,

essentially the first two octets of that
subnet are or what to look at and permitted.

So, if I have you know, some guy down
here, that's 172.30.1.52, he'll come in,

the routers says, okay, well you are 172.30/16"
that's says first two octets are relevant.

So that's what I'm going to look at.

So you are permitted.

I don't really care that
you have 1.52 on the end.

That's fine.

So, so that's kind of how the list is right.

Now, let's look at the rules.

The list is red from top to the bottom
and it will stop at the first match.

Men, I should have thought of a better example.

So let's say, okay, let's imagine this.

Pretend that's not that.

It is actually 172.30.1.5 right?

There is that PC.

So, let's say, that host is out here.

He comes into the router.

He says, "Hey, I'm 172.30.1.5."

It says, "Okay are you this person?"

"Nope, I'm not.

'Cause if you were, you wouldn't have permitted.

Are you this person?"

He goes, "Yes, I am.

I'm sorry you're denied."

It does not go on to the next name and
to find out, well, actually you would--

would have permitted if you
would have made it this far.

It's like one of those movies you know,
where somebody's reaching for that--

the serum that would cure them from
the poison, whatever they just drunk

and then they die like a centimeter away.

I hate those kind of movies.

But they died just like a centimeter away.

So it's like, well, if you
would have just made it further,

you would have but I'm sorry, we had to deny.

Now, at the bottom of this
Access-List, is an 'implicit deny'.

You don't see it.

You don't-- it won't show up in the show
commands or anything like that but it's there.

Meaning, as soon as you create an Access-List,
you say, do this, do that, do this, do that,

you create this list of statements and
the list goes on and on and on, however,

long you wanted to be, there is no
cap on how big this list can be.

You can make them 500 statements if you want to.

But at the very end of it is an implicit deny.

And what that means is, if you have not been
permitted somewhere in this list and you get

to the end, you're going to be denied.

Totally reverses the way that routers
work as soon as you apply one of this.

Routers unlike firewalls, routers
when you connect up you know,

we've got FastEthernet0/0 connected
will whole bunch of computers over here

and they're all happy and they're
trying to search the internet,

routers by default will like,
"Hey, everybody's welcome.

Come on in.

You know, come on in.

You're welcome too."

No permission restriction whatsoever.

These guys can freely past in the internet
and the internet can freely past to him

without an issue until you
apply your first Access-List.

It's like putting this little
guard on the line you know, here--

here's our little guard standing here.

If that's where I apply it, I
don't know why he's head's a cloud.

That's his hat, I supposed.

So the guard is sitting there and he
is protecting the router you know,

from stuff coming to the internet or,
from stuff going out to the internet.

We don't know.

We have to discuss the direction first of all.

But that's what that guy is here to do.

So, as soon as I apply an
Access-List, no more is.

There are these free for all.

Everybody is allowed.

We had now have implicit deny to
deal with, more on that later.

Access-List is applied to an
interface inbound or outbound.

This is one of two of the most difficult
things to get with Access-List, perspective.

How does this impact to router?

So, so when I create Access-List 50,
it-- let me just give you a heads up.

This is going to be created
in global configuration mode.

Global as in, remember things that
created in global impact the whole router.

So, from global configuration, I make this
list, but it's not going to do anything

until I go and assign it to an interface.

This list says we're trying out security.

So let's say, I go into FastEthernet0/0, the
command allows me to apply this so I would say,

you know, I'll show you the command on
the next lecture but in plane English,

apply Access-List 50 and I can
either type an inbound or outbound

and that is one of the most confusing things.

People use to-- so what does that mean?

Like out from the internet,
out from, in from the router.

Like this words, just the words themselves,
they're like, what do you mean in or out?

Like in from here?

Or in from there?

Or out from, what does that mean?

When you're thinking-- let me give you, I'll
mention this so when we get to config again.

But one of the biggest things that
you can do to catch the direction

to figure this out is be a router.

I'm serious.

Let's say we've got a router right here.

It's got two interfaces FastEthernet0/1
and FastEthernet0/0.

I'm trying to figure out the direction.

I know that I want to filter you know,
right here is the internet right?

And I want to filter you know, all this
internet traffic that's coming to me and I have

to decide what direction to I apply?

In or out?

You know, what is that?

Be the router.

So, if I'm the router you
know, you hold out your arms.

I do all this all the time.

I know it's weird.

But I hold up my arms to where I'm--

I'm like you know, flying like
a-- like a guy who's flying.

So my arms are straight out from my side
and I look at my right arm and I look at

and say, "You are FastEthernet0/0."

I look at to my left arm which
is-- which is whole lot to decide.

And you're arem-- do this with me please.

Put your arms up.

It's going to feel weird.

It's all right.

Nobody's watching.

On the left arm, that's FastEthernet0/0.

So, this is-- let me, I got
to show you a picture.

This is literally me with bigger arms right
now, standing out your, and me being the router,

this is a FA0/0, this is 0/1 and I'm going to
say, okay so if apply it out on this interface.

If I say Access-List 50 that means it's coming
out of me like out of my soul right here.

Traffic is coming out.

So, if it's coming out me
where is it coming from?

Somewhere else.

It probably came in my right
arm and decided to go out--

out my left arm or maybe I have a
WAN link in my head, it's coming in--

in there, you know, that's coming
in there but it's going out here

because the routing table said it had
to go out there to get to the internet.

So, again me being the router,
holding my arms out to my sides,

I look and I go, okay so
it's going out that way.

The-- you know, so if I were to say, "Okay well,

I don't want to filter stuff
going to the internet.

I want to filter coming from the internet."

Again, holding my arms out, I'm looking them
go, okay, then it must be coming in my right arm

or right arm depending on
which perspective you had.

It's coming in my right arm.

So that's-- so I'm applying
it in FastEthernet0/0.

Be a router.

It's the best thing that you
can be when you're trying to do.

Now, I don't stick my arms
at all the way if I'm in a--

in a data center something
could do-- what are you doing?

But I still use my fingers.

I mentally, I visually have to do it for myself.

I point with my fingers.

I go, "Okay, so I'm going out
this direction so it's can be in".

The reason-- you might say,
"Okay Jeremy, I get it.

Stop now. Why are you emphasizing it?"

'Cause this is the fastest way
to take down and entire network.

What I just told you was that at the bottom

of every single Access-List
is an implicit deny, right?

Deny everything.

So if I am applying that in the wrong direction,
you know, and maybe I meant to, you know,

say "Permit this, permit, deny
that, permit this", you know.

And so I'm saying these people are
allowed to surf the internet right?

So if I said, this people from my organization,
and all those happy people exist over here.

They need to surf the internet so I
would say, "Okay, well they are allowed

to go out the internet connection."

You know, so this would be applied outbound.

What if I mistakenly apply to inbound?

Well, all of these are private IP addresses.

They don't exist on the internet.

So by applying this Access-List on the inbound--

oops, I did the wrong direction by
applying it inbound right there,

none of these will come in from the internet.

So, essentially, in all internet traffic,
you will say, "No, you're not this.

No you're not this.

No, no, no, no, no, no.

Denied." You pretty much took down
the entire internet connection

for the company by applying to wrong direction.

You may had have the greatest Access-List
in the world, but just by that one command,

you can savor your connection
and I can tell you, I've done it.

I've done it more times that I'm
ashamed to tell you right now.

Because sometimes you just keep going and
like, oh, oh, apply and here's the worst thing.

The worst thing of it all, is you're managing--
let's say, you're managing this router

and you happen to be sitting at home at you
know, 1:00 in the afternoon, that's a worst.

Or maybe 1:00 in the morning and you apply
the Access-List in the wrong direction

and you savor you connection to the router.

You're telling that session dies.

You're SSH doesn't [inaudible] because you just
cut of your access to that rather remotely.

I've been there.

I know what it feels like to be calling people
at 2:00 in the morning saying, "I'm sorry.

I need to be late into the building.

Yes I know.

I know what time it is but you're
company will be off-line in the morning.

Yes, yes. I'm sorry.

That's sad day."

You know, all are smiling
aside that is a sad day.

So, that's why it's hugely emphasized
how important the direction is.

There are multiple types of
Access-List that you can create.

However, boil it down to two that
you will use on a regular daily,

almost daily basis depending on what you do.

They are Standard Access-List
and Extended Access-List.

Standard Access-List is used
to match things based on only;

we should put little, only the source address.

Because of that, they have lower
processor utilization and you know,

the effect that they have depends on how you
apply them and that goes for any Access-List.

So let me expand a little bit on that.

When I say a Standard Access,
that's only matches on the source.

Let's again say that we're
applying it in terms of security.

I've go a router here that has a
connection to two different PCs.

Top PC is 10.1.1.50, bottom is 10.1.1.51 okay?

Standard Access-List can filter
only on the source address.

So, I can say, 10.1.1.50 is permitted.

10.1.1.51 is denied.

So I can't, you know, when you
said, well denied from what?

Denied how?

Well, again it depends on where you apply.

So let me-- let me give a
couple of more connections.

Let's say, we got a WAN link there,
maybe this connects to a branch office,

Texas, you know, or whatever you know.

So, you've got a bigger network here.

So let's say, I want 10.1.1.50 to
be permitted to access the internet;

10.1.1.51 to be denied for accessing the net.

So what I can do is apply
that outbound right here.

So as this guy, tries to go
out to access the internet,

he will be filter and says, "Oh you're allowed.

Okay great."

You can go through.

This guy, as he comes in,
it will say, "Oops, sorry.

Denied." You are not going to be access that.

Now, let me just-- I'm getting a
little ahead of myself but that's okay.

Some of your might look at this and say, "Well,

could I have applied this Access-List
instead of outbound right here?

Could have I applied it inbound right here?"

Yes, you can do almost anything
and the Cisco Router.

However, would not have the desired result,
because what would happen is this guy

as he tried to get into that interface,
it would say, "you're permitted",

so he's in now he can go wherever he wants
to, right here, right here, right here.

This guy when he tries to get in, maybe I only
wanted to filter him from internet access right?

But as soon as he tries to get
in, what's the access will say?

Deny, 10.1.1.51 is denied so he
can even get to the branch office.

He can't go out whatever that link goes to.

Surely he can't go out to the internet, but
we may have cut them off from too much stuff.

So, when I say, affect depends on application,
you can see, just based on the one router

that I have in this picture, where
you apply it makes the difference.

Extended Access-List.

Now-- but let me also mention one more thing.

Standard Access-List can be use but
are not often used for security.

The reason why is they catch too much and most
people say, okay, well I want to deny them

if he goes there but not there and if
he uses this port or things like that,

Standard Access-Lists are usually used for
other applications like, quality of service.

I could say, this whole in that work gets the
priority over that one, anywhere that they go.

That's easy to match with
the Standard Access-List.

I could say, you know, for instance, this
whole network is allowed to be netted.

Network address translation, that's
another common use of Standard Access-List.

So, it can be used for security
but it's too often.

Extended is where the security
is most often used.

This one matches based on source and destination
address or IP address as well as the protocol

and the source and destination port numbers.

So, let me define this.

So the source and destination IP address
is who you are and where you're going.

So what I can do is apply in the Extended
here that says, I want to permit this guy

if he is accessing the website of
DNS server or whatever 4.2.2.2.

Otherwise I want to deny it.

I can't do that with the Standard Access-List.

The standard just says, "This
is you and you are permitted."

I can say from what or from where
whereas an extended, I can't.

So source and destination IP address.

Protocol. Protocol meaning
the sub-protocols of TCP/IP.

When you first learned TCP/IP, you quickly
realize there's more to it than meets that I.

There is TCP.

There is UDP.

There is ICMP which is use for
things like pings and all that.

TCP and UDP we've talked about.

I think we even mentioned this one.

There is ESP which is use for VPNs.

And we're getting to things like OSPF.

I mean these are all protocols that exist
inside of this TCP/IP protocol suite

and technically at layer 4 of the OSM model.

We can match anyone of those
using extended Access-List.

So I can say maybe I want to allow TCP Port 80,
and we'll talk about port numbers a little bit.

But deny UDP Port 80.

I can separate those but allow pings
which is "Echo request" from ICPM.

So there're all kinds of things I can
do with the protocol and then source

and destination port numbers, that's
the actual, you know, so I can say TCP.

I want to allow all of TCP or maybe I
just wanted to do Port 80 which is HTTP,

that's what that port lines up to.

Or maybe I want to only allow
Port 25 which is SMTP.

That's e-mail services.

Now, this guy does cause for Higher Processor
Utilization because he's examining more

so it's going to cause a
little more on that side.

And this one is where that fear
of Access-Lists comes from.

That syntax of it takes a little
time to learn and get use to.

So give yourself some grace when you're learning
this that it may take you a couple of times,

okay, it's one of those like subnetting.

First time you see like, what?

You know, and then as you see
it more and more like, "Okay,

I'm starting to piece this together."

Last one is something called
a Reflexive Access-Lists.

We may talk about this one.

What this does is allow return
traffic for internal request.

Here's what that means.

Sometimes when people first think and
learn about Access-List, they go crazy.

What did I just do?

Here we go.

They go a little bit crazy because they are
like, "Okay, you know, I want to come in here

and I want to make sure that my network
is secure so I am going to deny everything

from the internet 'cause there're
all kinds of mean people out here.

We want to block them all and you
know, I keep them out of my network."

Well that's great but what happens when
your internal computer comes in and says,

well I want to get to Google or I want to get to
Microsoft.com to do some researcher Cisco.com.

And Cisco tries to send website
information back to you well, they can't.

So yes, you know, it's kind of like perfect
security, you would never have anybody be able

to do anything and now you are secure.

That is true.

But we have to allow some usability.

So when you bring that up, you're like oh, well
is there a way that I can watched it somehow

and when it-- they rather see something being
requested then I allow just what was requested

to come back.

The answer is yeah.

That's exactly what it reflects
of Access-List does.

Some people call it TCP Established
Access-Lists.

So that's, I mean your router has eyes.

And as traffic goes out, it's
always watching and says, "Okay,

I see what destination you're going to.

What port you're going on.

What sequence number you're using."

So when that side and only that
site, only responding to the request

that I saw comes back, I will
allow it to come through.

But once we're done, once we tear down that
connection and when you close your browser

or whatever, we kill the TCP session,

now that website will be denied
from ever coming in uninvited.

So here we go again, you're ready?

Fuzzy bunny.

I'm just kidding.

And so, do Access-List feel a little better?

Probably not!

Honestly, at this point, if I were
you, you know, you might say, okay,

well, I kind of see what you're doing.

And I get the concepts but
Access-Lists are really learned by doing.

And that's what I planned on using the next two
nuggets to do is go through Access-List with,

I mean just like we did subnetting
example, after example.

Okay, get it, example again.

Okay, get that?

Okay, example again.

So we just keep seeing it and seeing it until
we are absolutely 100 percent sure we've got it.

For now, I hope this been informative for
you and I'd like to thank you for viewing.