Original subtitles

>> Okay I'm going to say some words and I want you

to tell me how you feel when you think about it.

There's a feeling associated with this, okay?

So here we go.

Fuzzy bunny, okay.

How about this one?

Ice cream cone.

Uh-hmm. You get the feeling around that.

Okay, let me throw one more at you.

Subnetting.

[Laughs] Its like, which one of this is not like the other right?

Now, now I'm hoping at this does point you, you've had a chance to go

through this series and you gone through subnetting.

You're feeling-- you're feeling like a fuzzy bunny right, when you think about something.

But I would tell, think about how you felt about it before you gotten those nuggets

and before you had an understanding of subnetting.

Well, that's how a lot of people feel when I say the word, Access Control List.

Yes, that's three words.

But when I say that, people go [inaudible], because it's a big concept.

There's a lot wrapped around it because it's use for a ton of things inside of the Cisco device

and there is some understanding that has to go with it.

As in, if you've encountered Access Control Lists before, you--

a lot of times will walk with if you've encountered them in the real world,

or heard of them, seen them before.

You walk way go "Whoa!"

That was one of those weird and I didn't quite get that.

Well, I'm hoping that by the time we're done here, you will feel the same

about Access Control List as you do about ice cream

and fuzzy bunnies and even hopefully subnetting.

We're going to look at what these are,

what they're use for 'cause they're not just for access?

It's not just for turning a router

into a firewall although that's one thing you can do with them.

We'll look at how to use them for security how they are use

and then we'll look at types of access control list.

Let's start of with what they are, definition.

An Access-Lists is nothing more than a list,

that's the name implies of permit and deny statements.

So you can see right here on the screen, I've got permit 192.168.2.50,

so immediately the question is, permit it to what?

Well, we're not going to talk about that right now.

[Laughs] That got to kind of comes later.

So okay, well what about the-- okay deny 192.168.1.0, that the whole subnet.

Immediately our mind goes to denied from what?

Well, we're not going to talk right

because that's not what an Access-List is, that's how it's applied.

Now, I'm being very intentional with my words here because I really want you

to catch what an Access-List-- let's to do it one more.

Permit TCP Port 80 for this host, okay?

Do you see how it leaves you feeling incomplete like you're only half way there?

You're like, okay, I get it.

You're permitting that port so-- so what?

To that server from that server, what is being permitted to do or like you feel,

like I get what the statement says, it's like if somebody walked up you, you know,

then they're kind of twitching and they're like, "The brown cow jumped over the bridge."

And you're looking there like, "I have no contacts to what you're saying.

You are crazy."

Well, that's what an Access-List by itself is.

It's crazy.

It's just a list of permit and deny statements that do nothing until--

okay, okay so I've given you, this is the technical definition right?

Here's what it is.

Access-Lists are a matching mechanism, right?

It is a matching mechanism.

So, I'm trying to think of a good analogy.

I can't even-- let's do this.

I'm making this on the fly so we'll see if it works.

So let's say, let's say that you had a million dollars and you're like,

I'm going to give this money away.

And so, there's-- there's-- you've put an ad in the paper and a thousand people come to you

and say, "I want your million dollars."

And so you're like, "Okay.

Well, I can't just give it to all 1000 of you.

I have to filter you down.

I have to kind of, you know, figure out criteria that I want to make."

I'm like, as I'm thinking, where is analogy going?

Jeremy [phonetic] is going to teach us how to discriminate today.

I'm sorry, I don't know how this is going to work out.

So, let's just say, you're like, okay, everybody and all thousand people are in front of you.

You're like, "Everybody that has a blue shirt.

I'm sorry you don't get the million dollars.

Just go home.

Okay, everybody that makes this amount of money or more, you don't need my million dollars.

You make enough.

Go home." So you start filtering all this things until you finally get what--

what you want, the things that are left.

That's a weird analogy but that's kind of what an Access-List is.

So, now put in perspective of your router.

It doesn't have a million dollars but it does have a ton of traffic going in and out of it.

And there's times where you want to much certain stuff to do something with it.

You want to-- you want to for instance match your voice over IP traffic.

Why? Because you want to tell the router that's special, it's very special traffic that goes

above everything else and has the priority and to do that we use, an Access-List.

Now, it's an Access-List that's applied in the way of quality of service.

That's one way that we apply.

Or you might say, "Okay, okay, I've got-- I've got net set up."

So you know, up here is the internet.

And I want to make sure that people can surf the internet, and I'm going to translate,

then I'm going to apply net, network address translation

so that the people are able to access the internet.

Well, when you do net, you have to specify what traffic gets netted.

So that is done by an Access-List.

It-- It's you know, when you see this, you're like, "Oh man,

that totally feels like a firewall."

Right? It's like permit and deny and all-- all that.

It feels like-- feels like a firewall and that is absolutely one way

that you can use an Access-List is like a firewall to say, this is allowed,

this is blocked, but there is, so many features in the Cisco Router that depend on being able

to identify traffic and that's all an Access-List is.

So, so that's why I left a very vague at the beginning.

I'm like, "Well, here is a list of statements", and I said, "Permit this.

Deny that."

But I wouldn't go-- I wouldn't go there.

I wouldn't say, well, here's how it's applied because how you apply it depends on what kind

of feature you're looking to create.

Now, I put making french toss in there.

That's not literal.

I'm just saying that, I mean, this list can go on and on and on, any feature in the Cisco IOS,

in the Cisco Router that requires you to identify a certain set

of traffic is almost always going to be identifies using an Access-List.

Let me illustrate this by giving you an example of one of the more common ways

that Access-Lists are used and that is for security.

This is-- this is when people hear the term Access-Lists, immediately what their mind goes

to because they're like, oh, that's sounds like a, you know, access,

security kind of function then they can definitely be used with that.

So, first thing that we do is go into global configuration mode and create a list.

Now, you actually identified the list by either a number or a name.

We'll look at the config in the next nugget.

So, let's just say I create list number 50 and in that list,

the first statement that I make is Permit 10.1.5.1.

Maybe that's-- that's specific host that I'm really want to focus on.

Now, the second one is there's a sky has been surfing the web all day, I'm done with in.

I'm denying 192.168.1.53.

Then I go down and I say, well, but you know what the subnet 172.30.0.0 /16 so that means,

essentially the first two octets of that subnet are or what to look at and permitted.

So, if I have you know, some guy down here, that's 172.30.1.52, he'll come in,

the routers says, okay, well you are 172.30/16" that's says first two octets are relevant.

So that's what I'm going to look at.

So you are permitted.

I don't really care that you have 1.52 on the end.

That's fine.

So, so that's kind of how the list is right.

Now, let's look at the rules.

The list is red from top to the bottom and it will stop at the first match.

Men, I should have thought of a better example.

So let's say, okay, let's imagine this.

Pretend that's not that.

It is actually 172.30.1.5 right?

There is that PC.

So, let's say, that host is out here.

He comes into the router.

He says, "Hey, I'm 172.30.1.5."

It says, "Okay are you this person?"

"Nope, I'm not.

'Cause if you were, you wouldn't have permitted.

Are you this person?"

He goes, "Yes, I am.

I'm sorry you're denied."

It does not go on to the next name and to find out, well, actually you would--

would have permitted if you would have made it this far.

It's like one of those movies you know, where somebody's reaching for that--

the serum that would cure them from the poison, whatever they just drunk

and then they die like a centimeter away.

I hate those kind of movies.

But they died just like a centimeter away.

So it's like, well, if you would have just made it further,

you would have but I'm sorry, we had to deny.

Now, at the bottom of this Access-List, is an 'implicit deny'.

You don't see it.

You don't-- it won't show up in the show commands or anything like that but it's there.

Meaning, as soon as you create an Access-List, you say, do this, do that, do this, do that,

you create this list of statements and the list goes on and on and on, however,

long you wanted to be, there is no cap on how big this list can be.

You can make them 500 statements if you want to.

But at the very end of it is an implicit deny.

And what that means is, if you have not been permitted somewhere in this list and you get

to the end, you're going to be denied.

Totally reverses the way that routers work as soon as you apply one of this.

Routers unlike firewalls, routers when you connect up you know,

we've got FastEthernet0/0 connected will whole bunch of computers over here

and they're all happy and they're trying to search the internet,

routers by default will like, "Hey, everybody's welcome.

Come on in.

You know, come on in.

You're welcome too."

No permission restriction whatsoever.

These guys can freely past in the internet and the internet can freely past to him

without an issue until you apply your first Access-List.

It's like putting this little guard on the line you know, here--

here's our little guard standing here.

If that's where I apply it, I don't know why he's head's a cloud.

That's his hat, I supposed.

So the guard is sitting there and he is protecting the router you know,

from stuff coming to the internet or, from stuff going out to the internet.

We don't know.

We have to discuss the direction first of all.

But that's what that guy is here to do.

So, as soon as I apply an Access-List, no more is.

There are these free for all.

Everybody is allowed.

We had now have implicit deny to deal with, more on that later.

Access-List is applied to an interface inbound or outbound.

This is one of two of the most difficult things to get with Access-List, perspective.

How does this impact to router?

So, so when I create Access-List 50, it-- let me just give you a heads up.

This is going to be created in global configuration mode.

Global as in, remember things that created in global impact the whole router.

So, from global configuration, I make this list, but it's not going to do anything

until I go and assign it to an interface.

This list says we're trying out security.

So let's say, I go into FastEthernet0/0, the command allows me to apply this so I would say,

you know, I'll show you the command on the next lecture but in plane English,

apply Access-List 50 and I can either type an inbound or outbound

and that is one of the most confusing things.

People use to-- so what does that mean?

Like out from the internet, out from, in from the router.

Like this words, just the words themselves, they're like, what do you mean in or out?

Like in from here?

Or in from there?

Or out from, what does that mean?

When you're thinking-- let me give you, I'll mention this so when we get to config again.

But one of the biggest things that you can do to catch the direction

to figure this out is be a router.

I'm serious.

Let's say we've got a router right here.

It's got two interfaces FastEthernet0/1 and FastEthernet0/0.

I'm trying to figure out the direction.

I know that I want to filter you know, right here is the internet right?

And I want to filter you know, all this internet traffic that's coming to me and I have

to decide what direction to I apply?

In or out?

You know, what is that?

Be the router.

So, if I'm the router you know, you hold out your arms.

I do all this all the time.

I know it's weird.

But I hold up my arms to where I'm--

I'm like you know, flying like a-- like a guy who's flying.

So my arms are straight out from my side and I look at my right arm and I look at

and say, "You are FastEthernet0/0."

I look at to my left arm which is-- which is whole lot to decide.

And you're arem-- do this with me please.

Put your arms up.

It's going to feel weird.

It's all right.

Nobody's watching.

On the left arm, that's FastEthernet0/0.

So, this is-- let me, I got to show you a picture.

This is literally me with bigger arms right now, standing out your, and me being the router,

this is a FA0/0, this is 0/1 and I'm going to say, okay so if apply it out on this interface.

If I say Access-List 50 that means it's coming out of me like out of my soul right here.

Traffic is coming out.

So, if it's coming out me where is it coming from?

Somewhere else.

It probably came in my right arm and decided to go out--

out my left arm or maybe I have a WAN link in my head, it's coming in--

in there, you know, that's coming in there but it's going out here

because the routing table said it had to go out there to get to the internet.

So, again me being the router, holding my arms out to my sides,

I look and I go, okay so it's going out that way.

The-- you know, so if I were to say, "Okay well,

I don't want to filter stuff going to the internet.

I want to filter coming from the internet."

Again, holding my arms out, I'm looking them go, okay, then it must be coming in my right arm

or right arm depending on which perspective you had.

It's coming in my right arm.

So that's-- so I'm applying it in FastEthernet0/0.

Be a router.

It's the best thing that you can be when you're trying to do.

Now, I don't stick my arms at all the way if I'm in a--

in a data center something could do-- what are you doing?

But I still use my fingers.

I mentally, I visually have to do it for myself.

I point with my fingers.

I go, "Okay, so I'm going out this direction so it's can be in".

The reason-- you might say, "Okay Jeremy, I get it.

Stop now. Why are you emphasizing it?"

'Cause this is the fastest way to take down and entire network.

What I just told you was that at the bottom

of every single Access-List is an implicit deny, right?

Deny everything.

So if I am applying that in the wrong direction, you know, and maybe I meant to, you know,

say "Permit this, permit, deny that, permit this", you know.

And so I'm saying these people are allowed to surf the internet right?

So if I said, this people from my organization, and all those happy people exist over here.

They need to surf the internet so I would say, "Okay, well they are allowed

to go out the internet connection."

You know, so this would be applied outbound.

What if I mistakenly apply to inbound?

Well, all of these are private IP addresses.

They don't exist on the internet.

So by applying this Access-List on the inbound--

oops, I did the wrong direction by applying it inbound right there,

none of these will come in from the internet.

So, essentially, in all internet traffic, you will say, "No, you're not this.

No you're not this.

No, no, no, no, no, no.

Denied." You pretty much took down the entire internet connection

for the company by applying to wrong direction.

You may had have the greatest Access-List in the world, but just by that one command,

you can savor your connection and I can tell you, I've done it.

I've done it more times that I'm ashamed to tell you right now.

Because sometimes you just keep going and like, oh, oh, apply and here's the worst thing.

The worst thing of it all, is you're managing-- let's say, you're managing this router

and you happen to be sitting at home at you know, 1:00 in the afternoon, that's a worst.

Or maybe 1:00 in the morning and you apply the Access-List in the wrong direction

and you savor you connection to the router.

You're telling that session dies.

You're SSH doesn't [inaudible] because you just cut of your access to that rather remotely.

I've been there.

I know what it feels like to be calling people at 2:00 in the morning saying, "I'm sorry.

I need to be late into the building.

Yes I know.

I know what time it is but you're company will be off-line in the morning.

Yes, yes. I'm sorry.

That's sad day."

You know, all are smiling aside that is a sad day.

So, that's why it's hugely emphasized how important the direction is.

There are multiple types of Access-List that you can create.

However, boil it down to two that you will use on a regular daily,

almost daily basis depending on what you do.

They are Standard Access-List and Extended Access-List.

Standard Access-List is used to match things based on only;

we should put little, only the source address.

Because of that, they have lower processor utilization and you know,

the effect that they have depends on how you apply them and that goes for any Access-List.

So let me expand a little bit on that.

When I say a Standard Access, that's only matches on the source.

Let's again say that we're applying it in terms of security.

I've go a router here that has a connection to two different PCs.

Top PC is 10.1.1.50, bottom is 10.1.1.51 okay?

Standard Access-List can filter only on the source address.

So, I can say, 10.1.1.50 is permitted.

10.1.1.51 is denied.

So I can't, you know, when you said, well denied from what?

Denied how?

Well, again it depends on where you apply.

So let me-- let me give a couple of more connections.

Let's say, we got a WAN link there, maybe this connects to a branch office,

Texas, you know, or whatever you know.

So, you've got a bigger network here.

So let's say, I want 10.1.1.50 to be permitted to access the internet;

10.1.1.51 to be denied for accessing the net.

So what I can do is apply that outbound right here.

So as this guy, tries to go out to access the internet,

he will be filter and says, "Oh you're allowed.

Okay great."

You can go through.

This guy, as he comes in, it will say, "Oops, sorry.

Denied." You are not going to be access that.

Now, let me just-- I'm getting a little ahead of myself but that's okay.

Some of your might look at this and say, "Well,

could I have applied this Access-List instead of outbound right here?

Could have I applied it inbound right here?"

Yes, you can do almost anything and the Cisco Router.

However, would not have the desired result, because what would happen is this guy

as he tried to get into that interface, it would say, "you're permitted",

so he's in now he can go wherever he wants to, right here, right here, right here.

This guy when he tries to get in, maybe I only wanted to filter him from internet access right?

But as soon as he tries to get in, what's the access will say?

Deny, 10.1.1.51 is denied so he can even get to the branch office.

He can't go out whatever that link goes to.

Surely he can't go out to the internet, but we may have cut them off from too much stuff.

So, when I say, affect depends on application, you can see, just based on the one router

that I have in this picture, where you apply it makes the difference.

Extended Access-List.

Now-- but let me also mention one more thing.

Standard Access-List can be use but are not often used for security.

The reason why is they catch too much and most people say, okay, well I want to deny them

if he goes there but not there and if he uses this port or things like that,

Standard Access-Lists are usually used for other applications like, quality of service.

I could say, this whole in that work gets the priority over that one, anywhere that they go.

That's easy to match with the Standard Access-List.

I could say, you know, for instance, this whole network is allowed to be netted.

Network address translation, that's another common use of Standard Access-List.

So, it can be used for security but it's too often.

Extended is where the security is most often used.

This one matches based on source and destination address or IP address as well as the protocol

and the source and destination port numbers.

So, let me define this.

So the source and destination IP address is who you are and where you're going.

So what I can do is apply in the Extended here that says, I want to permit this guy

if he is accessing the website of DNS server or whatever 4.2.2.2.

Otherwise I want to deny it.

I can't do that with the Standard Access-List.

The standard just says, "This is you and you are permitted."

I can say from what or from where whereas an extended, I can't.

So source and destination IP address.

Protocol. Protocol meaning the sub-protocols of TCP/IP.

When you first learned TCP/IP, you quickly realize there's more to it than meets that I.

There is TCP.

There is UDP.

There is ICMP which is use for things like pings and all that.

TCP and UDP we've talked about.

I think we even mentioned this one.

There is ESP which is use for VPNs.

And we're getting to things like OSPF.

I mean these are all protocols that exist inside of this TCP/IP protocol suite

and technically at layer 4 of the OSM model.

We can match anyone of those using extended Access-List.

So I can say maybe I want to allow TCP Port 80, and we'll talk about port numbers a little bit.

But deny UDP Port 80.

I can separate those but allow pings which is "Echo request" from ICPM.

So there're all kinds of things I can do with the protocol and then source

and destination port numbers, that's the actual, you know, so I can say TCP.

I want to allow all of TCP or maybe I just wanted to do Port 80 which is HTTP,

that's what that port lines up to.

Or maybe I want to only allow Port 25 which is SMTP.

That's e-mail services.

Now, this guy does cause for Higher Processor Utilization because he's examining more

so it's going to cause a little more on that side.

And this one is where that fear of Access-Lists comes from.

That syntax of it takes a little time to learn and get use to.

So give yourself some grace when you're learning this that it may take you a couple of times,

okay, it's one of those like subnetting.

First time you see like, what?

You know, and then as you see it more and more like, "Okay,

I'm starting to piece this together."

Last one is something called a Reflexive Access-Lists.

We may talk about this one.

What this does is allow return traffic for internal request.

Here's what that means.

Sometimes when people first think and learn about Access-List, they go crazy.

What did I just do?

Here we go.

They go a little bit crazy because they are like, "Okay, you know, I want to come in here

and I want to make sure that my network is secure so I am going to deny everything

from the internet 'cause there're all kinds of mean people out here.

We want to block them all and you know, I keep them out of my network."

Well that's great but what happens when your internal computer comes in and says,

well I want to get to Google or I want to get to Microsoft.com to do some researcher Cisco.com.

And Cisco tries to send website information back to you well, they can't.

So yes, you know, it's kind of like perfect security, you would never have anybody be able

to do anything and now you are secure.

That is true.

But we have to allow some usability.

So when you bring that up, you're like oh, well is there a way that I can watched it somehow

and when it-- they rather see something being requested then I allow just what was requested

to come back.

The answer is yeah.

That's exactly what it reflects of Access-List does.

Some people call it TCP Established Access-Lists.

So that's, I mean your router has eyes.

And as traffic goes out, it's always watching and says, "Okay,

I see what destination you're going to.

What port you're going on.

What sequence number you're using."

So when that side and only that site, only responding to the request

that I saw comes back, I will allow it to come through.

But once we're done, once we tear down that connection and when you close your browser

or whatever, we kill the TCP session,

now that website will be denied from ever coming in uninvited.

So here we go again, you're ready?

Fuzzy bunny.

I'm just kidding.

And so, do Access-List feel a little better?

Probably not!

Honestly, at this point, if I were you, you know, you might say, okay,

well, I kind of see what you're doing.

And I get the concepts but Access-Lists are really learned by doing.

And that's what I planned on using the next two nuggets to do is go through Access-List with,

I mean just like we did subnetting example, after example.

Okay, get it, example again.

Okay, get that?

Okay, example again.

So we just keep seeing it and seeing it until we are absolutely 100 percent sure we've got it.

For now, I hope this been informative for you and I'd like to thank you for viewing.