Original subtitles

>> Configuring and Applying Standard Access Control Lists.

That title says it all.

Let's get started.

You might remember me saying in the previous Nugget that the only way to get access list

down is by doing them again and again and again.

It's like subnetting.

So that's what I've done here, is created a scenario of standard access list in this case

that we're going to work through.

But before we dive right in, I want to go through

and just familiarize our self with this whole network diagram.

First off, left hand side, you can see we've got the 192.168.1 network.

So we've got a computer on there, 192.168.1.50, default gateway is 1.1.

And then we've got a WAN link.

Now, we've gone to a slash 30 subnet mask in here.

So again, using-- or practicing our subnettting skills, sometimes you're going to look at that

and say, "Okay, well, what is that range, what IP addresses are in there"?

Now, in this case, it's easy especially if you have experience looking at a slash 30

because you know there's only two IPs and they're assigned

on each side, but let's say, you didn't.

What you would do is say, "Okay, well slash 30 as a decimal subnet mask, what is that?"

Convert that back to decimal.

So, that would be a 255.255.255.252.

Now, so we might say, "Well, how did you know that?"

Well, just 'cause I know.

But when, you take 30, essentially that means there's 30 ones in the subnet mask.

So that's eight one, eight ones, eight ones, six ones right there,

so add them all up and there's your 30.

So that will be where you get the 252,

that's why putting you're six ones, that's six, like that.

Now, the good news is that also gives you your increment.

Remember, lowest network bit as a decimal is a 4.

So I'm going to be able to reverse engineer my ranges.

They would have had to start at 10.1.1.0, dot 4, dot 8, dot 12, you know,

dah-dah-dah-dah down they go, so filling the end ranges.

And now, I've-- whoa, not written that right.

Now, I've reverse engineered what we've got here.

We've got-- so this one is 10.1.1.0 through 3, can't use zero,

it's a network; can't use 3, it's a broadcast.

So 1 and 2 are the usable IP addresses from there, right?

So that explains our WAN link.

So our WAN links are being very efficient.

We're actually using VLSM in this scenario, Variable Length Subnet Mask,

changing the subnet mask based on the fit.

So what's up this?

While I put this on there, the slash 25 at both of these locations because you will run

into that subnet mask in the real world.

A lot of people use it.

It is very efficient, but also because they really want to show you how wildcard mask work

which is what ACLs really thrive on.

So seeing this, you might say, "Okay, well, explain that to me, how do we do that?"

Well, same thing, a slash 25 is really 255.255.255, that's, you know,

8 plus 8 plus 8, that's 24 ones so far we've got.

So 25 ones would be 128, right?

So 1-- so you know, essentially, 1000000 is what that comes out to.

So, this as a decimal number, that's our increment, is also 128,

one of those nice weird ones where the subnet mask equals the increment.

So looking at our network, that means we've got 192.168.2.0, is where it begins.

Dot 2 dot 128.

Now, what do you get if you add 128 to 128?

256. So filling the end ranges, and there's our two ranges that we go, okay,

so we really have broken a class c network into two subnetworks,

one of them going from 0 to 127, that's this one.

So default gateway is dot 1, he is dot 50.

The second range going from 128 to 255, again, can't use the first one, can't use the last one.

So you notice on this side, I kind of drew through it, the default gateway is dot 129,

the first usable IP address from that range and this computer just happens

to be another one in that range, dot 150, right?

So, good, I mean, that's really good 'cause, you know to truly get access listed on their glory,

you have to be one that understands the subnetting behind it.

Okay. So that's what we've got so far.

Now, what I've done is I've actually set up this little scenario in GNS3.

Now, I do this series totally out of order.

So I'm actually recording this access list Nugget before I've done routing.

Why? 'Cause, I just wanted to record access list.

So I don't know if I've shown you GNS3 yet, but if I haven't, this is GNS3.

A CBT Nugget, actually Keith Barker just released a total series on how to use GNS3.

It is a free emulator for Cisco.

So just in case I did mention this-- mentioned this earlier, I won't dive into it

in all its glory, but this is the topology that we've set up.

These are essentially running the real Cisco IOS.

I'm using a 2691 platform, if I could keep that little thing there, 2691 platform.

I've just found that to be really stable with the 12.4 IOS on there.

So, we have this environment running.

The last piece I'll add on the set of it all is I've gone in and set up--

I'll do a show IP interphase brief on router 1.

I can see the interphases.

So again, router 1 is this guy, upper left corner.

We can bring-- my terminal back, bring the terminal so we can see

and I see a FastEthernet0/0 192.168.1.1 that matches.

Serial0/0 10.1.1.6 that matches and I'm able to verify that.

But I've also set up RIP, this is just a base config on there.

I'm going to do a show IP route and you can see that router 1 knows how to reach all

of the networks in our little mini-enterprise here.

So he is able to reach, you know, 192.168.2.128.

So I can ping-- or that network, so I can ping 192.168.2.129, excuse me.

So this represents the network.

I'm pinging the default gateway.

that's this guy on that network receiving successful.

So as a foundation, we have full IP connectivity.

Okay, if you're watching closely, you just saw the whole scenario for number 1 changed.

And that just because I started getting into it, I'm like, ah, this is just too--

we can do it, it was just the old one I had up there just a second ago,

was too complex for example number 1, so I changed it a little bit.

So let's get into it.

Before we configure an access list, recall your mind,

there are two distinct phases of access list setup.

Number one is configuration.

We need to go on the device and set the access list up.

This is done from global configuration mode and we put

in our list of permit and deny statements.

We can do that all day.

We could create a thousand access lists and it will never do a thing until we hit step 2,

which is application, and this is where the action really have it.

I mean, if you're thinking about-- I don't know why this came into my head, but you know,

when you were a kid and you built those little matchbox race cars, you can build them all day,

but until you put them on the ramp, and say go, they're not--

they're just going to sit there and look pretty and that's all these accesses do

and the application is were all the action happens.

We're going to apply it in terms of security; but keep in mind, we can apply this in terms

of quality of service, in terms of VPN.

This is just a list, a way of matching stuff.

So how we apply it says what that matching will then do to all of that stuff.

So, we are set from a goal of saying, I want to block 10.1.1.1, that is router 3 right here,

from reaching 10.1.1.6, that is router 1 right there and 192.168.1.0/24, so this whole network.

So I'm saying, I want to block him from coming over here

and reaching him or him or those networks.

So I mean, envision with me, we're going to build a wall here

to block that guy from coming over here.

Now, I know you're probably like, "Okay, it makes sense, I don't really need the picture,"

but you do, because even though we first go in and configure the access list, you know,

you're in global config mode and you do it.

You have to already be thinking ahead.

It's like a game of chess, you got to be two steps ahead thinking, "Okay,

I'm going to set this up, but where am I going to apply this?"

Now, let's think about a standard access list.

Standard access list filters only on IP source information, right?

Think this through with me.

IP source address information.

So based on who you are, so for instance, this guy says, "Hello,

I'm 10.1.1.1," that is all we can filter on.

I can say, "Okay, 10.1.1.1, you are denied."

[laughs] And he goes, "Thanks."

What do you say to that?

I mean, well, denied from what?

Well, it depends where we put this access list and this is where we got to be careful.

You might say, "Well, we want to catch it right here,

I want to block 10.1.1.1 from reaching those networks.

So let's block 'em right here as soon as he tries to get it in router 2."

And you're already thinking in terms of direction.

So as he's coming in, because we are going to have to apply this in the direction

to router 2, I want to block him, right?

Well, careful.

If I do that, I can just say 10.1.1.1, you are denied from coming

in to router 2, what have I blocked him from?

He can't reach this, he can't reach this, he can't reach this, he can't reach this.

I mean, yes, did I accomplish my goal?

Yes, but with the sledgehammer.

It's like saying, "Oh, let's just take him out from everything,"

and that's not what the scenario said.

Scenario didn't tell us to block it from here and here and here and all that.

It just said block it over here.

So, okay, what that tells me is since we are only able to match based on the source, right,

are you following me here, since I can only say 10.1.1.1 is denied, then I got to go as close

to the destination as I possibly can.

I'm probably going to go-- matter of fact, I'm probably going to create this right on router 1

and I'm going to apply it, you know, as they're coming in this interphase because that--

you know, then I can say you're denied and not deny them from too much,

that accomplishes my objectives right?

I can say you're denied because now you won't be able

to reach this nor will you be able to reach this.

But, you know, that accesses doesn't exist until we get there so we can everything in between.

So let's-- let's do this.

I'm going to bring up router 1.

No, I'm going to going to bring up router 3.

And 'm just going to, I want to before we do anything we got

to know what-- what we've come from.

I'm going to make sure that I can ping to this.

As a matter of fact I'm going to telnet to that.

I'll make sure I can ping this IP Address.

Just make sure everything is working 'cause if you don't know what you have beforehand,

you don't know if you accomplish anything.

So let's-- let's go here, I'm on router 3.

Enable as to show IP Interface brief, just orient ourself.

I see there's my FAST ethernet.

Life is good.

Okay, there's my zero.

So I'm going to ping.

Let's do a ping to 10.1.1.6.

We are good.

We are humming along.

Ping 192.168.1.50.

So I am okay, that's not as good.

I'm glad we tested this.

So anyhow let's do a show IP route.

I want to make sure that I can get there 10.1.1 so--

it says I know to reach the 10.1.1.1 network.

So let's go over to router 1.

I bet you I forgot to configure that PC.

Well, let's find out.

Show IP interface brief.

I just want to make sure the interface is up, okay?

So let's try from here ping 192.168.1.50.

Oh, Jeremy you forgot something completely.

You know what all these PCs, so these PCs they're not really PC's.

They're actually routers that I made to look like PCs.

And I completely forgot to give them a default gateway and they're not running RIP.

They don't know how to get out.

So here hang with me.

Let's-- let's do this on the first one.

That's good troubleshooting technique.

So I'm going to open my little PC one, show IP interface brief.

It's got an IP address but when I do a show IP route, it's like, "I don't anything."

I mean I don't have a default gateway.

I don't-- I don't have anything.

So watch this.

Let me-- let me show you to reduce a Cisco router to like a nothing.

Like this is like insulting to a Cisco router to do this.

I'm going to do no IP routing.

I pretty much said yes.

You are router but you cannot route.

You're not really routing because I'm just going to make you like a host.

I'm going to do IP default gateway and we'll do 192.168.1.1.

There we go.

So now I'll do a show IP Route.

Notice it totally changes.

It's like, you know, I used to be able to do all this but now I am a nothing.

I can't get anywhere.

All I know is my default gateway is this.

So I've reduced this router to essentially a PC.

So I'm going to save that in the config files 'cause they're actually going

to make these GNS3 config files available to you so you are able to try this out

and like I said practice makes perfect on this.

So let me get in here and do the same.

Let me pause.

I'm going to just going to do the same thing for PC 2 and PC 3.

All right, that's done.

So now it's your-- let's go back to router 3 and I'll just hit the up arrow.

Fail-- Failed before but should-- should work now.

Okay, it worried me for a second.

Okay, there we go.

So we've got-- we've got router 3 now able to fully ping.

So this verifies router 3 is able to get here.

He's able to get all the way to PC.

Let's-- let's just do one more test 'cause I'd like to check this out as well.

I'm going to even telnet 10.1.1.6.

It comes up and says you are there.

So I am telneting from-- I just telneted from router 3 all the way to router 1

and shows we connected and we are good.

So-- so we have verified IP connectivity.

Now let's get into the access list.

This access list based on all the chicken scratch

on the screen, I'm going to create on router 1.

So let me just wipe off all that.

Okay, I'm going to create over here on router 1 so that I block those coming over.

So I'm going to first on router 1 and not router 3.

Let's go router 1.

Go into global configuration mode and type

in the command access list followed by question mark.

And by the way if haven't gotten used to using your question mark now is the time.

Question mark through the access list is almost critical.

O you can see right away the Cisco router is like, "Well okay, you said access list.

What kind of access list would you like to create?"

Now you see in this list there's a whole bunch of them.

But most of them they're like, "Okay, I'm not going to use,

I'm not going to create an AppleTalk access list, IPX access list, DECnet [phonetic]."

I mean these are protocols we just haven't seen for decades or I would say at least a decade

because TCP/IP has replaced them all.

The main one that we care about is right up here, standard and extended,

just what I was mentioning in the last nugget.

So-- so based on the number I typed in the router knows what kind of access list I create.

So if type for instance access list 5 and start configuring my options from there,

the router knows I'm creating a standard access list and it will give me one set of options

versus if I put 105 it knows I'm creating an extended access list.

This is going to give me a totally different set of options.

So in here we're going to focus on standard.

So do access list let's just start with one, right?

Now a list and I'm creating my-- my access list can contain as many statements as you want.

So I have a list one but it could contain many of them.

Also, also notice so you'd say, okay, so I can create 99 access lists per router, right?

Well yes that was in the original version of the IOS, that's the limit.

But I've never seen a router with a hundred access list on it

but I'm sure they exist out there.

And because of that you can see that Cisco has come up with an expanded range.

So they say if run out of number 1 through 99 there's 600, 700 more that you are able to use.

Same thing right here expanded range for the IP extended.

But all of that being said I'm also going to show you this later.

You can also use named access list.

So instead of using a number I can say access list denied Bob or something like that

and create as many of those as I want.

So I hit the question mark and it's saying okay, you are now configuring your first statement

in access list one, your first line entry.

So I'm going to say, "Okay, well-- well what I wanted to do is I wanted to deny somebody.

And I hit the question mark and it says okay, well-- well, who do you want to deny?

Do you want to deny oh, anybody?

Do you deny just a single host or is there a specific address that you want to match here?

And so I'm looking here I'm like, "Okay, well-- well, actually--

" there's actually a couple of ways I could go about it.

I'll-- I'll do one way first.

I'm going to deny 10.1.1.1.

Now that's just-- it's just that's one host.

I mean that's my whole focus right now is that one host.

So-- so I'm going to take the easy route and I'll show you why in a little bit.

I'm going to type in deny host, a single host address and they are 10.1.1.1.

You see how this question mark is so critical?

So now it says, "Okay, well of you want,

I can also create sys log messages anytime this host is denied so you know

that they're being denied or you just press the enter key.

Now say most of the time unless you're really interested if that host is denied

or not there's other ways of verifying that.

I'll just press the enter key 'cause the more logs you put on there, the more it's going

to start filling up all your memory buffers and sys log servers

with all these entry saying this guy's denied, this guy has been permitted so, ta-da!

We've created our first line in our access list.

So I'm going to type in the command from Privileged mode, show IP access list

and it's like, "Hey you've now created list number one.

Inside of there is denied 10.1.1.1 and now the Cisco writer added to this to front.

What's that?

It's sequence 10.

You're going to find out that the Cisco router allows us to squeeze entries in.

So for instance the next line that I add by default unless I change it is going

to be sequence 20, sequence 30, sequence 40.

The more lines I add they add the sequence number

so what I can do is come in and-- and squeeze things in.

So I create 10, denied this person 20, permit that person 30, denied that person.

Now suddenly like, "Oh I forgot I wanted to put one here."

Now in the old days when I first got into Cisco there was no sequence numbers.

If you had to squeeze something in you had to delete the whole access list and recreate it.

Yeah, seriously!

It was painful.

But now I can just say, "Well, I want to squeeze in sequence number 15 and put a line kind of in

between those so I can change the order of the events.

So let's-- let's continue one from there.

So is this guy ready?

Can I just apply this?

No! That would run into one of the most common, devastating events

that you could do with access list.

Here's access list one, right?

We've-- we've created our first-- our first list.

And we have said sequence 10 is denied 10.1.1.1, right?

And that's the only thing that's in there.

Now think back to last nugget.

What is at the bottom of every access list?

And the last thing that I said you won't see it there but it's there.

Anyone remember?

Yeah, you, yeah, okay you in the red shirt.

Deny everything.

You got it.

Deny everything.

So if-- in this-- let me make a statement.

This is-- this is a key statement to remember.

If you have an access list that just has deny entries, it is an access list

that will completely cutoff all network connectivity if you apply it.

You must have at least one permit statement in there

or else you might as well unplug the cable.

I mean if I were to take this and now apply it to this interface, inbound, it would say, "Okay,

I'm going to deny this person and then I'm going to deny everybody else."

And you might as well shut the interface

down 'cause that's exactly what you've done and that's so easy.

I mean in a quick move without thinking it through sometimes you're like "Oh man,

we're under attack because a new SQL Slammer virus, worm came out.

Let's-- let's go out and deny this-- this source IP Address from China or wherever it's coming

in from that this attack originated and so you quickly say, "Oh deny this"

and then you go apply it and well, I would say you're safe, you've protected yourself

because you completely cut off the internet connection

which is probably not what your intentions were.

So what we need to do is add in a permit.

So, let's think this through, what-- if I'm denying this one then what am I permitting?

Everything else, right?

I mean this shouldn't be impacted, this just said deny that

and that alone so I want to permit everybody.

Okay, let's go back there.

There was actually-- did you see the key word in there for that?

So, let's add line number 2.

So I'm going to say access list one and now we're going to say, okay, permit,

anyone have a guess what key word?

Any, any source host, right?

So check this out now.

I'll do a show IP access list and right there I can see access list 1 now has two statements.

You see how this is building.

Statement 10, says, deny that person and statement 20 is permit anybody else.

Now-- now you might think, "Okay.

Well so-- what about the implicit deny at the end?"

Well, now that we put a permit all before it, we will never get there.

Remember the rules of an access list is as a router, so as packets are coming in,

the router is going to now filter and say,

"Are you this person, 'cause if you are you're denied.

Okay, if you're not this person, you hit this permit all statement."

Now as soon as it gets the first match in an access list, it stops processing, you know?

So for instance 10.1.1 did come in there, it's not like he goes, okay,

well I'm going to deny you, but-- no actually I'm not going to deny 'cause I see right next

to me is a permit everybody and you're kind of like everybody, right?

So let list-- no, no, no.

As soon as you get you're first match, it says check.

I'm not looking at anymore of the access list.

So the good news is by putting in a permit all,

I have really reversed the whole mindset of an access list.

I've now said, deny what I say to deny, but permit everything else.

Sometimes, you'll hear people call us.

I've heard this said once.

I thought it was a great way to describe that.

This is like fishnet security, where you're allowing all the water to go through

and you're trying to catch the big old fish, you know, what,

you know, which in this case 10.1.1.1.

Everything else can go through those giant gaping holes in the access list, whereas,

leaving the denial is like iron wall security and you've got a little drill

and you say [noise] you know, I'm allowing this, you know, port 80 through [noise].

I'm allowing 10.1.1.1 through or whatever, whatever you're allowing through,

you just kind of poke these little holes and go through, which is better, this one.

Well, I'm sorry, backup.

Let me use the universal, it depends.

It depends on, you're what you're trying to accomplish, but most of the time,

if you're talking about like internet security,

the iron wall just saying exactly what is allowed in is usually the best way to go, okay.

So we've got this access list created, right?

We're in global config mode, we're going back to those two things.

Step 1, the config is done already.

But now we have to go to the application.

Now in this case I need to go into the interface where I want to apply it

and in this case it's serial 0/0.

Now, I said right here assume all ethernet ports are FAST here,

so this is FAST ethernet, 0/0 could I apply it here?

Yes, but it would miss one of the objectives.

So let's-- let's apply it here first.

So I'm going to go on router 1 and I'm going to say, "Okay, I want access 1 to take effect,

global conifg mode, interface 00/0" and I'm going to use the command, here is the command.

It is IP access group.

Well, why Cisco do that?

'Cause they had to have a different way.

So IP access group is how we apply an access list to an interface.

It's not IP access list, it's IP access group.

I hit the question mark and it's says, "Okay, what number of access list would you

like to apply or even what name if you've used the name one.

I'll show you how to do that in a moment.

So, I would say I want to use number 1 that's the one I created.

Now it's going to ask me that key question.

Remember I said last time you got to get this one right, inbound or outbound.

Okay? How do I determine that direction?

Be the router.

I am router 1.

My right arm, you know, again, if I'm a human being my right arm is 00/0,

my left arm is FAST ethernet 0/0.

So I'm holding him right here and I go, okay.

Direction wise, I'm applying right here.

Am I filtering traffic in as it's coming into me from my right arm in the 00/0 or I'm applying it

out to where it's going out this interface?

If you think that through, it's in because router 3 and everything else is going

to be coming in my arm in the interface to me, the router sitting in the middle

and that's where I want to do filtering.

So I'm going to say, apply that inbound.

All right.

Let's do-- I want you to show IP, you can actually type in show access list.

But the reason I like show IP access list, they're the same exact command is

because I can hit the tab key after three letters and it fills in all inwards.

If I do show IP or show access, I actually have to type in the dash and the L and it works,

but it same-- same exact command.

Now, ooh-- ooh, check it out.

We've got deny 10.1.1.1, it's there, but it hasn't done anything

yet because I can see below the permit any is getting three matches.

So there's already three packets that have come in and said, "I want to come in,"

and the access list says, "Okay, come on in."

And then they're going to say, well, "Jeremy you're talking.

What's going on?

What is there matches coming in?"

Well, I remember I said at the beginning I set up RIP, a routing protocol which is saying,

"Hey, I know about these networks."

So it's sending its little updates behind the scene.

So chances, I hit the up arrow, it's now up to six matches.

So RIP is talking and chatting and sending its route updates, doing its thing,

that's the matching that I'm gaining.

Okay. Let's test it.

Let's go ever to router 3-- who is this guy over here, right, router 3, and now we test it before

that I was able to ping I could telnet to this guy so let's try now.

Ping 10.1.1.1.6.

Denied! A matter of fact you can see right here Us.

That means unreachable as in a protocol called ICMP has come

in and said, you are being blocked.

Usually when you see a U that means either the router has no idea what you're talking about.

It' doesn't have a route to that destination or an access list is blocking you

and sending back messages saying, "You are being denied."

Now, when you get into the-- if you decide to go security as your specialty and get in there,

one of the things that you'll learn is a way to turn this off.

Because as a hacker, if I'm trying to hack in somewhere and I do a ping

and I see Us coming back to me, that tells me something, that tells me they are alive.

I can get there, but they have purposely put an access list on there that this is blocking.

There is a command that you can do to turn off what called ICMP unreachable messages.

So that way, it just says, dot.

It's as if you would have ping'd just an IP address that doesn't exist, dot, dot, dot,

and you know, you can't tell that you're being blocked.

So that's, that's in the security series so I'll leave that to them.

So, let's do some more testing.

I'm going to try and telnet.

We just did up here right, telnet 10.1.1.6, telnet to 10.1.1.6.

Denied destination immediately comes back unreachable gateway host that.

It's-- I'm being block from that.

Okay. So that verifies that I can't get here.

Now what about-- what about this guy?

I could ping him before.

So let's do a ping 192.168.1.50.

Successful!

So now, let's go up here to router 1 and hit up arrow and do the same command.

Check it out.

Now, we can see it in action.

We're denying 10.1.1.1, 25 matches from all of the pings in the telnet

and everything else I'm trying to do to reach that, it's actually saying,

I'm blocking, I'm blocking, I'm blocking.

Okay. Awesome!

That is excellent.

Now, let me do this.

Wipe. I want to go back to the question I said, "Couldn't-- could I apply it right here?"

Yes! Yes, yes I could apply that same accesses right here.

As a matter of fact, let's do that.

I'll go into interface 00/0 and I'm going to do no, IP access group 1

and so I'm taking it off of the serial port.

So I mean immediately upon doing that, I should be able to hit the up arrow.

Now pings are going through successfully.

You can see access list and action right there.

But now, let's say I went into FAST ethernet 00/0 and I said,

okay, well I want to apply it here.

First of, let me ask you, what direction would you apply it?

Ken, be the router.

This is FAST ethernet 0/0.

This is 00/0.

I've got access to those one that says, deny this guy, holding my arms out.

If I apply it right here, I want to apply it outbound like as it's going out router 1.

Because if I apply it inbound, what would that mean?

It would assume that 10.1.1.1 is over here somewhere, you know, trying to come in.

That's not the truth.

That's not where it's at.

So it's going to applied outbound there and let's do it because I just want to show you.

I'm going to under FAST ethernet 0/0, just let just hit the up arrow.

IP add-- oh, wait, stop the train.

We're moving too fast.

I just caused an internet outage.

So, IP access group 1 outbound so I've applied it in the out direction on FAST ethernet 0.

Now, can I go to router 3 and test?

Yes I can, if I find them.

Router 3, I'm going to hit the up arrow and ping them again, and okay, that's good right?

It means I'm blocked from getting to this guy.

I just tested that but what's missing?

If it's applied outbound right here, then getting here which is one of the objectives,

block information, that's-- it's not going to be there 'cause I removed it from this

so he's going to have no problem reaching this.

It's just when he tries to go out right here, it's where it's going to be blocked

so let's just verify Ping 10.1.1.6.

Good. So again, verifying that this was indeed the correct place to put that access list.

All right, let's look at number 2.

Use a standard access list to block access to the 192.1681.0/24 from 192.1682.128/25.

Now, again, why it's so critical to draw this out?

It's just so you can visualize what's going on.

So it's -- what it's saying here is not to block the specific IP address.

It's saying block this whole network.

So 192.1682.128/25 so, that's identifying the whole memory--

the 128 is the network ID so I'm saying the whole network is being blocked

from accessing this whole network, so again, big sweeping statements there.

Okay, so let's do that.

First off I'm going to go to-- okay, before I even do that,

let's figure out where we're at, right.

Again, standard access list only blocks based on IP source.

So I can't really say what something is denied from other than where I apply it to.

So if I create an access list, I'm going to apply it here as things are coming

into that interface then I had cut off too much.

So again, I'm back over on the Router 1 and I'm saying, "Well, I want-- I need to block--

no longer am I blocking access to this.

I need to block access to this subnet.

So I need to catch things as they're trying to leave this interface."

Again, with standard access list, it's as close to the destination as possible

because the close you move to the source, the more chance you're going to block too much

since you can't really say what they're denied from.

You just say they are denied and that's just based on the source, so, okay.

So I'm going to be right here as they're going out, right, that that interface,

I need to block them so I'm back over on router 1 and I'm going to go in--

first off remove this one from being applied, exit back out.

So let's-- a matter of fact, let's just kill the whole thing.

I'm going to do a no IP-- a no access list 1.

And it's gone.

So that actually deleted the whole access list.

I'll do a show IP access list and you can see nothing there.

They're all gone.

So let's go and create-- so I'm going to create access list just-- we can use 1 but just--

because I want to be different, let's use 2.

So access list 2-- now who are we denying?

We are denying this whole subnet, 192.168.2.128 with that weird subnet mask.

So again, we're looking at that range, 192.168.2.128 through 255, okay?

So I want to block that whole subnet so I'm going to say, "Okay."

So 2, I'm going to deny.

That's my goal is to block them.

And it says, "Okay, what address do you want to match or do you want to do,

you know, any address or specific host?"

Well, I can't use any because that'll block everybody and that's not the goal.

I could use host but that means I'm going to have to type in host 192.168.2.128

and then hit the up arrow, 129.2.130, 2.131.

Come on, is this sufficient?

Can we say-- can I hear a no?

No, it is not sufficient.

So that means we're creating this slides, show-- a giant access list, show IP Access.

You see all this.

It's just crazy but someone going to say, "No, no, no," clear access list 2.

So let's blow it away.

So we could do that but not efficient.

So instead, I'm going to say, "I want to block the network 192.168.2.128

but enter stage left the wildcard mask, okay.

Wildcard mask allows you to say these are the bits that I care about."

Now, nobody is really certain to why Cisco decide to go this way

like you would think it be nice and logical to be able to say, "Okay,

we'll block that network like that."

But a wildcard mask doesn't do that.

Think of-- I mean, if it's-- okay, if you've got a rebellious teenager and you're like "Man,

they're wild," what do you think?

You're like?

"Okay, they are doing the opposite of what I want them to do.

They're doing the opposite of what would be acceptable and normal to this family," right?

So think of the wildcard mask, it's the rebel, it's the opposite.

So it's going to be the backwards mask, essentially.

So we see the mask is 255.255.255.128.

The wildcard mask is exactly the opposite, flip it, as in, if we're to look at this in binary,

you know, 111111111, all the way down to, you know, 0.1.00000,

so that's the normal subnet mask in all binary.

wildcard mask flips.

So wherever you see a 1, put a 0, wherever you see a 0, put a 1.

So the wildcard mask could be 0000000.000.000.011111.

So, you know, and take that all in binary and then flip it as exactly the opposite

and there, you have the wildcard mask.

They are the weirdest looking things ever.

So the question is what is that-- what is that binary number as a decimal?

Well, that's where you pull out your mathematical mind and add 1,2,4,6,8,16--

did I count that right-- 32, 64, right.

That didn't feel right but, you know how what I mean.

You add all the binary digits up to 64 together, you know, in one big math problem.

And that will give if you add them all up, 127.

So the wildcard mask, instead of being nice and easy as a subnet mask, I go in there and I say,

"Actually, it's going to be 0.0.0.127.

Creepy! That's it.

That's the accurate way of identifying, "I want to block that whole network."

Now, I've got a shortcut for you, doing it all binary, it's kind of painful.

So what I usually do if I'm, like, "Okay, what's the wildcard mask?"

I take all 255 and subtract my subnet mask that I want to kind of convert it

over to a wildcard mask, and that will give me, I mean, obviously, easy math there and I go 127,

you know-- so that-- that is the wildcard mask for this subnet mask,

you know, /25 or 255.255.255.128.

That's the opposite.

So again, nice and bizarre, that's probably the most difficult thing of access list.

Next to figuring out which direction to apply them is going, "Okay,

what's up with this wildcard mask?

Why would I use?"

So let me ask you this.

What would the wildcard mask be for this?

If I were to generate a wildcard mask for 192.168.1.0/24, what would it be?

It'll be-- we'd say, Okay, deny or permit 192.1681.0 with wildcard mask of 000255.

That's the flip opposite of a /24.

and the way to think about is if you like looking at things in terms of decimal,

wherever you see a zero, that tells the router, "Look at this, evaluate this.

This access list is either permitting or denying so when this packet comes in, look at this.

Look at the 192."

And then it goes, "Okay a zero -- that means look at this, look at this, well 192.168.

Oh a 1, look at this.

You make sure that you're watching this and then this last one is I don't care.

Essentially, the 255 are all ones says, "I don't really care what's

in that last octet, and that's good."

So if I have an access list, that' saying it deny 192.1681.0, you know, this guys 192.1681.50

and it's going to come in and say "Okay, you're 192, I look at that, I look at that ,

look at that" and it's like .50, I don't really care about that, you know, whatever.

So you will be denied because you start with this.

So it's really like what do you matching on with this.

You could-- you won't do this but you could.

You could do something like I want to create an access list center that says,

"I want to match 192.053.0 with a wildcard mask of 0.255.0255."

And what that says is you know, let's just say we said deny and then we put that information.

Let' say, "Okay, I'm going to deny any IP address that has 192 in the first octet.

I don't care what's in the second octet but they also have to have 53

in the third octet, right 'cause that's a match.

This one, I don't care what's in the last octet."

So you can actually deny things based on, you know, just one octet,

I mean if-- okay, let me ask you this.

What do you think-- let's say I want a wildcard mask

that would deny everything all the time, what would it look like?

I would say deny.

On the IP address, I would just put 000.

It doesn't matter what you put there 'cause it's not really caring about.

Wildcard mask 255.255.2550 or so not 0-- 255.255.255-- I've said that too often.

255.255.255.255 it's very much saying deny, I don't care, I don't care, you're denied.

It doesn't matter what IP address you have.

You could also go the other way.

For instance, let me show you this.

Remember when we did that access list?

Let me just use access list 50 as an example.

And I did permit and like in that first example, we said host, you know,

10.1.1.1 right, a different way of doing.

So there's a couple of ways you can do it.

A different way of doing it is I could've said permit 10.1.1.1 but now, it's going to ask me

for a wildcard mask so I would put 0000.

Now, watch this.

I'll do a show IP access list.

Access list 50.

It's automatically dropped that because it assumes the host command.

I could've done the same thing.

I could type in access list 51 permit host 10.1.1.1, hit the Enter key, show access list.

Look they're one and the same.

One, I used the wildcard mask of all zeros, one, I used the host command to type it in there

and it ends up being the same thing, the same result.

So back to the example, we were using access list 2 up here and I said, deny 192.168.2.128

with a wildcard bits 000127, right.

So that's the opposite of the subnet mask.

Okay, that's great and I'm going to want to come back--

good grief if we got these things at mess now.

I'm going to come back in here and I'm going to apply that algorithm.

But before I do, remember an access list with only a deny command will deny everything 'cause

of the implicit so I need to go in there and do access list 2 permit any.

And let's get rid of the other one.

No access list, my little demo access list 50 and 51, they're gone.

So to show IP access list, and now I've got few of that-- I have access list.

So I've got deny 192.1682, okay, that looks good and permit everything else.

So now, I need to apply it.

And since this said, "Only-- you know, I just get rid of all this chicken scratch.

Only deny access to this one network, that's my focus.

I'm going to go into the router.

I'm going to say, "Okay, show IP and interface brief and I'm going to look, I mean--

Well, that's the network I want to block access to.

I don't want 192.1682.128 to get there so I'll go

in the FAST ethernet 0/0 IP access group 2 'cause that's the accesses I created right here,

number 2, right?

And then out.

So as this network tries to go out FAST ethernet 0/0, I'm going to deny them.

So let's give it a try.

I'm going to shoot over to Router 3 first, just to make sure.

I'm going to do a Ping 192.168.1.50 and it works.

Now, don't be surprised.

You're like, "Oh, I thought-- didn't we deny that network?"

Yes, but Router 3 is not that network.

Router 3 came from this IP address, 10.1.1.1.

That's the IP address I Ping'd from.

So the access list came in there.

As a matter of fact, let's verify it.

The access list said, "Well 10.1.1.1 come on in."

So I'll do a show IP access, you know, I've seen matches.

You know, those Pings are, you know, come on in.

you can feel free to come in but, now let me show you something else.

Let me first-- I'll do the PC, I'm going to PC3 up there which is right here, okay?

So PC 3 is right here so I'm going to do a Ping--

let's do Ping 192.168.1.50 which is that host over there.

Hit the Enter key and sure enough, I'm getting unreachable messages back.

And those used are sure indicator that you've done it right.

But if you want to feel that warm and fuzzy feeling, you can do a show access list.

And now, I can I'm getting denied packets from that access list.

The other thing I wanted to show you is I said Router 3 is not coming from this network.

It's coming from this, right?

Well, watch this.

If I want to, I can make it come from that network.

Let's see how.

I'm going to go to Router 3 and I'm going to type in ping, you know that one works fine.

It's coming from another one so I'm going to hit the question mark after the ping command.

I'm going to say, "I'm actually coming from the source IP address.

And I can either type in my IP address or I type in 192.1682.129 or I can type

in the source, FAST ethernet 0/0.

And sure enough, now, take a look at this, it says, I'm sending five pings to that guy

with a source address of 192.168.1.129, which is right there,

and you can see sure enough those are all denied by the access-list.

That's pretty cool.

Okay. Last example, and first off, at this point,

you should feel a little more warm and fuzzy about doing this.

So you might just want to pause and write this up on paper or try it on a router

if you have one and see if you can figure that out.

But I'd like to use this last example to illustrate an example of using named access-list

which I love far more than the number ones.

So it says, "Create a standard access-list to block 192.168.2.50,

to this one, from reaching 10.1.1.

That's this one.

So, block them from getting there.

So looking at that, I can think, "Okay.

Well, I could either apply it outbound right here.

Can anyone say this guy is blocked from getting here or I could apply it inbound right here.

Now, basically, regardless of which one you choose the results is going to be the same.

I'm not going to be able to reach this, but also by saying block to this WAN IP address I'm going

to be automatically be denied from reaching that network too, why?

Because standard access-list can't say what you're denied from.

They just say, "You're denied."

So, when I say deny 192.168.2.50 and apply either out, excuse me, out right here

or in right here then access-list is going to say, "You are denied.

You are denied from getting any further."

So, honestly, I would think it might be a little more efficient to apply it out right here

because otherwise you have to cross the whole WAN link just to find

out on the other side that you're denied.

It's like a bad trip to Disney Land, right?

You got to drive all the way to California just to find out Disney Land is closed

for the day or something like that.

So you don't want to have this packets drive further than necessary.

So in this case since the result is the same I'm thinking applying it outbound right here would

be the best way to go.

So, let's do this.

I'm going to get into router 2.

I haven't even been on this one yet.

And let's go into global config mode.

So now let me show you, so, so far we've been using number access-list which is done by typing

in access-list and a number, whatever number we want to, to pick what kind.

But the better way, I believe it's a lot cleaner

or it just makes more sense is to type in IP access-list.

Okay. Same thing that we're after in access-list just putting the IP and the keyboard in front

of it tells it I'm going to create a named access-list.

So notice, instead of asking me for a number to identify what kind it is it's just asking me,

it's just like, "Hey, why don't you just identify what it is?

Is it a standard or is it an extended access-list?

Now, all these other commands is like, "Okay.

Do you want to renumber it?

Do you want to set up logging or a log update?"

But really the main command is standard access--

well, right now we are creating standard access-list.

So I'll type that.

Well, you can even use this command to modify one of the numbered or now I'm going

to give you the option to type a named.

So I'm going to say, BLOCK PC 2 ACL.

I put little underscores in between.

You can't put spaces.

But do you see how that makes more sense when I do a show access-list?

If I see, BLOCK PC 2 ACL-- it's going to bug me.

Hang on. I want BLOCK PC 2 not-- no underscore there.

So BLOCK PC 2 ACL, now when I do the show command I can see exact--

just by looking at the name I know what it is rather

than being like, "Oh, what was number 73 again?"

You know, you have to have some kind of reference for that.

So I'm going to say, "Okay.

I want to block 192.168.2.50."

So the way this works is it's just as if I had type IP access-list now--

or access-list, you know, whatever I want, now I can say, permits or deny

or I can even use the sequence number.

Now, you saw that by default so far when we type

and create an access-list it creates sequence numbers of 10, right?

The first command we type in is a sequence 10.

Next one sequence 20.

Next one sequence 30.

Now, if you want to you can type in your own sequence number.

So I can say, sequence 100.

You know, and then type in permit or deny, or anything like that, or if I just type in permit

or deny without typing any sequence number it will automatically use

that increment of 10 for me.

So I'm good with that.

So let's just say, deny.

I want to deny 192.168.2.50, wild card bit, 0.0.0.0, and then, you know, again,

I've got now an access statement or accesses that were just to deny.

So I'm going to say, "Permit any."

Okay. So I'm going to go back and do a show access-list and now I can see I've got accesses.

Don't you love the name better BLOCK PC 2 ACL?

Same syntax as before or sequence 10 deny that host.

Sequence 20 permit everything else.

So now I can go into interphase serial 0/1 on that side.

Network diagrams are essential for this and do IP access-group

and now I'll just type in the name BLOCK PC 2 ACL.

By the way, keep in mind, oops, this is case sensitive.

So if you use lower, uppercase you got to keep it consistent.

I always type them in all uppercase because it's easy for me to see in a show run

and then I'll hit question mark, outbound, playing it out 0.00/1 interface.

Good! So now I'm going to test it.

I'm going to be sure that it works.

Let's go to PC 2 and I'm going to ping 192.168.2.

Well, actually, the goal was to block it from 10.1.1.1.

So let's start there and make sure we achieved our goal.

And sure enough I'm getting those unreachables show access-list.

I can see that I'm denying that host so it is working, but also just as a bonus

because there's-- with the standard there's no way of stopping it.

I'm completely denying access to everything beyond that WAN interface as well

because it's just saying, "You are denied."

With the access-lists, as I said, the more and more

and more you do the better and better they feel.

What I would like you to do is first off, if you have your own router or something like that,

use that to practice the syntax to come up with those scenarios.

As a matter of fact you could just run through the scenarios.

You know, just bring up the slide.

I've been using this entire time, pause it, and now see if you can do those three examples

on your own without actually watching me walk me through that.

Then I would start going through in and coming up with your own scenarios.

You know, come up with I want to deny this from this and try it out.

I'm going to make that GNS 3 typology available to you.

So if you have GNS 3, if you've played with that maybe you check out,

I think CBT Nuggets has some free GNS 3 videos that you can download if you don't have access

to whole thing that, well at least show you how to get started with it and so on.

It's again free emulator software that you can use.

You know, import that typology and start practicing

with the environment that I've created right there.

So once you're feeling pretty good about standard access-lists go ahead and jump

into the next one which is going to be the extended world.

I hope this been informative for you and I'd like to thank you for viewing.