All language subtitles for 30 - Routing - Configuring and Applying Standard Access Control Lists-eng

>> Configuring and Applying
Standard Access Control Lists.

That title says it all.

Let's get started.

You might remember me saying in the previous
Nugget that the only way to get access list

down is by doing them again and again and again.

It's like subnetting.

So that's what I've done here, is created a
scenario of standard access list in this case

that we're going to work through.

But before we dive right
in, I want to go through

and just familiarize our self
with this whole network diagram.

First off, left hand side, you can
see we've got the 192.168.1 network.

So we've got a computer on there,
192.168.1.50, default gateway is 1.1.

And then we've got a WAN link.

Now, we've gone to a slash
30 subnet mask in here.

So again, using-- or practicing our subnettting
skills, sometimes you're going to look at that

and say, "Okay, well, what is that
range, what IP addresses are in there"?

Now, in this case, it's easy especially if
you have experience looking at a slash 30

because you know there's only
two IPs and they're assigned

on each side, but let's say, you didn't.

What you would do is say, "Okay, well slash
30 as a decimal subnet mask, what is that?"

Convert that back to decimal.

So, that would be a 255.255.255.252.

Now, so we might say, "Well,
how did you know that?"

Well, just 'cause I know.

But when, you take 30, essentially that
means there's 30 ones in the subnet mask.

So that's eight one, eight ones,
eight ones, six ones right there,

so add them all up and there's your 30.

So that will be where you get the 252,

that's why putting you're six
ones, that's six, like that.

Now, the good news is that
also gives you your increment.

Remember, lowest network
bit as a decimal is a 4.

So I'm going to be able to
reverse engineer my ranges.

They would have had to start at
10.1.1.0, dot 4, dot 8, dot 12, you know,

dah-dah-dah-dah down they go,
so filling the end ranges.

And now, I've-- whoa, not written that right.

Now, I've reverse engineered
what we've got here.

We've got-- so this one is
10.1.1.0 through 3, can't use zero,

it's a network; can't use 3, it's a broadcast.

So 1 and 2 are the usable IP
addresses from there, right?

So that explains our WAN link.

So our WAN links are being very efficient.

We're actually using VLSM in this
scenario, Variable Length Subnet Mask,

changing the subnet mask based on the fit.

So what's up this?

While I put this on there, the slash 25 at
both of these locations because you will run

into that subnet mask in the real world.

A lot of people use it.

It is very efficient, but also because they
really want to show you how wildcard mask work

which is what ACLs really thrive on.

So seeing this, you might say, "Okay, well,
explain that to me, how do we do that?"

Well, same thing, a slash 25 is
really 255.255.255, that's, you know,

8 plus 8 plus 8, that's 24
ones so far we've got.

So 25 ones would be 128, right?

So 1-- so you know, essentially,
1000000 is what that comes out to.

So, this as a decimal number,
that's our increment, is also 128,

one of those nice weird ones where
the subnet mask equals the increment.

So looking at our network, that means
we've got 192.168.2.0, is where it begins.

Dot 2 dot 128.

Now, what do you get if you add 128 to 128?

256. So filling the end ranges, and
there's our two ranges that we go, okay,

so we really have broken a class
c network into two subnetworks,

one of them going from 0
to 127, that's this one.

So default gateway is dot 1, he is dot 50.

The second range going from 128 to 255, again,
can't use the first one, can't use the last one.

So you notice on this side, I kind of drew
through it, the default gateway is dot 129,

the first usable IP address from that
range and this computer just happens

to be another one in that range, dot 150, right?

So, good, I mean, that's really good 'cause, you
know to truly get access listed on their glory,

you have to be one that understands
the subnetting behind it.

Okay. So that's what we've got so far.

Now, what I've done is I've actually
set up this little scenario in GNS3.

Now, I do this series totally out of order.

So I'm actually recording this access
list Nugget before I've done routing.

Why? 'Cause, I just wanted
to record access list.

So I don't know if I've shown you GNS3
yet, but if I haven't, this is GNS3.

A CBT Nugget, actually Keith Barker just
released a total series on how to use GNS3.

It is a free emulator for Cisco.

So just in case I did mention this--
mentioned this earlier, I won't dive into it

in all its glory, but this is
the topology that we've set up.

These are essentially running
the real Cisco IOS.

I'm using a 2691 platform, if I could keep
that little thing there, 2691 platform.

I've just found that to be really
stable with the 12.4 IOS on there.

So, we have this environment running.

The last piece I'll add on the set of
it all is I've gone in and set up--

I'll do a show IP interphase brief on router 1.

I can see the interphases.

So again, router 1 is this
guy, upper left corner.

We can bring-- my terminal back,
bring the terminal so we can see

and I see a FastEthernet0/0
192.168.1.1 that matches.

Serial0/0 10.1.1.6 that matches
and I'm able to verify that.

But I've also set up RIP, this
is just a base config on there.

I'm going to do a show IP route and you can
see that router 1 knows how to reach all

of the networks in our little
mini-enterprise here.

So he is able to reach, you know, 192.168.2.128.

So I can ping-- or that network, so
I can ping 192.168.2.129, excuse me.

So this represents the network.

I'm pinging the default gateway.

that's this guy on that network
receiving successful.

So as a foundation, we have
full IP connectivity.

Okay, if you're watching closely, you just
saw the whole scenario for number 1 changed.

And that just because I started getting
into it, I'm like, ah, this is just too--

we can do it, it was just the old
one I had up there just a second ago,

was too complex for example number
1, so I changed it a little bit.

So let's get into it.

Before we configure an access
list, recall your mind,

there are two distinct phases
of access list setup.

Number one is configuration.

We need to go on the device
and set the access list up.

This is done from global
configuration mode and we put

in our list of permit and deny statements.

We can do that all day.

We could create a thousand access lists and
it will never do a thing until we hit step 2,

which is application, and this is
where the action really have it.

I mean, if you're thinking about-- I don't
know why this came into my head, but you know,

when you were a kid and you built those little
matchbox race cars, you can build them all day,

but until you put them on the
ramp, and say go, they're not--

they're just going to sit there and look
pretty and that's all these accesses do

and the application is were
all the action happens.

We're going to apply it in terms of security;
but keep in mind, we can apply this in terms

of quality of service, in terms of VPN.

This is just a list, a way of matching stuff.

So how we apply it says what that
matching will then do to all of that stuff.

So, we are set from a goal of saying, I want
to block 10.1.1.1, that is router 3 right here,

from reaching 10.1.1.6, that is router 1 right
there and 192.168.1.0/24, so this whole network.

So I'm saying, I want to block
him from coming over here

and reaching him or him or those networks.

So I mean, envision with me,
we're going to build a wall here

to block that guy from coming over here.

Now, I know you're probably like, "Okay, it
makes sense, I don't really need the picture,"

but you do, because even though we first go
in and configure the access list, you know,

you're in global config mode and you do it.

You have to already be thinking ahead.

It's like a game of chess, you got to
be two steps ahead thinking, "Okay,

I'm going to set this up, but
where am I going to apply this?"

Now, let's think about a standard access list.

Standard access list filters only
on IP source information, right?

Think this through with me.

IP source address information.

So based on who you are, so for
instance, this guy says, "Hello,

I'm 10.1.1.1," that is all we can filter on.

I can say, "Okay, 10.1.1.1, you are denied."

[laughs] And he goes, "Thanks."

What do you say to that?

I mean, well, denied from what?

Well, it depends where we put this access
list and this is where we got to be careful.

You might say, "Well, we
want to catch it right here,

I want to block 10.1.1.1
from reaching those networks.

So let's block 'em right here as soon
as he tries to get it in router 2."

And you're already thinking
in terms of direction.

So as he's coming in, because we are going
to have to apply this in the direction

to router 2, I want to block him, right?

Well, careful.

If I do that, I can just say
10.1.1.1, you are denied from coming

in to router 2, what have I blocked him from?

He can't reach this, he can't reach this,
he can't reach this, he can't reach this.

I mean, yes, did I accomplish my goal?

Yes, but with the sledgehammer.

It's like saying, "Oh, let's just
take him out from everything,"

and that's not what the scenario said.

Scenario didn't tell us to block it from
here and here and here and all that.

It just said block it over here.

So, okay, what that tells me is since we are
only able to match based on the source, right,

are you following me here, since I can only say
10.1.1.1 is denied, then I got to go as close

to the destination as I possibly can.

I'm probably going to go-- matter of fact, I'm
probably going to create this right on router 1

and I'm going to apply it, you know, as they're
coming in this interphase because that--

you know, then I can say you're denied
and not deny them from too much,

that accomplishes my objectives right?

I can say you're denied because
now you won't be able

to reach this nor will you
be able to reach this.

But, you know, that accesses doesn't exist until
we get there so we can everything in between.

So let's-- let's do this.

I'm going to bring up router 1.

No, I'm going to going to bring up router 3.

And 'm just going to, I want
to before we do anything we got

to know what-- what we've come from.

I'm going to make sure that I can ping to this.

As a matter of fact I'm going to telnet to that.

I'll make sure I can ping this IP Address.

Just make sure everything is working 'cause
if you don't know what you have beforehand,

you don't know if you accomplish anything.

So let's-- let's go here, I'm on router 3.

Enable as to show IP Interface
brief, just orient ourself.

I see there's my FAST ethernet.

Life is good.

Okay, there's my zero.

So I'm going to ping.

Let's do a ping to 10.1.1.6.

We are good.

We are humming along.

Ping 192.168.1.50.

So I am okay, that's not as good.

I'm glad we tested this.

So anyhow let's do a show IP route.

I want to make sure that I
can get there 10.1.1 so--

it says I know to reach the 10.1.1.1 network.

So let's go over to router 1.

I bet you I forgot to configure that PC.

Well, let's find out.

Show IP interface brief.

I just want to make sure
the interface is up, okay?

So let's try from here ping 192.168.1.50.

Oh, Jeremy you forgot something completely.

You know what all these PCs, so
these PCs they're not really PC's.

They're actually routers
that I made to look like PCs.

And I completely forgot to give them a
default gateway and they're not running RIP.

They don't know how to get out.

So here hang with me.

Let's-- let's do this on the first one.

That's good troubleshooting technique.

So I'm going to open my little
PC one, show IP interface brief.

It's got an IP address but when I do a show
IP route, it's like, "I don't anything."

I mean I don't have a default gateway.

I don't-- I don't have anything.

So watch this.

Let me-- let me show you to reduce
a Cisco router to like a nothing.

Like this is like insulting
to a Cisco router to do this.

I'm going to do no IP routing.

I pretty much said yes.

You are router but you cannot route.

You're not really routing because I'm
just going to make you like a host.

I'm going to do IP default
gateway and we'll do 192.168.1.1.

There we go.

So now I'll do a show IP Route.

Notice it totally changes.

It's like, you know, I used to be able
to do all this but now I am a nothing.

I can't get anywhere.

All I know is my default gateway is this.

So I've reduced this router to essentially a PC.

So I'm going to save that in the config
files 'cause they're actually going

to make these GNS3 config files available
to you so you are able to try this out

and like I said practice makes perfect on this.

So let me get in here and do the same.

Let me pause.

I'm going to just going to do
the same thing for PC 2 and PC 3.

All right, that's done.

So now it's your-- let's go back to
router 3 and I'll just hit the up arrow.

Fail-- Failed before but
should-- should work now.

Okay, it worried me for a second.

Okay, there we go.

So we've got-- we've got router
3 now able to fully ping.

So this verifies router 3 is able to get here.

He's able to get all the way to PC.

Let's-- let's just do one more test
'cause I'd like to check this out as well.

I'm going to even telnet 10.1.1.6.

It comes up and says you are there.

So I am telneting from-- I just telneted
from router 3 all the way to router 1

and shows we connected and we are good.

So-- so we have verified IP connectivity.

Now let's get into the access list.

This access list based on
all the chicken scratch

on the screen, I'm going to create on router 1.

So let me just wipe off all that.

Okay, I'm going to create over here on
router 1 so that I block those coming over.

So I'm going to first on
router 1 and not router 3.

Let's go router 1.

Go into global configuration mode and type

in the command access list
followed by question mark.

And by the way if haven't gotten used to
using your question mark now is the time.

Question mark through the
access list is almost critical.

O you can see right away the Cisco router
is like, "Well okay, you said access list.

What kind of access list
would you like to create?"

Now you see in this list
there's a whole bunch of them.

But most of them they're like,
"Okay, I'm not going to use,

I'm not going to create an AppleTalk access
list, IPX access list, DECnet [phonetic]."

I mean these are protocols we just haven't seen
for decades or I would say at least a decade

because TCP/IP has replaced them all.

The main one that we care about is
right up here, standard and extended,

just what I was mentioning in the last nugget.

So-- so based on the number I typed in the
router knows what kind of access list I create.

So if type for instance access list 5 and
start configuring my options from there,

the router knows I'm creating a standard access
list and it will give me one set of options

versus if I put 105 it knows I'm
creating an extended access list.

This is going to give me a
totally different set of options.

So in here we're going to focus on standard.

So do access list let's just
start with one, right?

Now a list and I'm creating my-- my access list
can contain as many statements as you want.

So I have a list one but it
could contain many of them.

Also, also notice so you'd say, okay, so I
can create 99 access lists per router, right?

Well yes that was in the original
version of the IOS, that's the limit.

But I've never seen a router
with a hundred access list on it

but I'm sure they exist out there.

And because of that you can see that
Cisco has come up with an expanded range.

So they say if run out of number 1 through 99
there's 600, 700 more that you are able to use.

Same thing right here expanded
range for the IP extended.

But all of that being said I'm
also going to show you this later.

You can also use named access list.

So instead of using a number I can say
access list denied Bob or something like that

and create as many of those as I want.

So I hit the question mark and it's saying okay,
you are now configuring your first statement

in access list one, your first line entry.

So I'm going to say, "Okay, well-- well what
I wanted to do is I wanted to deny somebody.

And I hit the question mark and it says
okay, well-- well, who do you want to deny?

Do you want to deny oh, anybody?

Do you deny just a single host or is there a
specific address that you want to match here?

And so I'm looking here I'm like,
"Okay, well-- well, actually--

" there's actually a couple
of ways I could go about it.

I'll-- I'll do one way first.

I'm going to deny 10.1.1.1.

Now that's just-- it's just that's one host.

I mean that's my whole focus
right now is that one host.

So-- so I'm going to take the easy route
and I'll show you why in a little bit.

I'm going to type in deny host, a single
host address and they are 10.1.1.1.

You see how this question mark is so critical?

So now it says, "Okay, well of you want,

I can also create sys log messages
anytime this host is denied so you know

that they're being denied or
you just press the enter key.

Now say most of the time unless you're
really interested if that host is denied

or not there's other ways of verifying that.

I'll just press the enter key 'cause the more
logs you put on there, the more it's going

to start filling up all your
memory buffers and sys log servers

with all these entry saying this guy's
denied, this guy has been permitted so, ta-da!

We've created our first line in our access list.

So I'm going to type in the command from
Privileged mode, show IP access list

and it's like, "Hey you've
now created list number one.

Inside of there is denied 10.1.1.1 and now
the Cisco writer added to this to front.

What's that?

It's sequence 10.

You're going to find out that the Cisco
router allows us to squeeze entries in.

So for instance the next line that I add
by default unless I change it is going

to be sequence 20, sequence 30, sequence 40.

The more lines I add they
add the sequence number

so what I can do is come in
and-- and squeeze things in.

So I create 10, denied this person 20,
permit that person 30, denied that person.

Now suddenly like, "Oh I forgot
I wanted to put one here."

Now in the old days when I first got
into Cisco there was no sequence numbers.

If you had to squeeze something in you had to
delete the whole access list and recreate it.

Yeah, seriously!

It was painful.

But now I can just say, "Well, I want to squeeze
in sequence number 15 and put a line kind of in

between those so I can change
the order of the events.

So let's-- let's continue one from there.

So is this guy ready?

Can I just apply this?

No! That would run into one of the
most common, devastating events

that you could do with access list.

Here's access list one, right?

We've-- we've created our
first-- our first list.

And we have said sequence 10
is denied 10.1.1.1, right?

And that's the only thing that's in there.

Now think back to last nugget.

What is at the bottom of every access list?

And the last thing that I said you
won't see it there but it's there.

Anyone remember?

Yeah, you, yeah, okay you in the red shirt.

Deny everything.

You got it.

Deny everything.

So if-- in this-- let me make a statement.

This is-- this is a key statement to remember.

If you have an access list that just
has deny entries, it is an access list

that will completely cutoff all
network connectivity if you apply it.

You must have at least one
permit statement in there

or else you might as well unplug the cable.

I mean if I were to take this and now apply it
to this interface, inbound, it would say, "Okay,

I'm going to deny this person and then
I'm going to deny everybody else."

And you might as well shut the interface

down 'cause that's exactly what
you've done and that's so easy.

I mean in a quick move without thinking
it through sometimes you're like "Oh man,

we're under attack because a new
SQL Slammer virus, worm came out.

Let's-- let's go out and deny this-- this source
IP Address from China or wherever it's coming

in from that this attack originated
and so you quickly say, "Oh deny this"

and then you go apply it and well, I would
say you're safe, you've protected yourself

because you completely cut
off the internet connection

which is probably not what your intentions were.

So what we need to do is add in a permit.

So, let's think this through, what-- if I'm
denying this one then what am I permitting?

Everything else, right?

I mean this shouldn't be
impacted, this just said deny that

and that alone so I want to permit everybody.

Okay, let's go back there.

There was actually-- did you see
the key word in there for that?

So, let's add line number 2.

So I'm going to say access list one and
now we're going to say, okay, permit,

anyone have a guess what key word?

Any, any source host, right?

So check this out now.

I'll do a show IP access list and right there
I can see access list 1 now has two statements.

You see how this is building.

Statement 10, says, deny that person
and statement 20 is permit anybody else.

Now-- now you might think, "Okay.

Well so-- what about the
implicit deny at the end?"

Well, now that we put a permit all
before it, we will never get there.

Remember the rules of an access list is
as a router, so as packets are coming in,

the router is going to now filter and say,

"Are you this person, 'cause
if you are you're denied.

Okay, if you're not this person,
you hit this permit all statement."

Now as soon as it gets the first match in an
access list, it stops processing, you know?

So for instance 10.1.1 did come in
there, it's not like he goes, okay,

well I'm going to deny you, but-- no actually
I'm not going to deny 'cause I see right next

to me is a permit everybody and
you're kind of like everybody, right?

So let list-- no, no, no.

As soon as you get you're
first match, it says check.

I'm not looking at anymore of the access list.

So the good news is by putting in a permit all,

I have really reversed the
whole mindset of an access list.

I've now said, deny what I say to
deny, but permit everything else.

Sometimes, you'll hear people call us.

I've heard this said once.

I thought it was a great way to describe that.

This is like fishnet security, where
you're allowing all the water to go through

and you're trying to catch the
big old fish, you know, what,

you know, which in this case 10.1.1.1.

Everything else can go through those giant
gaping holes in the access list, whereas,

leaving the denial is like iron wall
security and you've got a little drill

and you say [noise] you know, I'm allowing
this, you know, port 80 through [noise].

I'm allowing 10.1.1.1 through or
whatever, whatever you're allowing through,

you just kind of poke these little holes
and go through, which is better, this one.

Well, I'm sorry, backup.

Let me use the universal, it depends.

It depends on, you're what you're trying
to accomplish, but most of the time,

if you're talking about like internet security,

the iron wall just saying exactly what is
allowed in is usually the best way to go, okay.

So we've got this access list created, right?

We're in global config mode, we're
going back to those two things.

Step 1, the config is done already.

But now we have to go to the application.

Now in this case I need to go into
the interface where I want to apply it

and in this case it's serial 0/0.

Now, I said right here assume
all ethernet ports are FAST here,

so this is FAST ethernet,
0/0 could I apply it here?

Yes, but it would miss one of the objectives.

So let's-- let's apply it here first.

So I'm going to go on router 1 and I'm going
to say, "Okay, I want access 1 to take effect,

global conifg mode, interface 00/0" and I'm
going to use the command, here is the command.

It is IP access group.

Well, why Cisco do that?

'Cause they had to have a different way.

So IP access group is how we apply
an access list to an interface.

It's not IP access list, it's IP access group.

I hit the question mark and it's says,
"Okay, what number of access list would you

like to apply or even what name
if you've used the name one.

I'll show you how to do that in a moment.

So, I would say I want to use
number 1 that's the one I created.

Now it's going to ask me that key question.

Remember I said last time you got to
get this one right, inbound or outbound.

Okay? How do I determine that direction?

Be the router.

I am router 1.

My right arm, you know, again, if I'm
a human being my right arm is 00/0,

my left arm is FAST ethernet 0/0.

So I'm holding him right here and I go, okay.

Direction wise, I'm applying right here.

Am I filtering traffic in as it's coming into me
from my right arm in the 00/0 or I'm applying it

out to where it's going out this interface?

If you think that through, it's in because
router 3 and everything else is going

to be coming in my arm in the interface
to me, the router sitting in the middle

and that's where I want to do filtering.

So I'm going to say, apply that inbound.

All right.

Let's do-- I want you to show IP, you
can actually type in show access list.

But the reason I like show IP access
list, they're the same exact command is

because I can hit the tab key after three
letters and it fills in all inwards.

If I do show IP or show access, I actually have
to type in the dash and the L and it works,

but it same-- same exact command.

Now, ooh-- ooh, check it out.

We've got deny 10.1.1.1, it's
there, but it hasn't done anything

yet because I can see below the
permit any is getting three matches.

So there's already three packets that have
come in and said, "I want to come in,"

and the access list says, "Okay, come on in."

And then they're going to say,
well, "Jeremy you're talking.

What's going on?

What is there matches coming in?"

Well, I remember I said at the beginning I set
up RIP, a routing protocol which is saying,

"Hey, I know about these networks."

So it's sending its little
updates behind the scene.

So chances, I hit the up arrow,
it's now up to six matches.

So RIP is talking and chatting and sending
its route updates, doing its thing,

that's the matching that I'm gaining.

Okay. Let's test it.

Let's go ever to router 3-- who is this guy over
here, right, router 3, and now we test it before

that I was able to ping I could
telnet to this guy so let's try now.

Ping 10.1.1.1.6.

Denied! A matter of fact
you can see right here Us.

That means unreachable as in a
protocol called ICMP has come

in and said, you are being blocked.

Usually when you see a U that means either the
router has no idea what you're talking about.

It' doesn't have a route to that
destination or an access list is blocking you

and sending back messages
saying, "You are being denied."

Now, when you get into the-- if you decide to
go security as your specialty and get in there,

one of the things that you'll
learn is a way to turn this off.

Because as a hacker, if I'm trying
to hack in somewhere and I do a ping

and I see Us coming back to me, that tells
me something, that tells me they are alive.

I can get there, but they have purposely put
an access list on there that this is blocking.

There is a command that you can do to turn
off what called ICMP unreachable messages.

So that way, it just says, dot.

It's as if you would have ping'd just an IP
address that doesn't exist, dot, dot, dot,

and you know, you can't tell
that you're being blocked.

So that's, that's in the security
series so I'll leave that to them.

So, let's do some more testing.

I'm going to try and telnet.

We just did up here right, telnet
10.1.1.6, telnet to 10.1.1.6.

Denied destination immediately comes
back unreachable gateway host that.

It's-- I'm being block from that.

Okay. So that verifies that I can't get here.

Now what about-- what about this guy?

I could ping him before.

So let's do a ping 192.168.1.50.

Successful!

So now, let's go up here to router 1 and
hit up arrow and do the same command.

Check it out.

Now, we can see it in action.

We're denying 10.1.1.1, 25 matches
from all of the pings in the telnet

and everything else I'm trying to do
to reach that, it's actually saying,

I'm blocking, I'm blocking, I'm blocking.

Okay. Awesome!

That is excellent.

Now, let me do this.

Wipe. I want to go back to the question I
said, "Couldn't-- could I apply it right here?"

Yes! Yes, yes I could apply
that same accesses right here.

As a matter of fact, let's do that.

I'll go into interface 00/0 and I'm
going to do no, IP access group 1

and so I'm taking it off of the serial port.

So I mean immediately upon doing that,
I should be able to hit the up arrow.

Now pings are going through successfully.

You can see access list and action right there.

But now, let's say I went into
FAST ethernet 00/0 and I said,

okay, well I want to apply it here.

First of, let me ask you, what
direction would you apply it?

Ken, be the router.

This is FAST ethernet 0/0.

This is 00/0.

I've got access to those one that says,
deny this guy, holding my arms out.

If I apply it right here, I want to apply
it outbound like as it's going out router 1.

Because if I apply it inbound,
what would that mean?

It would assume that 10.1.1.1 is over here
somewhere, you know, trying to come in.

That's not the truth.

That's not where it's at.

So it's going to applied outbound there and
let's do it because I just want to show you.

I'm going to under FAST ethernet
0/0, just let just hit the up arrow.

IP add-- oh, wait, stop the train.

We're moving too fast.

I just caused an internet outage.

So, IP access group 1 outbound so I've applied
it in the out direction on FAST ethernet 0.

Now, can I go to router 3 and test?

Yes I can, if I find them.

Router 3, I'm going to hit the up arrow and
ping them again, and okay, that's good right?

It means I'm blocked from getting to this guy.

I just tested that but what's missing?

If it's applied outbound right here, then
getting here which is one of the objectives,

block information, that's-- it's not going
to be there 'cause I removed it from this

so he's going to have no problem reaching this.

It's just when he tries to go out right
here, it's where it's going to be blocked

so let's just verify Ping 10.1.1.6.

Good. So again, verifying that this was indeed
the correct place to put that access list.

All right, let's look at number 2.

Use a standard access list to block access
to the 192.1681.0/24 from 192.1682.128/25.

Now, again, why it's so critical
to draw this out?

It's just so you can visualize what's going on.

So it's -- what it's saying here is
not to block the specific IP address.

It's saying block this whole network.

So 192.1682.128/25 so, that's
identifying the whole memory--

the 128 is the network ID so I'm saying
the whole network is being blocked

from accessing this whole network, so
again, big sweeping statements there.

Okay, so let's do that.

First off I'm going to go to--
okay, before I even do that,

let's figure out where we're at, right.

Again, standard access list
only blocks based on IP source.

So I can't really say what something is
denied from other than where I apply it to.

So if I create an access list, I'm going
to apply it here as things are coming

into that interface then I had cut off too much.

So again, I'm back over on the Router 1 and
I'm saying, "Well, I want-- I need to block--

no longer am I blocking access to this.

I need to block access to this subnet.

So I need to catch things as they're
trying to leave this interface."

Again, with standard access list, it's
as close to the destination as possible

because the close you move to the source, the
more chance you're going to block too much

since you can't really say
what they're denied from.

You just say they are denied and that's
just based on the source, so, okay.

So I'm going to be right here as they're
going out, right, that that interface,

I need to block them so I'm back over
on router 1 and I'm going to go in--

first off remove this one from
being applied, exit back out.

So let's-- a matter of fact,
let's just kill the whole thing.

I'm going to do a no IP-- a no access list 1.

And it's gone.

So that actually deleted the whole access list.

I'll do a show IP access list
and you can see nothing there.

They're all gone.

So let's go and create-- so I'm going to create
access list just-- we can use 1 but just--

because I want to be different, let's use 2.

So access list 2-- now who are we denying?

We are denying this whole subnet,
192.168.2.128 with that weird subnet mask.

So again, we're looking at that range,
192.168.2.128 through 255, okay?

So I want to block that whole
subnet so I'm going to say, "Okay."

So 2, I'm going to deny.

That's my goal is to block them.

And it says, "Okay, what address do
you want to match or do you want to do,

you know, any address or specific host?"

Well, I can't use any because that'll
block everybody and that's not the goal.

I could use host but that means I'm going
to have to type in host 192.168.2.128

and then hit the up arrow, 129.2.130, 2.131.

Come on, is this sufficient?

Can we say-- can I hear a no?

No, it is not sufficient.

So that means we're creating this slides,
show-- a giant access list, show IP Access.

You see all this.

It's just crazy but someone going to
say, "No, no, no," clear access list 2.

So let's blow it away.

So we could do that but not efficient.

So instead, I'm going to say, "I want
to block the network 192.168.2.128

but enter stage left the wildcard mask, okay.

Wildcard mask allows you to say these
are the bits that I care about."

Now, nobody is really certain to
why Cisco decide to go this way

like you would think it be nice and
logical to be able to say, "Okay,

we'll block that network like that."

But a wildcard mask doesn't do that.

Think of-- I mean, if it's-- okay, if you've
got a rebellious teenager and you're like "Man,

they're wild," what do you think?

You're like?

"Okay, they are doing the
opposite of what I want them to do.

They're doing the opposite of what would be
acceptable and normal to this family," right?

So think of the wildcard mask,
it's the rebel, it's the opposite.

So it's going to be the backwards
mask, essentially.

So we see the mask is 255.255.255.128.

The wildcard mask is exactly the opposite, flip
it, as in, if we're to look at this in binary,

you know, 111111111, all the way
down to, you know, 0.1.00000,

so that's the normal subnet mask in all binary.

wildcard mask flips.

So wherever you see a 1, put a
0, wherever you see a 0, put a 1.

So the wildcard mask could
be 0000000.000.000.011111.

So, you know, and take that all in binary
and then flip it as exactly the opposite

and there, you have the wildcard mask.

They are the weirdest looking things ever.

So the question is what is that-- what
is that binary number as a decimal?

Well, that's where you pull out your
mathematical mind and add 1,2,4,6,8,16--

did I count that right-- 32, 64, right.

That didn't feel right but,
you know how what I mean.

You add all the binary digits up to 64
together, you know, in one big math problem.

And that will give if you add them all up, 127.

So the wildcard mask, instead of being nice and
easy as a subnet mask, I go in there and I say,

"Actually, it's going to be 0.0.0.127.

Creepy! That's it.

That's the accurate way of identifying,
"I want to block that whole network."

Now, I've got a shortcut for you, doing
it all binary, it's kind of painful.

So what I usually do if I'm, like,
"Okay, what's the wildcard mask?"

I take all 255 and subtract my subnet
mask that I want to kind of convert it

over to a wildcard mask, and that will give me,
I mean, obviously, easy math there and I go 127,

you know-- so that-- that is the
wildcard mask for this subnet mask,

you know, /25 or 255.255.255.128.

That's the opposite.

So again, nice and bizarre, that's probably
the most difficult thing of access list.

Next to figuring out which direction
to apply them is going, "Okay,

what's up with this wildcard mask?

Why would I use?"

So let me ask you this.

What would the wildcard mask be for this?

If I were to generate a wildcard mask
for 192.168.1.0/24, what would it be?

It'll be-- we'd say, Okay, deny or permit
192.1681.0 with wildcard mask of 000255.

That's the flip opposite of a /24.

and the way to think about is if you like
looking at things in terms of decimal,

wherever you see a zero, that tells the
router, "Look at this, evaluate this.

This access list is either permitting or denying
so when this packet comes in, look at this.

Look at the 192."

And then it goes, "Okay a zero -- that means
look at this, look at this, well 192.168.

Oh a 1, look at this.

You make sure that you're watching this
and then this last one is I don't care.

Essentially, the 255 are all ones
says, "I don't really care what's

in that last octet, and that's good."

So if I have an access list, that' saying it
deny 192.1681.0, you know, this guys 192.1681.50

and it's going to come in and say "Okay,
you're 192, I look at that, I look at that ,

look at that" and it's like .50, I don't
really care about that, you know, whatever.

So you will be denied because
you start with this.

So it's really like what do
you matching on with this.

You could-- you won't do this but you could.

You could do something like I want to
create an access list center that says,

"I want to match 192.053.0 with
a wildcard mask of 0.255.0255."

And what that says is you know, let's just say
we said deny and then we put that information.

Let' say, "Okay, I'm going to deny any IP
address that has 192 in the first octet.

I don't care what's in the second
octet but they also have to have 53

in the third octet, right 'cause that's a match.

This one, I don't care what's
in the last octet."

So you can actually deny things
based on, you know, just one octet,

I mean if-- okay, let me ask you this.

What do you think-- let's
say I want a wildcard mask

that would deny everything all
the time, what would it look like?

I would say deny.

On the IP address, I would just put 000.

It doesn't matter what you put there
'cause it's not really caring about.

Wildcard mask 255.255.2550 or so not 0--
255.255.255-- I've said that too often.

255.255.255.255 it's very much saying deny,
I don't care, I don't care, you're denied.

It doesn't matter what IP address you have.

You could also go the other way.

For instance, let me show you this.

Remember when we did that access list?

Let me just use access list 50 as an example.

And I did permit and like in that
first example, we said host, you know,

10.1.1.1 right, a different way of doing.

So there's a couple of ways you can do it.

A different way of doing it is I could've said
permit 10.1.1.1 but now, it's going to ask me

for a wildcard mask so I would put 0000.

Now, watch this.

I'll do a show IP access list.

Access list 50.

It's automatically dropped that
because it assumes the host command.

I could've done the same thing.

I could type in access list 51 permit host
10.1.1.1, hit the Enter key, show access list.

Look they're one and the same.

One, I used the wildcard mask of all zeros,
one, I used the host command to type it in there

and it ends up being the
same thing, the same result.

So back to the example, we were using access
list 2 up here and I said, deny 192.168.2.128

with a wildcard bits 000127, right.

So that's the opposite of the subnet mask.

Okay, that's great and I'm
going to want to come back--

good grief if we got these things at mess now.

I'm going to come back in here and
I'm going to apply that algorithm.

But before I do, remember an access list with
only a deny command will deny everything 'cause

of the implicit so I need to go in
there and do access list 2 permit any.

And let's get rid of the other one.

No access list, my little demo
access list 50 and 51, they're gone.

So to show IP access list, and now I've
got few of that-- I have access list.

So I've got deny 192.1682, okay, that
looks good and permit everything else.

So now, I need to apply it.

And since this said, "Only-- you know, I
just get rid of all this chicken scratch.

Only deny access to this one
network, that's my focus.

I'm going to go into the router.

I'm going to say, "Okay, show IP and
interface brief and I'm going to look, I mean--

Well, that's the network
I want to block access to.

I don't want 192.1682.128
to get there so I'll go

in the FAST ethernet 0/0 IP access group 2
'cause that's the accesses I created right here,

number 2, right?

And then out.

So as this network tries to go out FAST
ethernet 0/0, I'm going to deny them.

So let's give it a try.

I'm going to shoot over to Router
3 first, just to make sure.

I'm going to do a Ping 192.168.1.50
and it works.

Now, don't be surprised.

You're like, "Oh, I thought--
didn't we deny that network?"

Yes, but Router 3 is not that network.

Router 3 came from this IP address, 10.1.1.1.

That's the IP address I Ping'd from.

So the access list came in there.

As a matter of fact, let's verify it.

The access list said, "Well
10.1.1.1 come on in."

So I'll do a show IP access,
you know, I've seen matches.

You know, those Pings are, you know, come on in.

you can feel free to come in but,
now let me show you something else.

Let me first-- I'll do the PC, I'm going
to PC3 up there which is right here, okay?

So PC 3 is right here so
I'm going to do a Ping--

let's do Ping 192.168.1.50
which is that host over there.

Hit the Enter key and sure enough,
I'm getting unreachable messages back.

And those used are sure indicator
that you've done it right.

But if you want to feel that warm and fuzzy
feeling, you can do a show access list.

And now, I can I'm getting denied
packets from that access list.

The other thing I wanted to show you is I
said Router 3 is not coming from this network.

It's coming from this, right?

Well, watch this.

If I want to, I can make
it come from that network.

Let's see how.

I'm going to go to Router 3 and I'm going to
type in ping, you know that one works fine.

It's coming from another one so I'm going to
hit the question mark after the ping command.

I'm going to say, "I'm actually
coming from the source IP address.

And I can either type in my IP address
or I type in 192.1682.129 or I can type

in the source, FAST ethernet 0/0.

And sure enough, now, take a look at this,
it says, I'm sending five pings to that guy

with a source address of
192.168.1.129, which is right there,

and you can see sure enough those
are all denied by the access-list.

That's pretty cool.

Okay. Last example, and first
off, at this point,

you should feel a little more
warm and fuzzy about doing this.

So you might just want to pause and write
this up on paper or try it on a router

if you have one and see if
you can figure that out.

But I'd like to use this last example to
illustrate an example of using named access-list

which I love far more than the number ones.

So it says, "Create a standard
access-list to block 192.168.2.50,

to this one, from reaching 10.1.1.

That's this one.

So, block them from getting there.

So looking at that, I can think, "Okay.

Well, I could either apply
it outbound right here.

Can anyone say this guy is blocked from getting
here or I could apply it inbound right here.

Now, basically, regardless of which one you
choose the results is going to be the same.

I'm not going to be able to reach this, but also
by saying block to this WAN IP address I'm going

to be automatically be denied from
reaching that network too, why?

Because standard access-list
can't say what you're denied from.

They just say, "You're denied."

So, when I say deny 192.168.2.50 and apply
either out, excuse me, out right here

or in right here then access-list
is going to say, "You are denied.

You are denied from getting any further."

So, honestly, I would think it might be a
little more efficient to apply it out right here

because otherwise you have to cross
the whole WAN link just to find

out on the other side that you're denied.

It's like a bad trip to Disney Land, right?

You got to drive all the way to California
just to find out Disney Land is closed

for the day or something like that.

So you don't want to have this
packets drive further than necessary.

So in this case since the result is the same I'm
thinking applying it outbound right here would

be the best way to go.

So, let's do this.

I'm going to get into router 2.

I haven't even been on this one yet.

And let's go into global config mode.

So now let me show you, so, so far we've been
using number access-list which is done by typing

in access-list and a number, whatever
number we want to, to pick what kind.

But the better way, I believe it's a lot cleaner

or it just makes more sense
is to type in IP access-list.

Okay. Same thing that we're after in access-list
just putting the IP and the keyboard in front

of it tells it I'm going to
create a named access-list.

So notice, instead of asking me for a number to
identify what kind it is it's just asking me,

it's just like, "Hey, why don't
you just identify what it is?

Is it a standard or is it
an extended access-list?

Now, all these other commands is like, "Okay.

Do you want to renumber it?

Do you want to set up logging or a log update?"

But really the main command is standard access--

well, right now we are creating
standard access-list.

So I'll type that.

Well, you can even use this command to
modify one of the numbered or now I'm going

to give you the option to type a named.

So I'm going to say, BLOCK PC 2 ACL.

I put little underscores in between.

You can't put spaces.

But do you see how that makes more
sense when I do a show access-list?

If I see, BLOCK PC 2 ACL-- it's going to bug me.

Hang on. I want BLOCK PC 2
not-- no underscore there.

So BLOCK PC 2 ACL, now when I do
the show command I can see exact--

just by looking at the name
I know what it is rather

than being like, "Oh, what was number 73 again?"

You know, you have to have some
kind of reference for that.

So I'm going to say, "Okay.

I want to block 192.168.2.50."

So the way this works is it's just
as if I had type IP access-list now--

or access-list, you know, whatever I
want, now I can say, permits or deny

or I can even use the sequence number.

Now, you saw that by default so far when we type

and create an access-list it creates
sequence numbers of 10, right?

The first command we type in is a sequence 10.

Next one sequence 20.

Next one sequence 30.

Now, if you want to you can type
in your own sequence number.

So I can say, sequence 100.

You know, and then type in permit or deny, or
anything like that, or if I just type in permit

or deny without typing any sequence
number it will automatically use

that increment of 10 for me.

So I'm good with that.

So let's just say, deny.

I want to deny 192.168.2.50, wild card
bit, 0.0.0.0, and then, you know, again,

I've got now an access statement
or accesses that were just to deny.

So I'm going to say, "Permit any."

Okay. So I'm going to go back and do a show
access-list and now I can see I've got accesses.

Don't you love the name better BLOCK PC 2 ACL?

Same syntax as before or
sequence 10 deny that host.

Sequence 20 permit everything else.

So now I can go into interphase
serial 0/1 on that side.

Network diagrams are essential
for this and do IP access-group

and now I'll just type in
the name BLOCK PC 2 ACL.

By the way, keep in mind,
oops, this is case sensitive.

So if you use lower, uppercase
you got to keep it consistent.

I always type them in all uppercase because
it's easy for me to see in a show run

and then I'll hit question mark,
outbound, playing it out 0.00/1 interface.

Good! So now I'm going to test it.

I'm going to be sure that it works.

Let's go to PC 2 and I'm
going to ping 192.168.2.

Well, actually, the goal was
to block it from 10.1.1.1.

So let's start there and make
sure we achieved our goal.

And sure enough I'm getting those
unreachables show access-list.

I can see that I'm denying that host so
it is working, but also just as a bonus

because there's-- with the standard
there's no way of stopping it.

I'm completely denying access to
everything beyond that WAN interface as well

because it's just saying, "You are denied."

With the access-lists, as
I said, the more and more

and more you do the better and better they feel.

What I would like you to do is first off, if
you have your own router or something like that,

use that to practice the syntax
to come up with those scenarios.

As a matter of fact you could
just run through the scenarios.

You know, just bring up the slide.

I've been using this entire time, pause it,
and now see if you can do those three examples

on your own without actually
watching me walk me through that.

Then I would start going through in
and coming up with your own scenarios.

You know, come up with I want to
deny this from this and try it out.

I'm going to make that GNS
3 typology available to you.

So if you have GNS 3, if you've
played with that maybe you check out,

I think CBT Nuggets has some free GNS 3 videos
that you can download if you don't have access

to whole thing that, well at least show
you how to get started with it and so on.

It's again free emulator
software that you can use.

You know, import that typology
and start practicing

with the environment that
I've created right there.

So once you're feeling pretty good about
standard access-lists go ahead and jump

into the next one which is
going to be the extended world.

I hope this been informative for you
and I'd like to thank you for viewing.