All language subtitles for 31 - Routing - Configuring and Applying Extended Access Control Lists-eng

>> While, we're building on the
foundation that was laid in the last Nugget

on standard access list, enhancing it now
with more capabilities in the extended world.

Same story, multiple scenarios back to
back to back that we're going to walk

through to show examples of
using extended access-lists

and by doing that, solidify the concept.

Same topology as before so we can
focus on the access-list concept,

not re-learning what the network looks like.

We've got five scenarios, three of
which are on the screen right now.

Number one, use an extended access-list
to block 192.168.1.0/24 so these guys

from reaching 192.168.2.128/25, it's these guys.

Now is it possible to do that
using a standard access list?

Yes, the answer is absolutely yes.

However, we can be a lot more
efficient and it's just the norm

to be using extended access-list
for these kind of things.

Anytime you have a source and a destination
or port number or anything like that,

extended access-list is the way to go.

So, as a refresher, extended access-list, they
can filter based on source and destination IP,

they can filter based on protocol
so things such as TCP, UDP,

ICMP, et cetera, et cetera, et cetera.

Those are the ones we care about
in CCNA, and then port number.

So, for instance TCP port 80, TCP
port 25, all that kind of stuff.

Now before-- I'm going to hold off.

So let me do this, I'll show you the kind of the
base example and then I want to start talking

about what are some common port
numbers that you're going to run into.

So, what we're going to do is start off with
the big question, where do we start off?

Remember, there're two things, you configure
the access list, which you can do all day

without affecting anything and
then you apply the access list.

That's where it goes into action.

But before you can configure,
you have to know where you're at.

Now here's the concept.

With extended access-list, we can
filter based on source and destination.

So, based on this question, we need to create
a statement that says deny 192.168.1.0/24

from reaching 192.168.2.128/25, right?

So, put that statement in there and
then we can say permit anything else.

I'm just kind of pre-planning
our steps with this.

Now, think this through with me.

If I can say deny this source from reaching
that destination, where can I apply it?

Well, there're actually a lot of places.

I could apply it like what we're doing with this
standard access list, outbound right here to say

as they're going out that interface,
check this, is it this source?

Are they trying to access this?

Then they will be denied.

And it will work, absolutely.

But follow this, I could apply
it inbound right here, right?

And I could-- you know, as packets are
coming in, they're chugging along their way,

as they get in, it's going
to say, "Okay, are you this?"

And they'll say, "Yes, we are
because we're coming from here."

And it's going to say, "Well,
are you trying to access this?"

And they'll say, "Yes, we are.

That's where we're going."

They'll say, "Okay, well then,
right here, I'm going to deny you."

So just following that same
logic, do you see the point here?

I could apply outbound right here,
I could apply inbound right here.

I could apply outbound right here and
I could even apply inbound right here,

because even before the packets get
into the router, it can, you know--

before they go any further
it can say, "Are you this?

Are you trying to access this?

Oh, okay, then you're going to be denied."

So I can even deny them right here.

So then the big question is
I could apply this, how many?

One, two, three, four, five, six
different places, they all work,

they all accomplish the result,
what's the best place to do it?

Cisco would tell you, right here.

Why? Because the further down the chain
you apply the extended access-list,

the further the traffic has to go
just to find out that it's blocked.

So, if I apply it right here, that means this
router had to process it, waste bandwidth.

This router had to process, waste bandwidth.

And it had to get here and be processed
before it found out it was going to be denied.

Like I said in the last Nugget, it's
like that bad trip to Disney Land,

we're driving all that way just
to find out Disney Land is closed.

So we'd rather know before we leave the house,
essentially right here, that it's closed

or that we're going to be denied
and that's Cisco's best practice.

With extended access-list, the rule is to
apply them as close to the source as possible.

Even though it would work further
away, we want to be able to--

to be as efficient in our
configuration as possible, too.

So, with that in mind, that's where
I'm going to begin my configuration.

Let's go over to router 1.

So I've all the-- I was getting rid of all
of the old config from the previous ones,

so let's clear all that off gone.

So, router 1, now I'm going
to go-- let's start--

and I know last Nugget, we wrapped up with
the named access list and we'll go there,

but I'm going to start off with the
traditional way which is numbered.

First off, let's do a show ip interface
brief that's just constant orientation.

Okay, it's-- I, I know where I am,
that's 192.168.1.1, that's right here,

FastEthernet zero, serial 0 is right here.

So, I'm going to create an access list.

I'll do access list, question mark.

Now we're going to move into the extended range.

So I'm going to say extended, now you remember
the syntax from the last Nugget, right?

So, for instance, if I said, you
know, five and I would say permit

and it's like okay, what's your source?

You got used to that, right?

So now, when I do access list, let's
go 100, I'm now in the extended range,

I hit the question mark, immediately I
see, there's a little difference there.

There's this new word dynamic,
we're actually not going

to use those, but there's a new word in there.

So, I already can tell that I'm moving on a
little different track, so what am I doing?

Denying somebody.

I'm denying 192.168.1.0 from
reaching the other one.

So, okay, so I'm going to say deny,
question mark, and now it's like, whoa,

syntax went a totally different direction.

First question it's going
to ask you is what protocol?

What protocol?

Remember, that's one of the
things we can filter on.

What protocol would you like to allow or
deny key ones that we care about, ICMP,

that's things ling pings, echo, echo reply,
unreachables, all those kind of things.

TCP and UDP and IP.

So, ICMP, protocol-wise, TCP, UDP, and IP.

These three we know.

Those' are the protocols that applications
use so what's this mysterious IP?

IP is everything, like for instance, you see a
whole bunch of protocols there and if I allow,

you know, maybe I block TCP
traffic from these, well,

problem is that allows UDP to still get through.

That allows, you know, ICMP or IGMP and
ESP, all these other stuff can still get

through 'cause there's other protocols in TCP,
but if I really want to catch all of them,

IP is essentially everyone of these in one.

It's all protocols is what it is.

And that's what we want here.

We said, "Block this from getting there."

It didn't specify anything more so we're
left to assume block, that's what it means,

like deny everything, not just TCP or UDP.

So we're actually going to go in
here and say, "Deny the IP protocol."

Now, I'd ask the question, what source
address would you like to deny from?

And I'll say, "Okay, well,
I'm not actually looking

for everybody nor am I looking
for a specific host.

I've been told to block this network
and that's what I'm going to do."

I'm going to go in and say, "The source
that I'm blocking is 192.168.1.0."

And of course, it's going to say
"Okay, well, give me something more.

Are you looking for just a host
on there or the whole subnet."

So that's where our good
old wildcard mask comes in.

Remember, this is from before,
this is a class C subnet mask.

Flip that, completely backwards rebel land
and the wild world, we flip that around 000

which says, "Look at 192, look at 168, look
at 1, I don't care about that last action."

So, that can be anything.

If it starts with this, they match this.

They're going to be denied.

So I'll say 0.0.0.255.

Now, we get new options, things that we
didn't see at all in the standard access list,

it's saying "Okay, now what
destination would you like to refer to?"

So I'm going to say, "I am blocking this
source from," now I typed in the destination.

Well, I'm not blocking it from
everything nor a specific host.

I'm blocking it from this network, right?

192.168.2.128 right here, so we'll type that in.

That's, that's the network ID,
192.168.2.128, hit the question mark.

Now, it says, "What's the wildcard bit?"

Well, you remember, we use the custom
subnet here, so wildcard bits are going

to be 000 dot and how do we figure that out?

Well, slash 25 in decimal is 255.255.255.128,
one of those funky subnet masks.

So I could either convert all these to
binary and then make all the one zeros

and all the zeros one to figure it out or
we can use that handy-dandy formula which is

to take 255.255.255 and subtract this and
that gives us 0.0.0.127 is the wildcard mask

that we need to use to match that whole network.

So, come in there and do 0.0.0.127.

Hit the question mark, you know, things
like do you want to log this enter-- entry?

Are there certain types of
service that you want to match?

I mean, all of these goes way beyond.

Types of service, DSCP, all those kinds
of things, deal with quality of service.

Same thing here, different quality
of service tags that we can use.

Don't even worry about it for now.

I hit enter.

We have entered our first
extended access-list statement.

Let's do a do show IP access list.

Right there, we've got deny
this source to this destination.

Now, extended access-list can get pretty hairy.

The biggest thing that you can do
is remember the three key pieces.

You're going to say-- well, I'll
say you know, permit or deny right?

I guess that-- that doesn't count.

Permit or deny, so you have the
protocol, that's one key piece,

you pick your protocol you then have your
source and you have your destination.

No matter how complex, how big this thing
starts getting like we're going to start seeing

over here, no matter how big this is, you're
always going to break into those three pieces,

you pick what protocol it is, what your
source is and what your destination is

and that makes sense when we look at this.

Deny IP that's a protocol, this is our
source, this is our destination, cool?

Now, extended access-list have the same rules
as a standard if I have a deny in there,

there's the implicit deny below that
so it's going to deny everything.

So what I need to do is get in here and type
in, IP or-- wait, hang on, where was it?

Access list 100 and I need to add a
permit, so I'm going to say, you know,

they're denied from that, but I'm
going to permit everything else.

Now, in an extended world, we have
to type in permit so when I say,

"I want to permit everything
else," what protocol is that?

IP, right?

That's everything, all protocols.

What's the source?

Well, we can actually be very broad here.

I can say any source to,
well, what do you think?

Any destination.

That is your way of doing
a permit all at the bottom

of an extended access-list to
overrule that deny everybody.

So, now it's saying, "Okay, if
you're this and you're trying

to go to this, you will be denied."

However, if you're anything else, you will
be permitted even if you're this trying

to access something other than
this, does that make sense?

So now, I can go in to applying it to
Cisco's best practice as close to the source

as possible, so I'm going to go into
FastEthernet0/0, same exact command

as we saw previously, IP access
group and we say "Okay, well,

what's the access list number or name?"

And we'll say, "Access list 100," that's
the one we just created so I'm saying,

"Apply this access list in
the inbound direction."

Again, be the router-- I'll stop drawing my long
arms in a minute but fast FastEthernet0/0 is

over here so I'm saying as things are coming in,

in that interface 'cause that's the
interface mode I'm under right here,

it's going to start going through
that access list and saying,

"Are you trying to get over here?

Because I'm going to deny you
otherwise, you're permitted to go through

and pass out the Serial0/0 interface."

So that will accomplish the goal.

Let's test it.

I'm going to go to PC1, that's
over there on the left.

No, it's right here, and let's
just do a show ip interface brief,

yes that's just a little lone guy over there
on the network 192.168.1.50 that's him,

so I'm going to try and ping, let's try and ping
10.1.1.1 make sure we can still get there, yup,

and that-- so 10.1.1.1 you might remember
is this guy, so it's going all the way

across the network to here to reach it but
now let's add in, let's go a little further.

Let's go to ping 192.168.2.150 which should be
a forbidden IP address and sure enough it is.

So, the good news is our device is literally
getting right here and being blocked.

He doesn't have to travel much further
like we did with the standard access list,

we can't apply the standard
access list any closer

than out here 'cause you can't say what you're
denied from so we would always have to have all

of our traffic crossing the
whole network to get there.

Now I'm able to go back in to my
router 1 to a show IP access list

and I can see all the matches, the
things that have been denied as well

as the things that are being permitted.

Okay, number two.

Block 192.168.1.50, so this guy, from reaching
192.168.2.50 so this guy using HTTP or HTTPS.

So what can we assume?

Well, we'll just pretend that this guy is
actually a web server that would be using those.

So now is what I was holding myself
back from, now is a good time

to talk about common port numbers.

TCP, UDP all of the different protocols out
there have specific port numbers that they use.

I'm going to do TCP, UDP and
I'll just put ICMP up here.

The three protocols we've been talking
about so far, I guess we can throw IP,

but it doesn't really have any port
numbers 'cause that's everything, right?

Those are the protocols that we've
been talking about in the config,

there are ones that you will want
to know off the top of your head.

TCP port 21 FTP, port 22 is SSH,
TCP port 23 is Telnet, port--

you want to know port 25 which
is SMTP that's email services.

You want to know, maybe 53, which is
actually a DNS server, so for instance,

DNS servers that have all those records like
google.com really points to these IP addresses,

they replicate to each other or they
can and they use TCP port 53 to do that.

Port 80, the most well-known port in the world,
HTTP, port 110 POP3, that's client email.

So if you're downloading email
from an email server, you use POP3.

On the same token port, what is it?

143, IMAP4 which that same thing, a client email
but instead of downloading it from the server,

it leaves it on the server so that way,
the client doesn't hold the email at all,

it stays on the server, so IMAP4.

And then the only other one
that I could foresee popping

up at you is port 443 and that is HTTPS or SSL.

So, encrypted or secured
HTTP uses that port number.

Now I know, you're like "Ooh, that's a lot of
port numbers to know off the top of my head."

Yes, the vast majority of them
are in TCP because that's what all

of our data applications use, correct?

Now UDP, there are some but very
few, UDP, you really only want

to know port 53 which is DNS client.

So when, for instance, your computer at home
goes to google.com or cbtnuggets.com and tries

to resolve that name to an IP
address, it sends out a UDP request.

It's just a-- that's the normal DNS lookup.

And then port 69 which is TFTP.

Our Cisco devices use that for a lot

of configuration backups or
upgrading the IOS software.

So, those are really the only two on UDP.

ICMP doesn't really use port numbers, it
uses protocol numbers or protocol name

so the only two you'll want to
know there is echo and echo-reply.

And if you combine both of
those together, what do you get?

A ping. That's when you ping something, it
sends an echo and the other side sends back

and an echo reply so that's how we do that.

So, I would suggest and now this is-- well, you
know, I was going to say, if you're studying

for the exam, but I would say real world.

Yeah, I mean, you use those all the time 'cause
those are the major services that you end

up supporting as a Cisco firewall administrator
or you know, whatever you're doing with those,

you constantly run across those service, so
it's for good reason that Cisco allows those.

So, okay, now back to the objective,
block 192.168.1.50 from reaching this guy,

who's probably a web server, on port 80 and 443.

This is going to be awesome, I just-- I
paused and I was like, "I've got an idea."

I want to take this opportunity to
show you how to edit an access list,

because see here's the deal we
already have, in scenario one,

blocked this guy from reaching
out over here on everything.

So now we're saying, "Okay, in addition to that,
I want to block this guy, that one IP address

on the network, from reaching
to this guy on port 80 and 443."

I know that because I, you know,
just did the quick correlation,

HTTP and HTTPS are there in that list.

So, we've already got an access list
applied inbound right here that we can edit

to add those restrictions to, so let's do it.

So, where am I?

Router 1, come right there, so
there's our existing access list.

Now you notice that we've got
these sequence numbers right there.

So that's going to leave us
in a little bit of a pickle

because if we-- yes, I did just say pickle.

So if we use our normal access list
command, if I say access list--

access list, you know 100 and I keep going
down and I say, you know, permit IP--

or TCP and I start squeezing in all the stuff,

it's going to keep adding on
to the bottom of the list.

No, no, no I can't do that.

I want to squeeze stuff in.

Now, do any of you remember
where we saw that little--

in the last Nugget, I had the question mark and
we say the option to type in a sequence number?

So I can say, "Well, squeeze in sequence 15
in between these two," or something like that.

Remember where that was?

It was in the named access list,
so let's back up a little bit.

If I type in-- how to get
to the named access list?

IP access list, right?

And I'll say this is going to
be instead of using number 100

and all that to specify it's extended, I'm
going to say, "This is an extended access list,

but now, it lets me type in, oh, which one are
you editing or which one are you creating?"

You can do both with this command.

So we'll say extended and we'll say number 100.

Now, you noticed it says, "Okay,
go ahead and press Enter."

Thanks, I'm now in the configuration
mode, editing that access list.

So now, what I can do is specify a sequence
number to squeeze in the commands I'm

about to do before we get
to that permit IP any any.

So, what do we do?

Okay, so we're, first off, needing to
block HTTP and then we'll block HTTPS

which we'll be really easy
once we get the first command.

First off, I'm going to say, "Okay,
previously, we had sequences 10 and 20,

so I need to squeeze it in," so I was
saying 15, but why go right in the middle?

Why not just use 11?

How is that?

So, sequence number 11 will
add the line between 10 and 20.

It's like-- any of you-- my roots go
back to the Commodore Amiga Computer.

That's were I really got
my first taste of computing

and I remember [laughs] trying
to learn programming.

Now this is many, many moons ago.

I was much, much, much younger.

And I got into basic programming
thinking, I'm going to--

you know, what's every kid dream of
when they're getting into computers,

I want to be a video game programmer, right?

And so I got in the basic and, you know,
got the book and out and says, "Okay,

type in line 10, echo, hello world."

And then you-- so you typed that into the
basic compiler 10 Echo, you know, hello world.

And then you do a line 20, go to 10, and you
run the program and you just get a screen full

of hello world and that's about as far as
I got and I'm like, "Well, that was lame.

I'm a long way away from creating, you
know, Defender of the Crown kind of games,"

[laughs] you know, like which was of
course the game of the year back then.

So, what was I talking-- so that-- so
yeah, this is very similar to that.

We just got these sequence numbers
to keep everything straight.

So, I'm going to say sequence
11 to squeeze it in there,

now we can put it in our
permit and deny statements.

So I'm going to say, "Deny.

We're blocking them from--
" So saying, "Deny what?"

Well, HTTP is a TCP-based protocol, right?

So I'm going to say "Deny TCP."

It's the-- TCP is the protocol
that I'm blocking.

Now it's saying, "Who are you denying?"

Well, it's nice and easy here so I can say--
well, there's two ways, I can either say host

and type in the IP address or I can type in
the IP address, let's do 192.168.1.50, right?

The two we're-- let's this
squeeze this a little bit.

The two we're blocking 192.168.1.50 from-- and
then so I'll hit the question mark says, "Okay,

what's your wildcard bits, 0.0.0.0."

So if I would have used the host
keyword, I could have skipped doing

that 'cause it would assume that.

So, now it's going to say, okay, what is your--

okay what is your-- so I've
got this mouse, right?

And the scroll-- it doesn't have a scroll wheel,
it's invisible, like if you just kind of move

over the mouse, it scrolls for you so
that's why I'm doing all that time.

So, it's saying, "Okay, this is your source
now into your destination," but wait, but wait.

This is actually a point where
a lot of confusion comes in,

because somebody hits the
question which we all do.

This is-- hitting the question mark
is something you always do in Cisco.

And we see-- oh wait, wait, match packets on
a port number or greater than a port number

or less than a port number or
not equal to a port number.

That's NEQ, not equal to or range of port.

So we're like, "Oh okay, so this is
where I type in my port number, right?"

Major area where access list get
kind of messed up and this goes back

to what I was just showing
you on the last example.

Remember, the access list is always
comprised of three main pieces.

You say, I want to allow or deny the
protocol, which we chose as TCP, the source,

you put in your source information,
then the destination.

Now you might be saying, "Well yeah,
that's what we're doing, right?"

And we said, port 80.

Well, if we type in the port number right here--

not there, right here, if we type in the port
number and we say, "Okay, equal to port 80,"

then we're actually choosing the source
port and that's not what we want.

I mentioned this way early on in the
series so I want to talk about it again.

When a computer creates a connection to,
well, let's just say this web server,

it'll always creates what's known as a socket

and what a socket is-- this
guy is 192.168.2.50, right?

And this guy is 192.168.1.50.

So a socket is when he says, "I
want to talk you web server."

And the web server is like, "Well,
I actually do a lot of stuff.

I'm a web server.

I'm an email server.

I'm a [laughs]-- like what else--
oh, I'm an online gaming server.

I'm a database server," I mean, he's like,
"So what service on me do you want to talk to?

You can't just say you want to talk me, you
got to tell me what on me you want to talk to,"

so that's why this guy creates a socket.

He says, "Well actually, I want
to talk to you, 192.168.2.50.

I want to talk to you on a
socket of 192.168.2.50:80,"

which now when he gets that he goes, "Oh, okay.

You're trying to access my web server,"
because that's assigned to port 80 on here.

But at the same token, this guy also creates
a source socket, to where he says, "Oh,

coming from 192.168, you know, when you talk
back to me, I'm coming from 192.168.1.50 colon."

What is it?

How's 5196?

[laughs] We don't know because
Windows makes that up.

When I open-- you remember this?

When I open a web browser, I open, you
know, Google and go cbtnuggets.com,

the operating system-- we did
this early on, we do netstat.

It comes in and says, okay, well, I'm creating
all these little source ports, you know,

this is my source IP address and I'm going--

you know, coming from this source port
which identifies, you know, Google Chrome

or whatever app and now I've got other stuff
right here like wow, that's a lot of stuff.

Well, I've got a lot of stuff running on here.

But you know, these, I can tell
you, are all related to CBT Nuggets

because CBT Nuggets stores their data
in Amazon AWS which uses EC2 services

which is-- that's another great series.

If you're ever interested in that, CBT
Nuggets has a series on AWS, it's amazing.

[laughs] Amazing.

So, moving on.

So, this, you know, is going to be
made up by the operating system.

So if-- going back to where we're
at, let's see, we were on router 1.

If we type in equal next to the source, we're
going to be saying, "I want to deny based

on the source port number," which we
don't know what that's going to be.

We rarely if ever are going to know
what the source port are going to be--

is going to be, so rather, I'm just
going to go right into the destination.

I'm going to say, "Okay, I've specified this.

I've specified my source and I'm not
going to specify a source port number

because I don't know what it's going to be.

I'm just going to move on to the destination."

So watch this, come back here--
oh, I just pasted that in.

And now I'm going to say, "Okay destination."

Well, the destination host is 192.168.2.50,
hit the questions mark, wildcard bits 0.0.0.0.

There we go.

So we've got-- I'm denying a TCP from this
source, no port number, to this destination,

and now, now, we specify the port number.

Now notice, equal to a port number.

Now, we get a ton of other options like,
you know, match flags, log, [inaudible],

I mean, it just goes on and on and on.

But really, the main one
that we use is equal to.

So I'm going to say, "I want to deny TCP on
ports equal to and I'll hit the question mark."

I know I'm reaching the edge
of my screen there-- equal to--

and now look at this CISCO says, "You can
just type in the port number which I prefer."

You can just type it in right there and
we'll take whatever port number you specify

or Cisco's like, "I know sometimes you
forget a lot of the common port number

so we created a list of-- and I'm
putting in quotes, "common" port numbers

that we haven't updated since 1985.

I mean, it's like seriously,
this-- I mean, look at this list.

I mean, gopher.

Does anyone remember Windows 3.1, where
you had the original like a little gopher--

it had little teeth that-- it was
like-- it was FTP before there was FDS.

So, I mean, if you want to remember this archaic
list, then go for it, but I'm telling you,

just stick to the port number, you know.

So let's go on, so you can see the list.

Now, notice this.

It's not even HTTP that they chose as the name.

They said www which again, it's
been that way since long, long ago.

So, we'll just put equal to 80, how about that?

Whoa, you see what just happened there?

It just kind of scooted over
and put a dollar sign.

Remember way early on in the series, I said,
if you ever type a line that's really long,

the iOS is like, "Okay, I'm going
to put a dollar sign representing

that you've reached the end of that line."

So-- or I should say, there's
more to the left here

so you can scroll back to see the entire thing.

So, I'll hit the enter key
and now I've got in there.

Now watch this.

I'm going to a show ip access list
so we can verify that command.

So notice, first off, sequence 11 so it squeezed
it in between 10 and 20, that was successful.

Notice as well that the Cisco
IOS recognize, it goes, "Oh,

you're using a wildcard mask of all zeros.

Tell you what, how about we make that a host?"

So, remember, I said you
can type it one or two ways.

Well, you can, but the Cisco
IOS is like, "I prefer this way.

It's a little prettier that way."

So let's do that.

So it converts back it to you.

And also notice, it recognized port 80,
he goes, "Oh, well, you really mean www."

Does that mean that we have to know that?

No, it just means that, you know, there's a--

you know, the IOS does a lot of stuff
behind the scenes and that's fine.

We'll let it do that.

So, that now allows or I should say denies TCP
from this source, on any source port number,

to this host using the destinate--
remember, when we're talking about socket.

This is a destination port
number, destination port of 80.

Now, what about HTTPS?

That is just an up arrow away.

I hit the up arrow and say, okay, well--
actually, I'll go back to the beginning and say,

"This will be line 12, sequence 12."

Otherwise, it will-- but you may go,
"Well, what happens if you put 11?"

Some IOS versions, it all squeeze
it in and bump the other one down.

A lot of other ones will say, it
will either overwrite it or it will--

it's IOS dependent or it will just say,
"Sorry, there's something else at sequence 11.

You can't create it there."

So it's usually best just, you know,
don't try and figure out which you got.

Just go in and specify a unique sequence number.

So I'll put 443.

That's HTTPS.

Hit the up arrow.

With that, we've now got two lines in there
that's denying or saying, "Deny this source host

to this destination host on this
destination port for both of them."

Okay. Great.

Now this-- so we edited the
existing access list.

The beauty is it still applied to the interface.

So I still have the ability
to go in there and test it.

I don't have to reapply it
or anything like that.

Now, you've got to be careful.

It's a little dangerous 'cause these
commands are going into action right away.

So if you mess up, it's not like, "Oh,
whoops," you know, like this is, while it's--

well, the router is working, so these are
immediately active when you press the enter key.

So let's test it.

How do I test this?

Okay. One way that we can test access list, now
obviously this is a router that's simulating

as if I was a PC and does a very good job
at that, but there's no web browser on here.

So I can't open a website and test it there
and nor is this device really a web server.

But one of the things I can do is
use the Telnet command to test.

I might say, well, Telnet--
wait a sec, that uses port 23.

It does, but watch this.

I'm going to type in Telnet 192.168.2.50
and I'm going to follow up here

and see that it gives me the
option to type a port number.

So, I can say, well Telnet-- if I just hit the
enter key, it will Telnet and I can say, "Oh,

hey, I can Telnet to that device.

That's great."

Okay. So I'm going to get pass that.

So that verifies to me that port 23 is working,
but when I go back and I'll say, "Well,

I want to specify Telnet to port 80."

It immediately comes back.

It's like, deny.

Now, okay.

Did that happen because this guy isn't
running a web server or did it happen

because the access list really did block that?

Well, how do you think we can see?

Go to router 1.

Hit the up arrow and see did we have any hits?

And we did.

Essentially, PC1 sent three attempts to try
and open that www port, it tried to get there

and the router was like, "You're denied.

You're denied.

You're denied."

So, okay let's try this, let's
hit the up arrow and try 443.

Hit the up arrow.

Look at that.

Now we have three matches on that.

So that will-- I mean, without actually
having a computer with a web server to--

or a web server setup and a web
client to test, what a great--

and by the way, everybody does this.

This is a very common thing in the real realm
of Cisco that you're constantly using Telnet

to really test if your port
restrictions are working or not.

In this case, we can see
they are working like a gem.

Now, I'd like you to pause the Nugget and
see if you can do number 3 on your own.

Even if you don't have a Cisco IOS in front
of you, whether it's GNS3 or a real router,

still just write it down on paper.

That's where you really get used to the syntax.

Write it down and see if you can figure
out the commands that you would use.

Now, I will tell you, it's a little challenging.

It goes a little different mindset
than what we've done so far.

Okay. So pause and let's do it.

Okay, so permit 192.168.2.0 to access 10.1.1.1.

Let's identify the player.

So I'm saying, permit this whole subnet,
192.168.2.0 that's the network ID slash 25.

So that whole subnet and we figure
that out in the last Nugget,

that's really 192.168.2.0 through 127.

This being the broadcast,
that being the network.

So, you know, that first one is usable when
all the-- we figured out the range for that.

So we're saying that whole range can
access this guy only using Telnet and SSH.

Now, again, this IP address right here, okay?

So, where are we at?

Most efficient close to the source
as possible is going to be router 2.

Okay? So, I'm going to go in router 2 and let's
just clear the screen from the previous Nuggets.

So let's clear the screen off that.

Router 2, and I'm going to shrink this down
just so we can keep things in front of us.

All right.

So, I've got permit 192.168.2-- there we go.

How about right here?

Permit 192.168.2.0 to access it.

So I'm going to go in and let's use this
opportunity, use a named access list.

Again, you can use number.

That's fine if you did this beforehand, but
I'm going to use a named one 'cause it kind

of gets you experience with that side as well.

Anytime you want to use a named
access list, it is ip access-list

and then we hit the question mark.

We say, "Okay.

Extend it."

We're in the extended world now.

And what name do you want to do?

We'll just say, let's just say,
R3 Telnet SSH, how is that?

Just a unique name.

Okay, so I'm going to come
in here and do a permit.

Now again, we could specify sequence
numbers and all that, but I'm--

this is a new access-list so I'm just going
to let it kind of generate those for me.

So I'll do permit and we're going to say the
protocol, so we'll say, TCP as the protocol.

Permit TCP 'cause Telnet
and SSH are both TCP based.

That's port 22 and port 23.

So permit TCP from the source of 192.168.2.0
with a wildcard mask and you know,

we've figured this out a couple of times.

It's actually 0.0.0.127 is that custom
wildcard mask for the slash 25, right?

So that is what-- that's how the router knows
its-- all of these IP addresses, 0 through 127.

So, I'll hit the question mark.

It says, "Okay.

You can either type in a destination
address or put in port numbers."

Now, again, we're not going
to make that mistake.

If we type in a port number here, it's the
source port number and we're not doing that.

We don't-- we're caring if it's
going to the Telnet and SSH protocol.

It's going to this device on port 22
or 23 not coming from port 22 or 23.

So I'm going to say, it's going to the host
10.1.1.1 'cause we're only permitting access

to this one using those port numbers.

So, let me-- now, okay.

So we've got the source so this is the
source information, this is the destination

and now we can put in the port number.

So I'll say equal to.

Oh, there's another way I could do
this, but I'm not going to do that yet.

So, we're going to say equal to 22, enter.

And then I'm just-- I mean, now it's easy.

I hit the up arrow and say equal to 23.

That is SSH, that's port
22, and Telnet is port 23.

Now, what I was brainstorming is I was
saying you could also come in here.

I mean, the options are endless.

I could type in-- not reflect.

I could type in reflect, but I'm going
to say range and I could say 22 to 23.

That would do it in one line if
you want doing an access-list.

So, it's saying both of those port
numbers from-- or I could 22 through 1024.

I mean, you can put in whatever is the end port.

So that would be another
option, but we're not doing that.

So, delete list.

Okay. So let's do a show ip
access list on the source.

So we've got-- okay, the core of this is done.

We're permitting this and this.

And so initially, like, okay.

I think we're good.

We can apply it, right?

No. Because what that will
do is that says, "Okay.

You're permitted to access
this on port 22 and 23,

but everything else hits
the implicit deny, right?"

And that would say, "Okay.

I can't access anything over here.

I can't get to this guy."

I mean, so you might-- you know, this
was said, only block access to that,

not all of the other pieces that are in here.

So, we've got to be a little
more-- do a little more than that.

So I'm going to come back here
and we're going to say, okay, so,

I need to say these two are permitted.

Everything else to this guy has to be denied
to that IP address 'cause it says only

as it tells us, but then I need
to permit everything else, right?

Everything else should be allowed
and that's exactly what we'll do.

So come back in here.

I'm still in the named access list so I'm going
to say, deny, with caps lock, with authority.

Deny and I'll say-- and this is a very
common mistake, it's easy to say, TCP.

You know, just kind of copy and
paste this whole thing again.

But remember, TCP is just TCP.

There're all kinds of other stuff
so I'm going to say, deny IP.

So everything else from-- now we can
copy-paste actually this whole thing,

everything else from this source to
this destination is now denied, right?

So, hang on, let's look at the access list now.

It says, "Okay, this is allowed so I can
SSH, I can Telnet," then everything else

from this source to this destination is now
denied, which is achieving our goal, but then--

but I want to say, but beyond that,
everything else is allowed, how do I do that?

Permit IP.

[laughs] I was thinking I
was like, "I think I forgot."

Permit IP any any.

So now, that allows everything else.

So, here's what I want to--
here's a couple of things.

So, okay-- so, let me finish the
config and then we'll expound on it.

So now I want to go in to
interface Serial0/1, right?

Now, this is going to be where we apply it
as things are going out of that interface.

Ooh, is that the most efficient?

Actually, no.

Man, I almost busted myself.

The most efficient would be inbound right here.

This is really efficient, you could
say as it's coming out this interface

but you could be even-- you could-- but the
router would then have to accept it, process it,

and get it to here just to find it was denied.

So, we can even save a couple more
processor nanocycles by saying, you know,

as it comes in right here, I want to say, "Are
you going right here, using anything other

than Telnet and SSH 'cause
you're going to be denied."

So, this will be our good application point.

So, I'm going to go into not serial--
FastEthernet0/0 and I'll do IP access--

write that down, IP access
group R3 Telnet SSH in.

Ooh, we've now applied that
in the inbound direction.

Okay, so here's something-- I want to
show you something that I find a lot

of folks get stuck on, I got stuck on
it when I first learned access list.

So, I know a lot of people run into
this as well 'cause as I see it.

So, we just said, deny everything
to 10.1.1.1, right?

Except for-- yeah, I know-- I
know except for port 22 and 23,

that's permitted, that's Telnet and SSH.

So the question is, if everything is denied
right here, can this host still make it

through here and access that guy?

You know, option A, yes, option
B-- you know, here's your exam, no,

option C none of the above, whatever, you know,

this would be a good exam
question, will it make it through?

The answer is actually absolutely
yes, no problem, because remember,

this guy is 192.168.2.50 and he-- let's say
he's trying to access 192.168.2.150, right?

So, let's just say he pings from here to here.

Well, all IP is denied to 10.1.1.1, so
the packet will actually fly along--

well actually, we put the filer right here,
but let's just pretend we put it right there.

The packet would fly along and as it
comes in here, it would say, "Okay,

are you 192.168.2.0, are
you part of this subnet?"

And he would say, "Yes, I am."

And he would say, okay, are you
trying to access, you know--

let's look at the access list, it would
say, are you trying to acces-- where am I?

Oh, right here, "Are you trying to
access this IP address using port 22?"

And he would say, "No, actually I'm not."

He's going to say, "Okay, okay, are you trying
to access this IP address using Telnet?"

And the packet would say,
"No, actually I'm not."

And then he would say, "Okay, then you're
not permitted on either one of those."

He goes, "Okay, now wait a
sec, are you this person trying

to access this IP address
in any way whatsoever?"

And the answer is, "No, I'm not.

I'm not interested in you at all, I don't even
know you exist," from this guy's perspective.

I created a packet which was a ping and I
said, "It's coming from the source IP address

of 192.168.250 going to the
destination IP address of 192.168.2.150."

So, when this packet gets here, he
goes, "Okay well, you know what,

as long as your destination IP address
is not 10.1.1.1 'cause if it were,

man, you're busted, you're dropped.

But since your destination IP address
is not 10.1.1.1, then I'm going to say,

this is not a match because
you're not trying to access--

even though you're going through that IP
address, you don't know you're going through it,

you're not trying to access that IP address.

So, that line doesn't match and you hit
the permit IP any any at the bottom."

Are you feeling it yet?

Are you looking at these access lists and
starting to feel little warm and cozy with them?

Let's do two more, I want to solidify this down.

Number one, block 192.168.1.0/24, that's
these guys from accessing any WAN IP address,

so that's this and this, those
are our Wide Area Networks links.

Okay, so there's two ways we could approach
this, first off it says, from reaching any--

from reaching, that's a keyword there,
because that means block everything,

don't-- TCP, UDP, everything, right?

So, from reaching, okay, second thing
is there's two approaches we could take,

there's I'm sure plenty more of that
but two main ones, one we could say deny

to that IP address, deny to
this IP address, deny to this--

you know, do the individual host
route and deny to each one of those,

we could do that in four ACL statements.

We could also go in there and say, deny
to this network, deny to this network

and we could do the same thing into ACL
statements, rule of thumb, less is more.

The shorter your access list the better
it is because it takes less to process

that kind of access list on your router.

It's more efficient and it's
just the best practice.

Fewer lines is better access list.

So, that's the way we want to go with it.

So, what I'm going to do just so we don't get
any old access list in the way from our test,

let's first off go to router
1, and I'm just going

to remove any access list
that we have in action.

Let me do a show-- let's just do a show run and
I'll do section interface, show me the config

for all the interfaces, oop there is
one, we got one on the FastEthernet0/0.

So, that's-- looks like that is the only
one, I'm going to do interface, fe0/0,

no IP access group 100 in, that
section command is pretty nice, huh?

So, you can see just those
sections of the configuration.

You can do that with just about
anything in the running config.

So that's out, okay now let's look at this,
block 192.168, so let me just scoot this

over here, from any WAN IP address.

So, first thing we want to do is
go in and set up the access list.

So, let's use the named one, now
that we know the named access list,

that's all I use nowadays.

So, I'll say IP access list extended and I'll
say the name of it is NO WAN, NO WAN FOR YOU.

[laughs] So, the NO WAN FOR YOU access
list is going to say, rule number one,

deny or sequence-- you know, first
sequence, deny, who are we denying?

What's the source?

Oop, what protocol are we denying?

It's going to be IP because
it's everything, right?

TCP, UDP, et cetera.

What source?

It's going to be 192.168.1.0,
what wildcard mask?

0.0.0.255, right?

Good so far?

Identified the first three octets.

Next one, it says, "Okay, what
is your destination address?"

Okay, let's look at-- scrunch
this down a little bit,

destination-- I want to deny these networks.

Okay, we need a little pen work here, 10.1.1.1/0
or dot zero slash 30 and dot 4 slash 30.

We want to find out what those mean and
again, I just want to emphasize, you know,

slash 30 equals, if we were to convert that
to decimal, you know, would be eight ones,

eight ones, eight ones and then so that'd
be 24, 25, 26, 27, 28, 29, 30, so we got--

I count that right, six ones,
yup and the last [inaudible].

So, that's 255.255.255.252, kind of get back
to that decimal form 'cause we can see it,

it makes sense to us and that 252 is represented
right there, it is six ones and two zeros.

So, I'm going to say, what is my increment?

It is a four, that's 1, 2, 4.

So, the increment when we-- they came
up with these subnets was a four,

so the ranges is actually 10.1.1.0.4.8.,
this is our typical WAN link range.

I know, I know, some of you are like,
"I got that," but some people don't.

So, I want to show the reverse
engineering of this along the way.

So, now we want to say, "Okay, well I'm going
to say this destination and this destination

on the block, but I have to use
a custom wildcard mask for that."

So again, just like we saw
previously, for a custom wildcard mask,

we can either reverse all the ones and make them
all zeros, zero, zero, zero, and then, you know,

one, two, three, four, five, six, one, one,
and do it that way or you can take this

and subtract it from all 255s,
you know, 255.255.255.255

and our ending wildcard mask would be
0.0.0.3 and get the same thing, you know,

it's either a 1 plus 2, that's 3, or just
subtracting 252 from 255 gives you a 3.

So our wildcard mask and it is wild looking
for those WAN links will be 0.0.0.3.

So, first off destination address, so WAN link
number one, there, wildcard mask, 0.0.0.3, good.

WAN link number two, now this we can just hit
the up arrow 4 and say 10.1.1.4, okay good.

Let's look at our progress so far,
I'm going to do a show IP access list.

We've got two of them, this one we've removed

from the interface, so it's
not interfering anymore.

We've got the NO WAN FOR YOU access.

You can't even say it, "Yeah, no
WAN for you," we have to say it

like the Soup Nazi from Seinfeld.

So, we've got the source subnet
going to this and going to that,

so now we've got all denies, that's great.

So, we need a permit.

So I'm going to hit the up arrow
and let's-- well I'll just do a--

wait a second, I'm still in
the named acces list mode.

So I'll do permit ip any any.

Looks good to me, yeah, all right.

So, now where do I apply this?

I'm going to-- I would say-- well, if it
applies to 192.168.1.0, the best possible way,

the most efficient possible way
would be inbound right here, okay?

We could do it outbound right here,
however, we would have to process it more

to actually send it out and deny it.

So this is the most efficient way.

So in FastEthernet0/0.

So get back there.

[ Pause ]

Done. IP access group, NO WAN FOR YOU in.

So to test, let's go over to the PC number
1 to make sure this thing is working here.

PC number 1, let's do a ping, let's just
make sure we can ping anything 10 dot--

192.168.1.1, that's my default gateway.

And now, even though-- and another great
example of what I was just telling you

from the previous slide, even though they're
denied-- my pen is doing something very odd.

There we go.

Even though they're denied
from accessing these WAN links,

they can't ping the WAN links themselves,

that doesn't mean they can't go
through those WAN links, right?

Because again, it's coming from this
source going to this destination,

that doesn't violate any access list at all.

So I should be able to have no
problem on router PC1 I should say,

pinging 192.168, let's just go 2 dot 129.

Let's go in all the way over there to the
right hand side and that's pinging just fine.

So let's now ping the WAN links.

Let's go 10.1.1.1.

Unreachable, that's what we want to see.

The use indicate access list
are stepping in to intervene.

Let's go back into our show ip access
and I'm seeing-- I'm seeing some--

a lot-- matches on that first one.

That's the first subnet.

So let's just ping the second subnet so let's go
to-- let's go to-- I scribbled it all, 10.1.1.5,

that's going to be router 2, 10.1.1.5.

And again, unreachables being seen--
oop, I don't know what I've done there.

So let me just hit the up
arrow here and I can see

that now both statements have 11
matches whereas before it was just one.

So we are looking good on that.

Okay, so good, check everybody onboard?

Great. Last one, permit 192.168.2.50-- permit--

okay, okay permit access to 192.168.2.50
using only SMTP, POP3 and IMAP4 from anywhere.

So clear off all the chicken scratch
and this is the computer in question.

So we're saying, permit anybody to access
that using SMTP-- only SMTP, POP3 and IMAP4.

You see, while knowing those port numbers is
so critical, these are all TCP-based protocol,

SMTP 25, POP3 110, IMAP4 143, so you immediately
can fill in the gaps on your firewall.

So only those ports are allowed in.

I want to show you another use
of access list while we're here.

It is the last example so I figure, why not.

Have you ever heard of a debug IP packet?

If somebody tells you to type it, don't.

But what it is, is it's the ability to--

you know, the ability to see just about
every single thing passing through.

So for example, let me just--
now I'm in a lab environment.

By the way, this will likely take down a
production router if I type in debug IP packet.

What it's going to do is show me the
output of every single packet that is going

through my router at this time to the screen.

Now, not that you know, like,
well, that was exciting.

Because this router is literally
sitting idle, that's very rare.

But for instance, [inaudible] say
ping, let's just ping 192.168.2.1.

I can see that-- I see five exclamation
points and then it shows to my screen.

Okay, it looks like here is packet one, this
source went to this destination, I sent it out

and then this destination responded to
this source, you know, I received it in.

So you're actually able to
see every single packet

that is being sent to and from this device.

You can imagine why in a production
network-- I mean, that was what you see,

it filled the screen was five pings.

So in production, when you have
thousands of packets every single second,

if you were to turn this on, a lot of
times the routers just literally lock.

So what's done often is access
list are applied to filter it down.

Let me show you what we can do.

So I want to create a filter for PC2 so
I can do a debug, let's do undebug all

that turns off all the debugs and-- 'cause
we don't want to get flooded by any means.

But I want to do a debug where I can see if any
of these protocols are coming in to my router

or going through my router or whatever.

So I can go in there and I can do access
list, a lot of times I use numbered ones

for these 'cause they're always
temporary, I'll just do 170.

Permit, now I'm looking for three TCP protocol,
so I'll say, permit TCP from any source

to any destination equal to port 25, see that?

Equal to port 110, equal to port 143, I'm
creating this custom filter that says,

if any source sends anything, me being anything,
traffic on this port or this port or this port,

which is those three protocols,
then I want to know about it.

Now again creating access list all day they
don't do anything until I do an application,

so here's another-- we don't
always have to apply an access list

to an interface, that's only for security.

So here's another use, I can do a debug IP
packet but Cisco knows you'll crash your router

if you put that with too much
traffic so they always allow you

to filter it down using an access list.

Now also notice, they don't let you
us a named access list to do this.

Some things-- there are some
things still to this day in Cisco

that you must use a numbered access list
for it, that's why they're still around.

So debug IP packet, filter it using 170, okay.

So now, if I do a ping, you know, I do that
same ping, I can see the ping and notice,

no messages were displayed because it's
like, well, a ping doesn't use port 25,

110 or 143, so let's go a little further.

Let's-- here's what I'm going to do,
I'm going to go to router 2 and attempt

to access this host on one
of those port numbers, right?

So let's bring up PC2 and then let's go
to router 2 and the way that I'm going

to access them on one of those port
numbers, is by using Telnet just

like we did previously to test this.

So, do Telnet to-- what is the IP address?

Let's find out, show ip interface
brief, I think it's dot 50.

I know it's dot 50, but I've typed the command.

So Telnet to 192.168.2.50 and
then I'm going to put port 25.

Look at that.

Connection was refused by host, that's fine.

It's not an email server, it's a router.

But I'm able to verify, look at that, I
just received a packet from that person

and I'm able to see what's going on.

You can say well, show me port 110.

See that right there?

Show me port 23, not part
of my access list, right?

I'm able to get in there and you know,
no messages are displayed, whereas,

if I wouldn't have had that
access list, let's check this out.

Hang on, let me just bail out here.

So let's just do-- here, I'll do a u all, that's
a shortcut for undebug all and then I'm going

to do a debug ip packet and now watch
what happens when I do that same Telnet.

It's like, that's just for that Telnet session.

So you can see how valuable it is to
be able to filter it down to just--

again, just another perfect
use of an access list.

Now let's accomplish our goal.

We need to permit access to this guy using
only SMTP, POP3 and IMAP4 from anywhere.

So already, again we're thinking ahead, right?

We have to create the access
list, we have to configure it,

but we don't know where to configure it
yet because we first have to determine

where it's going to be applied,
where am I going to apply this?

Now this kind of reverse it.

Remember I said, "It's best to apply extended
access-list as close to the source as possible."

Well, the problem is we don't
know the source, it could--

you know, it's saying, "Permit access
using only these ports from anywhere,"

so the source could be over here, it could
be over here, there could be some cloud here

with you know raining dogs-- anywhere is
a big name so it could come from anywhere.

So there's no way I can say, "Okay, I'm going to
put it there to catch them as soon as possible."

Now I have to put it as close
to the destination as possible

because I'm filtering it from anywhere.

See what I mean?

With that anywhere argument, it kind
of changes the story a little bit.

So, what I'm going to do is I'm
going to hang out on router 2,

that's where the filtering is going to happen,
I'm going to go in and-- oh, I was Telneting.

So back on router 2, there we go, go in to
global, let's do ip access-list, I don't know,

what do you want to call it, extended, we'll
call it port filter and then we will say, well,

actually you know what, better
name EMAIL FILTER.

Those are all email protocols so
maybe that is an email server.

So we will do permit, so what are we permitting?

We're permitting TCP-based traffic, right?

Not IP, that's everything, TCP 'cause all
those are TCP-based protocols, from where?

Well, it's in a box, below the screen.

Anywhere, to where?

Well, this is where we can
get a little more specific.

We could say, "Okay, this is going
to the host 192.168.2.50 and you know

that we could have also left host off and done
192.168.2.50 with a wildcard of 0.0.0.0.0,

that's fine so we've got permit,
protocol, source, destination

and now the destination port number.

Destination port will be equal to so I put eq to
25 and now it's as easy and up arrow 110, 143.

And so now, we look back here and so--
okay, well where am I going to apply this?

Again from anywhere means it could be
coming in here, it could be coming in here,

it could be coming from some
mysterious interface

that hasn't been added yet, but will be someday.

So, I think it would be best since it's always
from anywhere to catch it as it's going out.

So as things are coming in here, they're
not filtered, but once they go out to try

and get to that server that's
where I'm going to smack them down.

I'm going to say, "No, you've got to use these
ports, otherwise you will be denied access."

So, let's go to router 2 right there
and to interface FastEthernet0/0

and we will do IP access group and
it is-- oh, it's the email server?

Email server, right?

Email filter, I'm glad I
looked, email filter outbound.

Good. Now we've got an action, let's test
it, let's go-- let's camp of it at router 1.

So we'll attempt to access that host from
router 1, so-- good I just-- good grief.

I just caused an outage.

[laughs] Some-- I just took down the network,

see how and I did so on purpose
because I wanted to demonstrate.

I just-- you see how easy it
is to where I said, you know,

allow access to that host
using those port numbers.

Let's do a show access list
okay, I didn't do it on purpose

but man that would-- that
would've been devastating.

So what this did is it says, "Okay, permit
any host to access this guy using this,

this and this," and you know,
there's an implicit deny for that.

Now, we might say, "Well,
isn't that what we want?"

Well maybe, but isn't there more people
on that network than just dot 50?

I know we can only see in
this little picture of dot 50.

But if I've got a subnet here, I'm
assuming the reason I have a subnet,

and not just like a crossover
cable going to a computer,

is because there's other hosts on here.

You know what, they just lost their access
completely because even if they're trying

to come out, nothing can come back

in because the only thing allowed
back in is these three port numbers.

So, any of you catch that.

ip access list extended email filter and
let's do-- now we need to add a statement,

we will say, "Deny ip from any
source to the host 192.168.2.50."

Now you're going, "Well, that
wasn't what I expected to do.

I mean, do a show access-- do show IP access."

So right here, wait a second,
why are you denying,

I thought you said we've been too restrictive.

Well, we have because nothing-- everything
else is denied because the same--

and I'm going to follow this up
with is permit IP any any, right?

So now, we've got these three ports allowed,
everything else is denied to that host

but then everything beyond
that because we weren't told

to put any restrictions beyond that,
everything beyond that is allowed.

Okay well, it's already applied
so the damage had been done,

but now connectivity has been
restored but, oh man, I'm kind of--

I didn't do it on purpose but yes I'm kind of
glad I did because do you see how easy it is?

You're like, oh I see my objective let me just
do this, apply it and I mean, right there,

that would have been a complete network outage
for everybody else on that network except

that one server but even that one server would
only be able to get those three ports coming in.

So, good. Do you see now why I said that
extended access-lists are almost always used

for filtering like we've been doing all along.

There's just so much more flexibility
than a standard access list.

So at this point, you might say,
well, I mean after seeing that,

it seems like all I would ever
use is an extended access-list.

Where would I use the standard?

Standards are still used in
particular places but usually,

they're applied for a specific purpose.

I want to do one more demonstration to show
you a typical use of a standard access list.

It is for restricting access to Telnet in VTY.

Did I just say Telnet VTY?

Telnet and SSH which both come
in the VTY ports of your device.

So here's the problem.

A lot of times, we have our routers
connected directly to the internet that's one

of their key goals is to
take the internet connection

and route it in to our internal network.

Well, once we connect it to the internet,
it's going to have an IP address,

we'll just say 150.1.1.1 that
anybody out in the world can access.

And you know what?

Cisco, by default, does not have any kind
of password locking mechanisms or things

like that enabled so somebody out here in
the world could just run a little script

that runs all day everyday that tries
the Telnet or SSH into your device

and attempt different user names and different
passwords, it's called the brute force attack.

They're very inefficient because that's
what they have to do, they have to sit there

and just try and try and try until it happens
to come across some combination that works,

but the problem is in their persistence, this
guy can start a brute force attack and walk away

and allow it to run a year
later, it's still running.

I mean-- and by then, it's tried thousands
and millions of possible combinations

of passwords likely could stumble on yours
depending on the strength of your password

and so on, that's why we need good
strong password, but why run that risk?

Let's set it up to where only
particular IP addresses from the outside

or maybe no IP addresses
from the outside can get in.

Now, we don't want to apply an access list here

because that will now filter all
traffic that's going in to that device.

I just want to apply an access
list that filters access to VTY.

Well, there's a special command that allows you

to apply an access control
list to your VTY ports.

It is known as access class.

So what I can do is create a
standard access list, for instance,

let's just say my internal network is
10.1.1.0/24 and I only want my internal network

to be able to Telnet and SSH in here,

and I don't want anybody else,
nothing from the outside world.

So what I can do is let me just grab a
router, any router will do, how's router 3?

I'm going to go in and create a standard
access list, IP access list standard

and we will do, let's just say VTY ACL.

Now, once in here, I'm going to do a permit
10.1.1.0 wildcard mask 0.0.0.255 and hit enter.

After seeing extended access-list

so much doesn't simple-- or
standard just seem so simple?

It's just like-- it's like,
wow, was it really that easy?

So that's it.

So just permit those source IP addresses.

Now, instead of going in to
an interface, I go into--

line VTY zero space 4 and
do access-class followed

by what access list I'd like
to use, VTY ACL inbound.

So, essentially now, as people
are Telneting, you know,

in Telnet and SSH both uses the VTY lines,
as they're trying to Telnet into my device,

the VTY is going to say, "Are you from 10.1.1.0?

If you are, you're allowed, otherwise,

you are completely restricted
from Telneting to this device."

So standard access lists are great
when you can apply them in such a way

that it doesn't impact a bunch-- if
you just need to identify a whole bunch

of source addresses for quality of service or
for Telnet access or for again the millions

of other uses that you will learn in your
journey through Cisco, then absolutely,

standard access list is the
way to go, so much simpler.

I hope this has been informative for you
and I'd like to thank you for viewing.