What is an access control list?
In the Cisco IOS, an access control list is a record that identifies and manages traffic. After identifying that traffic, an administrator can specify various events that can happen to that traffic.
What's the most common type of ACL?
IP ACLs are the most popular type of access lists because IP is the most common type of traffic. There are two types of IP ACLs: standard and extended. Standard IP ACLs can only control traffic based on the SOURCE IP address. Extended IP ACLs are far more powerful; they can identify traffic based on source IP, source port, destination IP, and destination port.
What are the most common numbers for IP ACLs?
The most common numbers used for IP ACLs are 1 to 99 for standard lists and 100 to 199 for extended lists. However, many other ranges are also possible.
- Standard IP ACLs: 1 to 99 and 1300 to 1999
- Extended IP ACLs: 100 to 199 and 2000 to 2699
How can you filter traffic using ACLs?
You can use ACLs to filter traffic according to the "three P's"—per protocol, per interface, and per direction. You can only have one ACL per protocol (e.g., IP or IPX), one ACL per interface (e.g., FastEthernet0/0), and one ACL per direction (i.e., IN or OUT).
How can an ACL help protect
my network from viruses?
You can use an ACL as a packet sniffer to list packets that meet a certain requirement. For example, if there's a virus on your network that's sending out traffic over IRC port 194, you could create an extended ACL (such as number 101) to identify that traffic. You could then use thedebug ip packet 101 detail command on your Internet-facing router to list all of the source IP addresses that are sending packets on port 194.
References:
To say I have anything to comment is crap. We have all done this, (AKA OUR OWN BLOG) and hence the only point of doing this is to find out about the parts we missed out in our own post. Anyways:
ReplyDeleteYou could have given some commands on how to set the ACLs for both the standard and extende..
I think this is a very organized and thorough post about access control list. You have covered what others would actually ask you about this topic. Maybe like what Zhi Yao said, you could give some commands on how to set the ACLs for both the standard and extended. Very nice post Ben.
ReplyDelete