CISCO router access list access-list

There are two types of access-list in a CISCO router: standard access list and extended access list, the main difference between the two is that the former is based on the destination address data packet filtering, while the latter is based on the destination address, source address, network protocol and port data packet filtering.

(1) Standard IP address access list format
　　
---- The format of the standard IP address access list is as follows:
　　

---- Access-list [list number] [permit | deny] [source address]
---- [Address] [wildcard mask] [log]
　　
---- The following describes the keywords and parameters of the standard IP address access list. First, there must be a hyphen "-" between the two keywords "access" and "list". Second, the range of the list number is 0 ~ Between 99, which indicates that the access-list statement is a common standard IP access list statement. Because for Cisco IOS ~ The number between 99 indicates that the access list is related to the IP protocol. Therefore, the list number parameter has two functions: (1) define the operation protocol of the access list; (2) IOS is notified to treat the same list number parameter as the same object when processing the access-list statement. As discussed later in this article, the Extended IP address access list also uses the list number (range: 100 ~ A number between 199. Therefore, when using the access list, you also need to add the following important rules: When you need to create an access list, you need to select the appropriate list number parameter.
　　
---- (2) allow/deny packet passing
　　
---- In the standard IP address access list, the permit statement can be used to allow data packets that match the access list items to pass through the interface, while the deny statement can filter out data packets that match the access list items on the interface. Source address represents the IP address of the host. You can specify the host using a combination of different masks.
　　
---- Here is an example to better understand the role of IP addresses and wildcard masks. Assume that your company has a branch whose IP address is 192.46.28.0 of class C. In your company, each branch needs to access the Internet through the Headquarters router. To achieve this, you can use a wildcard mask 0.0.255. Because the last group of numbers of class c ip addresses represents hosts, setting them to 1 allows the headquarters to access each host on the network. Therefore, the access-list statement in your standard IP address access list is as follows:
　　
---- Access-list 1 permit 192.46.28.0 0.0.255
　　
---- Note that the wildcard mask is complementary to the subnet mask. Therefore, if you are a Network Expert, You can first determine the subnet mask, and then convert it into an applicable wildcard mask. Here, you can add an access list rule 5.
　　
---- (3) Specify the address
　　
---- If you want to specify a specific host, you can add a wildcard mask 0.0.0.0. For example, to allow data packets from the IP address 192.46.27.7 to pass through, you can use the following statement:
　　
---- Access-list 1 permit 192.46.27.7 0.0.0.0
　　
---- In the Cisco access list, you can use the "host" keyword in addition to the wildcard mask 0.0.0.0 described above to specify a specific host. For example, to allow data packets from the IP address 192.46.27.7 to pass through, you can use the following statement:
　　
---- Access-list 1 permit host 192.46.27.7
　　
---- The keyword "host" can be used to represent the wildcard mask 0.0.0.0. the keyword "any" can be abbreviated as the source address and represent the wildcard mask 0.0.0.0 255.255.255.255. For example, if you want to reject data packets from a website whose IP address is 192.46.27.8, you can add the following statement to the access list:
　　
---- Access-list 1 deny host 192.46.27.8
---- Access-list 1 permit any
　　
---- Pay attention to the order of the preceding two access list statements. The first statement filters out data packets from the source address 192.46.27.8. The second statement allows data packets from any source address to pass the access list interface. If you change the order of the preceding statements, the access list cannot block packets from the source address 192.46.27.8 from passing through the interface. Because the access list runs the statements in the order from top to bottom. In this case, if the 1st statements are:
　　
---- Access-list 1 permit any
　　
---- Then, data packets from any source address will pass through the interface.
　　
---- (4) the mystery of rejection
　　
---- By default, the access list always blocks or denies the passing of all data packets unless explicitly specified, that is, at the end of each access list, there is a "deny any" statement. Suppose we use the standard IP address access list created earlier. From the router's perspective, the actual content of this statement is as follows:
　　
---- Access-list 1 deny host 192.46.27.8
---- Access-list 1 permit any
---- Access-list 1 deny any
　　
---- In the above example, the implicit denial statement does not work because 2nd statements in the access list explicitly allow any data packet to pass. For example, if you want data packets from the source address 192.46.27.8 and 192.46.27.12 to pass through the router interface and prevent all other data packets from passing through, the access list Code is as follows:
　　
---- Access-list 1 permit host 192.46.27.8
---- Access-list 1 permit host 192.46.27.12
　　
---- Note that all access lists will automatically include this statement at the end.
　　
---- By the way, we will discuss the parameter "log" in the standard IP address access list, which serves as a log. Once the access list acts on an interface, the statement containing the keyword "log" records packets that meet the "Permit" and "deny" conditions in the access list. The first data packet that matches the access list statement through the interface will generate a log immediately. Subsequent data packets are recorded based on the log format, logs are displayed on the console, or logs are recorded in the memory. You can use the Cisco IOS console command to select the logging method.
　　
Extended IP address access list
　　
---- The Extended IP address access list adds a lot of functionality and flexibility in data packet filtering. In addition to filtering based on the source address and target address, you can also filter based on the protocol, source port, and destination port, or even use various options to filter. These options can read and compare the information of certain fields in the data packet. The general format of the Extended IP address access list is as follows:
　　
---- Access-list [list number] [permit | deny]
---- [Protocol | Protocol key word]
---- [Source Address Source-Wildcard mask] [Source Port]
---- [Destination Address destination-Wildcard mask]
---- [Destination port] [log options]
　　
---- Similar to the standard IP address access list, "list number" indicates the type of the access list. Number 100 ~ 199 is used to determine 100 unique extended IP address access lists. "Protocol" determines the protocol to be filtered, including IP, TCP, UDP, and ICMP.
　　
---- If we review how data packets are formed, we will understand why the Protocol affects data packet filtering, although sometimes this can cause side effects. Figure 2 shows the formation of data packets. Note that the application data usually has a prefix added at the transport layer, which can be the header of the TCP or UDP protocol. In this way, a port flag indicating the application is added. When the data goes into the protocol stack, the network layer adds the header of an IP protocol containing the address information.

Because the IP header transmits TCP, UDP, routing protocol, and ICMP protocol, the IP protocol level is more important than other protocols in the access list statements. However, in some applications, you may need to change this situation. You need to filter based on a non-IP protocol.
　　
---- For better description, the following lists two statements for the extended IP address access list. Suppose we want to prevent TCP traffic from accessing a server whose IP address is 192.78.46.8 and allow traffic from other protocols to access the server. Can the following access list statements meet this requirement?
　　
---- Access-list 101 permit host 192.78.46.8
---- Access-list 101 deny host 192.78.46.12
　　
---- The answer is no. The first statement allows all IP traffic and TCP traffic to pass through the specified host address. In this way, the second statement does not have any effect.

Source: bbs.net130.com