Configuration of CiscoACl standard access control list

Prerequisite (go to global configuration mode first) access? List11denypermit192.168.1.120.0.0.255192.168.1.12 is the ID of the standard access control list, ipaccess? Group11inout (in Interface Configuration Mode first)

Prerequisite (go to global configuration mode first) access? List 11 deny/permit 192.168.1.12 0.0.0.255 192.168.1.12 is the anti-mask 11 with the source address 0.0.0.255 192.168.1.12 is the ID of the standard access control list ip access? Group 11 in/out (in Interface Configuration Mode first) in is inbound and outbound

Prerequisite (go to global firstConfigurationMode)

Access? List 11 deny/permit 192.168.1.12 0.0.0.255 192.168.1.12 is the anti-mask 11 with the source address 0.0.0.255 as 192.168.1.12StandardOfAccessControlListID

Ip access? Group 11 in/out (first enter the interfaceConfigurationMode) in is the inbound and outbound direction, and the outbound direction is 11 by default.AccessControlListUse the serial number to complete the two steps.AccessControlList. The default anti-mask is 0.0.0.0.

Use no access? List 11 command DeleteAccessControlListWhich belongs toAccessControlListDelete all (go to global mode first)

Use no ip access? The group 11 command is deleted from the port.AccessControlList(Go to interface mode first)

ExtendedAccessControlListOfConfigurationPrerequisite (go to global firstConfigurationMode)

Access? List 101 deny/permit tcp 172.16.4.0 0.0.0.255 172.16.3.0 0.0.0.255 eq 80

Access? List 101 permit ip any extensionAccessListAllow all times, followed by two anyStandardAccessControlListWhen all are allowed, an any

101 is no. tcp is Protocol No. 172.16.4.0 0.0.0.255 is source address 172.16.3.0 0.0.0.255 is Destination Address eq is equal to meaning 80 is the first above Port NumberAccessControlListWhich means: deny/allow the network 172.16.4.0 to remotely log on to the network 172.16.3.0.AccessControlListMeaning allow all

Ip access? Group101 out prerequisite (first enter the interfaceConfigurationMode) this command is enabled on the InterfaceAccessControlListAnd specify the direction

NamedAccessControlListOfConfiguration(Only available in Versions later than 11.2)-A name can be defined based on both IP and IPX (prerequisite: Go to the globalConfigurationMode)

Ip access? List standard/extended cisco is a custom name

Deny/permit 172.1.1.0 0.0.255 select standardStandardAccessControlListTime

Deny/permit tcp 172.16.4.0 0.0.0.255 172.16.3.0 0.0.0.255 eq 80 above select extended to extendAccessControlListTime

Ip access? Group cisco in/out premise (first enter the interfaceConfigurationMode.AccessControlListAnd specify the direction

Disable remote telnet on VTYAccess

Line vty 0 4

Password cisco is under VTYConfigurationWhen there is no password under VTY, the remote host cannot initiate telnetAccess

Login meaning (no password is set in VTYAccessControlListIn this case, no login remote host can be set to telnet to log on)

! (Return to global mode)

Access? List 1 deny 30.30.30.0 0.0.0.255 (reject a network)Access)

Line vty 0 4

Access? Class 1 in (enabled in VTY ModeAccessControlListAndConfigurationDirection) in is the direction

Extensions with the ESTABLISHED OptionAccessList

Extensions with EstablishedAccessListAllow internal usersAccessThe external network rejects external users.AccessInternal network. Without the keyword establishedStandardAccessTables and extensionsAccessThe table does not have this Feature (below Feature isConfiguration(Go to global mode first)

Access? List 101 permit tcp any established log? Input

Access? List 101 permit ospf any

Access? List 101 deny ip any log? Input

Enter interface mode

Ip access? Group 101 in

Above logs? Input is used to display the situation where data packets are filtered. Next, we will use the debug ip packet detailed to monitor the packet passing through. Because the router still produces OSPF packets, we will use another extension.AccessControlListLimit Debug information

Do not monitor OSPF packets. The following are 2nd extensions.AccessControlListOfConfiguration(Go to global mode first)

Access? List 102 permit tcp any no here does not reject OSPFAccessControlBut by default, all requests reject OSPF.

Return to privileged ModeConfiguration

Debug ip packet detail 102 (the command for viewing debug output information in privileged mode is show logging)

The above case is a TCP-based application. Any TCP communication is bidirectional.

Note: The first sending of TCP protocol is the SYN field, which is used to synchronize the hosts at both ends of preparing to establish a new connection, and the ACK bit is set by the receiver to indicate to the sender that the data has been successfully received, the RST (reset) Bit indicates when to restart the connection. Extensions with EstablishedAccessListOnly TCP packets at ACK or RST position 1 are allowed to pass.

[1] [2] Next page

[Editor: peter]