One: Access Control List Overview
• An access control list (ACL) is a list of instructions that are applied to the router interface. These instruction lists are used to tell the router which packets can pass, and which packets need to be rejected.
·How it works: it reads the information in the third and fourth layers of Baotou, such as source address, destination address, source port, destination port, and so on. The packet is filtered according to pre-set rules to achieve the purpose of access control. • Practical application: Block a network segment from accessing the server. Block a network segment from accessing the B segment, but the B segment can access a network segment. Security can be achieved by prohibiting certain ports from entering the network.
two: Standard ACLThe · standard access control list only checks the source address of packets routed by the router. If a segment is disabled using the standard access control list, all hosts and all protocols under that network segment are prohibited. If a network segment is forbidden, all hosts under the a network segment cannot access the server, while the host under the B network segment can. with numbers between 1----99 as the table number generally used for local area networks, it is best to apply the standard ACL to the location closest to the destination address. configuration of the standard ACL: Router (config) #access-list table number deny (Forbidden) segment/IP address Anti-mask * * Prohibit a network segment or a Ip router (config) #access-list table number permit (allow) Any note: By default all networks are set to prohibited, so other network segments should be released. router (config) #interface interface ****** enter the interface to which you want to apply this ACL (because access control lists can only be applied in interface mode) router (config-if) #ip access-group table number out/in * * * * * Set this interface as out or in where Router (config) #access-list 10 Deny 192.168.0.1 0.0.0.0 = Router (config) #access-list deny host 192.168.0.1 router (config) # access-list deny 0.0.0.0 255.255.255.255 = router (config) #access-list 10 deny any router#show access-lists ****** view access control list. how the standard access control list works. (Each time the data goes into each port of the router, the following process occurs.) Note: The order is important when you configure access control lists. Be sure to follow the specific to Universalorder to arrange entries. For example, to deny a specific host address and allow other hosts, make sure that the entry for this specific host is up to date.
three: Extended ACLThe extended access Control list checks the packet source address, destination address, source port, and destination port. If you use an extended access control list to prohibit a network segment from accessing another network segment, all hosts under the A network segment cannot access the B segment, and the host under the B network segment can access a network segment. with a number between----199 as the table number is generally used for the external network, so it is best to apply the extended ACL to the location closest to the source address. Configure the Extended access control list. Router (config) #access-list table number deny (Forbidden) Protocol Source IP address/network segment Anti-mask destination IP address/network segment anti-mask eq Port ****** Prohibit a network segment (source network segment) under a protocol (or a port) access to the B segment (destination network segment) router (config) #access-list table number permit ip any Any note: Extended ACLs By default all networks are also set to prohibit, so other network segments should be released. router (config) #interface interface ********** Enter the interface to which you want to apply this ACL router (config-if) #ip access-group table number out/in ****** activates the interface under the Access control list, and sets this interface as a out/in according to the actual situation. Common Port and its owning protocol. How the Extended Access Control List works: (each time the data enters each port of the router, the following process occurs.) )
From for notes (Wiz)
Detailed Cisco access control List ACLs
