WEBVTT

1
00:00.000 --> 00:04.900
So, let's start off with the protection mechanism called an infrastructure ACL.

2
00:04.900 --> 00:08.820
Now, what makes an extended access control list, which is really what it is,

3
00:08.820 --> 00:09.140
what makes

4
00:09.140 --> 00:11.520
it an eye ACL, infrastructure ACL?

5
00:11.520 --> 00:16.350
Well, the big deal here is that we're trying to, or we want to reduce the risk

6
00:16.350 --> 00:16.920
of people

7
00:16.920 --> 00:22.480
who are trying to compromise our systems, for example, R1, R3, R2, R4.

8
00:22.480 --> 00:25.920
So, what are some examples of something taking advantage of the systems?

9
00:25.920 --> 00:29.060
Well, if we have something out here from the internet, for example, hopefully

10
00:29.060 --> 00:29.440
we've got

11
00:29.440 --> 00:32.320
some firewalls and stuff here to block that traffic initially.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:29.440 --> 00:32.320
some firewalls and stuff here to block that traffic initially.

12
00:32.320 --> 00:38.140
But an infrastructure ACL, its goal is to help protect access to these devices

13
00:38.140 --> 00:38.520
from anyone

14
00:38.520 --> 00:39.520
who is unauthorized.

15
00:39.520 --> 00:42.850
So, let's imagine we have, just for grands, let's imagine this is our dress

16
00:42.850 --> 00:43.800
base 25,

17
00:43.800 --> 00:44.800
25, 25.0.

18
00:44.800 --> 00:48.760
And let's imagine that's what we're using for the management of our networks.

19
00:48.760 --> 00:51.860
So, part of our access control list that we could use at the edges of our

20
00:51.860 --> 00:52.480
network, for

21
00:52.480 --> 00:56.930
example, right here, coming in and also right here at R1 coming in, because we

22
00:56.930 --> 00:57.640
have a user

23
00:57.640 --> 01:01.520
right here, which is also a potential threat, we don't want anybody who is
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
00:57.640 --> 01:01.520
right here, which is also a potential threat, we don't want anybody who is

24
01:01.520 --> 01:02.360
unauthorized

25
01:02.360 --> 01:05.350
to be able to go ahead and manage our network devices or connect to our network

26
01:05.350 --> 01:05.920
devices.

27
01:05.920 --> 01:09.360
Because most traffic, for example, from this client going out to the internet,

28
01:09.360 --> 01:09.800
that traffic

29
01:09.800 --> 01:12.560
is going through our router environment, that's called transit traffic.

30
01:12.560 --> 01:15.940
And what we want to do is protect against people who are trying to connect to

31
01:15.940 --> 01:16.600
our specific

32
01:16.600 --> 01:21.560
devices for the purposes of a denial of service or to hack into our system or

33
01:21.560 --> 01:22.360
to cause another

34
01:22.360 --> 01:23.880
harm to our infrastructure.

35
01:23.880 --> 01:29.810
So, the key here is for infrastructure ACLs, think of it like management access

36
01:29.810 --> 01:30.360
to our
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

36
01:29.810 --> 01:30.360
to our

37
01:30.360 --> 01:32.360
network infrastructure devices.

38
01:32.360 --> 01:35.460
And the infrastructure ACL is being one of our first lines of defense to

39
01:35.460 --> 01:36.120
control that

40
01:36.120 --> 01:37.120
access.

41
01:37.120 --> 01:39.070
So, just for grands, let's imagine we're using this dress base for the

42
01:39.070 --> 01:39.640
management of our

43
01:39.640 --> 01:40.640
network.

44
01:40.640 --> 01:43.500
We could also make sure that we're, when we're launching connections from

45
01:43.500 --> 01:44.880
inside the company,

46
01:44.880 --> 01:47.320
that we're also launching it from that source of the dress base.

47
01:47.320 --> 01:50.520
So, this IP dressing space would be used, for example, just for the management

48
01:50.520 --> 01:50.840
of our

49
01:50.840 --> 01:54.210
devices and our management networks, and that wouldn't be any of our user

50
01:54.210 --> 01:54.880
networks.

51
01:54.880 --> 01:58.710
So, if we're going to place an access control list inbound here on this router,

52
01:58.710 --> 01:59.400
that's going

53
01:59.400 --> 02:03.710
to permit some traffic and deny other traffic, one of our first entries would
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
01:59.400 --> 02:03.710
to permit some traffic and deny other traffic, one of our first entries would

54
02:03.710 --> 02:04.480
be to stop any

55
02:04.480 --> 02:07.640
inbound traffic if we knew it was impossible traffic.

56
02:07.640 --> 02:12.820
For example, if we have the address base of 25, 25, 25, 0 in here, and then we

57
02:12.820 --> 02:13.240
have a

58
02:13.240 --> 02:16.740
packet coming in, and it claims that it has a source address of 25 dot 25 dot

59
02:16.740 --> 02:17.520
25 dot 25

60
02:17.520 --> 02:18.520
dot something.

61
02:18.520 --> 02:20.080
Of course, that's not a valid packet.

62
02:20.080 --> 02:22.560
That's going to be a spoofing trying to send traffic into our network.

63
02:22.560 --> 02:24.960
So, in this access control list, what you're going to call it, 101.

64
02:24.960 --> 02:28.160
In that ACL, we'd probably want to have something like deny IP.

65
02:28.160 --> 02:34.990
If it's sourced from 25 dot 25 dot 25 dot 0 slash 24, of course, we use wild
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

65
02:28.160 --> 02:34.990
If it's sourced from 25 dot 25 dot 25 dot 0 slash 24, of course, we use wild

66
02:34.990 --> 02:35.560
card bits

67
02:35.560 --> 02:39.320
to represent that space going to anywhere.

68
02:39.320 --> 02:43.130
And that way, any spoof packets trying to come in from what appears to be 25 to

69
02:43.130 --> 02:43.560
25,

70
02:43.560 --> 02:45.880
25, we'd kill it and deny it right there.

71
02:45.880 --> 02:51.040
Another good step would be to deny traffic that is listed in RFC 3330.

72
02:51.040 --> 02:53.240
So, I'll put RFC 3330.

73
02:53.240 --> 02:56.080
So, what's an example of RFC 3330 traffic?

74
02:56.080 --> 02:58.440
Let's take a moment and just peek at the RFC.

75
02:58.440 --> 03:03.400
So, here is RFC 3330 and it's documenting special use IPV for addresses.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
02:58.440 --> 03:03.400
So, here is RFC 3330 and it's documenting special use IPV for addresses.

76
03:03.400 --> 03:06.720
So, example of that would be all zeros for a source IP address.

77
03:06.720 --> 03:07.800
We don't block that.

78
03:07.800 --> 03:10.880
There's the 10 from the RFC 1918 address base.

79
03:10.880 --> 03:15.440
Here's the 127, which represents the loopback address, and the list goes on.

80
03:15.440 --> 03:18.870
So, we want to block anything claiming to come from many of these source

81
03:18.870 --> 03:19.680
addresses and

82
03:19.680 --> 03:22.560
stop them right as they're trying to come in and include that as part of our

83
03:22.560 --> 03:23.360
infrastructure

84
03:23.360 --> 03:24.360
ACL.

85
03:24.360 --> 03:28.150
Because any packets that are, for example, sourced from 127, trying to come

86
03:28.150 --> 03:29.320
into our network,

87
03:29.320 --> 03:30.320
those are going to be bogus.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

87
03:29.320 --> 03:30.320
those are going to be bogus.

88
03:30.320 --> 03:33.570
And while we're talking about packets to block, we should also be blocking in

89
03:33.570 --> 03:34.280
bound packets

90
03:34.280 --> 03:38.700
if, for whatever reason, they're claiming to come from the RFC 1918 address

91
03:38.700 --> 03:39.200
base.

92
03:39.200 --> 03:43.620
So here's RFC 1918 and as we all know and love this, here's the address spaces

93
03:43.620 --> 03:43.960
that

94
03:43.960 --> 03:50.520
we're looking at, the 10/8, the 1.62.16/12, and the 192.168/16.

95
03:50.520 --> 03:53.870
Now, hopefully, other service providers and people on the internet are blocking

96
03:53.870 --> 03:54.280
that type

97
03:54.280 --> 03:57.320
of source IP address from ever making it onto the internet.

98
03:57.320 --> 04:00.160
However, if it shows up with a source address, we want to block it and not let
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

98
03:57.320 --> 04:00.160
However, if it shows up with a source address, we want to block it and not let

99
04:00.160 --> 04:00.720
that traffic

100
04:00.720 --> 04:01.720
come in.

101
04:01.720 --> 04:05.220
So, we'd want to deny as source IP addresses, source addresses that are sourced

102
04:05.220 --> 04:05.720
claiming

103
04:05.720 --> 04:11.200
to come from the IP addresses associated with 3330 and also RFC 1918.

104
04:11.200 --> 04:12.600
And just deny those right out of the gate.

105
04:12.600 --> 04:15.680
So that'll not only protect your infrastructure, but it'll also help protect if

106
04:15.680 --> 04:16.240
you're a transit

107
04:16.240 --> 04:17.240
network.

108
04:17.240 --> 04:19.920
It'll help prevent those bogus packets from making it through your network

109
04:19.920 --> 04:20.400
going on to

110
04:20.400 --> 04:21.400
another destination.

111
04:21.400 --> 04:25.370
Now, another type of traffic we'd want to deny coming into our infrastructure

112
04:25.370 --> 04:25.760
to our

113
04:25.760 --> 04:28.880
management network address base would be fragments.

114
04:28.880 --> 04:31.740
Because the hacker is being creative, they can leverage the way Cisco router
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

114
04:28.880 --> 04:31.740
Because the hacker is being creative, they can leverage the way Cisco router

115
04:31.740 --> 04:32.680
handles fragments

116
04:32.680 --> 04:36.000
and actually get some traffic through, even though other access control entries

117
04:36.000 --> 04:36.560
may block

118
04:36.560 --> 04:39.630
it or attempt to block it based on the way fragments are handled on a Cisco

119
04:39.630 --> 04:40.200
router.

120
04:40.200 --> 04:44.840
So we want to lie fragments destined to our address base of 252550.

121
04:44.840 --> 04:47.560
Now, for a transit network, there may be fragments that we're forwarding

122
04:47.560 --> 04:48.800
through the network.

123
04:48.800 --> 04:49.800
We want to let them go.

124
04:49.800 --> 04:53.470
So, for here, I'm going to just presume that that's our internal address base

125
04:53.470 --> 04:53.960
here.

126
04:53.960 --> 04:59.480
So we'll say deny fragments for TCP and for UDP and for ICMP.

127
04:59.480 --> 05:03.120
Denied those fragments if they're destined to the 25 dot 25 dot 25 dot 25 dot
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

127
04:59.480 --> 05:03.120
Denied those fragments if they're destined to the 25 dot 25 dot 25 dot 25 dot

128
05:03.120 --> 05:03.840
25 address

129
05:03.840 --> 05:04.840
base.

130
05:04.840 --> 05:07.400
Again, presuming that's the address space we're using for our internal routers

131
05:07.400 --> 05:08.000
and switches

132
05:08.000 --> 05:09.300
in infrastructure.

133
05:09.300 --> 05:13.270
Another thing that we want to deny coming into our infrastructure address base

134
05:13.270 --> 05:14.200
are options.

135
05:14.200 --> 05:17.290
Because the somebody's trying to do strict source routing or the trainee other

136
05:17.290 --> 05:17.680
tricks

137
05:17.680 --> 05:21.200
with the IP protocol and they're using options to do it, we want to go ahead

138
05:21.200 --> 05:21.960
and stop that

139
05:21.960 --> 05:25.790
traffic right at the edge before forwarding those traffic with those options to

140
05:25.790 --> 05:27.000
our 252525

141
05:27.000 --> 05:28.000
address base.

142
05:28.000 --> 05:31.230
Now, there may be some traffic that we do need to allow to this address base
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

142
05:28.000 --> 05:31.230
Now, there may be some traffic that we do need to allow to this address base

143
05:31.230 --> 05:31.640
that we're

144
05:31.640 --> 05:32.640
using internally.

145
05:32.640 --> 05:37.940
For example, we may want to go ahead and permit things such as BGP traffic from

146
05:37.940 --> 05:38.700
specific

147
05:38.700 --> 05:42.720
peers coming into our address base or even to specific IP addresses in our

148
05:42.720 --> 05:43.960
address base.

149
05:43.960 --> 05:47.160
And things like SSH with very specific source and destinations.

150
05:47.160 --> 05:50.270
Again, we're focused on the addressing space here that we're using in our

151
05:50.270 --> 05:51.040
enterprise.

152
05:51.040 --> 05:54.120
We might want to allow some ICMP to our internal address base.

153
05:54.120 --> 05:58.730
So, another list of three examples of protocols we might want to allow to the

154
05:58.730 --> 06:00.160
25 dot 25 dot
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

154
05:58.730 --> 06:00.160
25 dot 25 dot

155
06:00.160 --> 06:02.160
25 address base.

156
06:02.160 --> 06:06.750
And we make it more granular, including the actual hosts or destinations inside

157
06:06.750 --> 06:07.040
of that

158
06:07.040 --> 06:10.710
address base, including the actual IP addresses of the sources that would lock

159
06:10.710 --> 06:11.660
it down further.

160
06:11.660 --> 06:15.540
And then once we permit the traffic that we want to allow, we then go ahead and

161
06:15.540 --> 06:15.900
deny

162
06:15.900 --> 06:20.620
BGP, SSH, ICMP, etc., once again, going to our address base.

163
06:20.620 --> 06:23.980
So, that way we're allowing the control and management traffic that we need to

164
06:23.980 --> 06:24.780
allow in

165
06:24.780 --> 06:28.440
and at the same time we're disallowing those other protocols to any of our

166
06:28.440 --> 06:29.220
other devices

167
06:29.220 --> 06:30.220
in the address base.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

167
06:29.220 --> 06:30.220
in the address base.

168
06:30.220 --> 06:34.200
So, this would be specific and this would be wide open for anything else that

169
06:34.200 --> 06:34.660
you can

170
06:34.660 --> 06:37.020
get caught with the specific permission.

171
06:37.020 --> 06:39.670
And then to tell them to this, we want to go ahead and have a permit for pretty

172
06:39.670 --> 06:39.880
much

173
06:39.880 --> 06:40.980
everything else.

174
06:40.980 --> 06:43.990
And that way, other traffic, for example, traffic that's transiting through our

175
06:43.990 --> 06:44.360
network

176
06:44.360 --> 06:48.160
going to a different location and not going to our management address base here

177
06:48.160 --> 06:48.480
, that

178
06:48.480 --> 06:49.480
could be allowed.

179
06:49.480 --> 06:52.540
And we'll do some examples of this and demonstrate this as we go through these

180
06:52.540 --> 06:53.360
videos together.

181
06:53.360 --> 06:58.240
Now, in addition to setting up infrastructure ACLs to control access to and

182
06:58.240 --> 06:59.600
management of

183
06:59.600 --> 07:04.560
our network devices, we could also leverage on our routers a feature called
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

183
06:59.600 --> 07:04.560
our network devices, we could also leverage on our routers a feature called

184
07:04.560 --> 07:05.560
Control Plane

185
07:05.560 --> 07:06.560
Policing.

186
07:06.560 --> 07:10.760
So, let me clean this up and let's talk about using Control Plane Policing as

187
07:10.760 --> 07:11.760
another infrastructure

188
07:11.760 --> 07:12.920
security feature.

189
07:12.920 --> 07:16.060
And to really appreciate Control Plane Policing, let me spell that out.

190
07:16.060 --> 07:19.420
Let's talk about the mechanics first about how the technology of a control

191
07:19.420 --> 07:20.220
plane policing

192
07:20.220 --> 07:24.690
mechanism works and then we'll apply that concept of Control Plane Policing to

193
07:24.690 --> 07:25.400
improving

194
07:25.400 --> 07:27.020
our infrastructure security.

195
07:27.020 --> 07:30.320
So, COPP has three basic elements.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

195
07:27.020 --> 07:30.320
So, COPP has three basic elements.

196
07:30.320 --> 07:35.040
One, we want to identify the traffic or identify some traffic.

197
07:35.040 --> 07:37.150
And based on what we're trying to identify, it's going to depend on what we're

198
07:37.150 --> 07:37.480
trying

199
07:37.480 --> 07:39.000
to protect against.

200
07:39.000 --> 07:42.410
So, for this overview, let's imagine that we still have our infrastructure ACL

201
07:42.410 --> 07:42.720
right

202
07:42.720 --> 07:46.400
here that's protecting most of our access to our infrastructure devices.

203
07:46.400 --> 07:52.600
And let's imagine R1 has an IP address of 25.25.25.1.

204
07:52.600 --> 07:56.270
So in our infrastructure ACL, we're permitting traffic, for example, from this

205
07:56.270 --> 07:56.880
server, if

206
07:56.880 --> 08:01.840
it's SSH to reach this device or from the server, if it's ICMP to reach this
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

206
07:56.880 --> 08:01.840
it's SSH to reach this device or from the server, if it's ICMP to reach this

207
08:01.840 --> 08:02.600
device.

208
08:02.600 --> 08:06.650
So, for the example, let's imagine as part of Control Plane Policing, we want

209
08:06.650 --> 08:07.480
to identify

210
08:07.480 --> 08:09.480
let's imagine just ICMP traffic.

211
08:09.480 --> 08:13.150
So, the first part of setting up Control Plane Policing is to set up an access

212
08:13.150 --> 08:14.000
control list

213
08:14.000 --> 08:18.120
just pointing to or identifying ICMP traffic with or without the source and

214
08:18.120 --> 08:18.920
destination

215
08:18.920 --> 08:20.600
that you want to use as part of that.

216
08:20.600 --> 08:26.760
So, the next is Control List, it can be a permit, meaning match on ICMP from

217
08:26.760 --> 08:27.320
any to any.

218
08:27.320 --> 08:30.880
And boom, that's our first step instead of Control Plane Policing is creating
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

218
08:27.320 --> 08:30.880
And boom, that's our first step instead of Control Plane Policing is creating

219
08:30.880 --> 08:31.280
access

220
08:31.280 --> 08:34.360
to control list to identify the traffic that we want to take action on.

221
08:34.360 --> 08:37.530
Now, once we're at an access control list to identify that traffic, we're also

222
08:37.530 --> 08:37.880
going

223
08:37.880 --> 08:41.890
to create something called a class map that calls upon that access control list

224
08:41.890 --> 08:42.480
and identifying

225
08:42.480 --> 08:43.480
that traffic.

226
08:43.480 --> 08:47.850
So, think of the identifying of the traffic as a two-step process using an ACL

227
08:47.850 --> 08:48.560
to identify

228
08:48.560 --> 08:51.920
the traffic and having a class map call upon that ACL.

229
08:51.920 --> 08:54.840
And we'll have examples in this set of videos to help reinforce that.

230
08:54.840 --> 08:57.720
So, the first step here again is to identify the traffic and that's done with

231
08:57.720 --> 08:58.160
an access

232
08:58.160 --> 09:01.480
control list and then a class map that's calling upon that access control list.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

232
08:58.160 --> 09:01.480
control list and then a class map that's calling upon that access control list.

233
09:01.480 --> 09:05.760
And the second step is saying what we want to do to that traffic.

234
09:05.760 --> 09:09.480
For example, do we want to rate limit it or do we want to drop it?

235
09:09.480 --> 09:11.880
And this is why anybody is specifying the actions we want to take.

236
09:11.880 --> 09:15.840
So, let's imagine that for ICMP traffic, we're okay with some of it, but if it

237
09:15.840 --> 09:16.400
reaches a

238
09:16.400 --> 09:19.480
certain threshold, we want to go ahead and start dropping it.

239
09:19.480 --> 09:21.120
So, that would be the action statement.

240
09:21.120 --> 09:24.200
And that's done with a feature called a policy map.

241
09:24.200 --> 09:27.320
And the third step is to specify where we want that to happen.

242
09:27.320 --> 09:31.560
For example, if we want to rate limit ICMP traffic or we want to drop
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

242
09:27.320 --> 09:31.560
For example, if we want to rate limit ICMP traffic or we want to drop

243
09:31.560 --> 09:32.360
altogether ICMP

244
09:32.360 --> 09:34.280
traffic, where do we want that to happen?

245
09:34.280 --> 09:38.550
On interface, for example, as traffic is going in on the interface or even

246
09:38.550 --> 09:39.720
better with control

247
09:39.720 --> 09:43.720
plane policing, we can apply that to the control plane itself.

248
09:43.720 --> 09:46.990
And in the Cisco router, we do that by going into control plane configuration

249
09:46.990 --> 09:47.360
mode on the

250
09:47.360 --> 09:50.840
router and then specifying the service policy that we want to use.

251
09:50.840 --> 09:53.770
So, I'm going to write service policy right here and in parentheses, I'll put

252
09:53.770 --> 09:54.120
control

253
09:54.120 --> 09:56.040
plane because that's where we want to apply it.

254
09:56.040 --> 09:59.380
And then the service policy says, I want to use this policy map and effectively

255
09:59.380 --> 09:59.800
applies

256
09:59.800 --> 10:00.800
it to the control plane.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

256
09:59.800 --> 10:00.800
it to the control plane.

257
10:00.800 --> 10:04.580
So, no matter where that traffic is coming in, if it's ICMP traffic, it's

258
10:04.580 --> 10:06.040
coming in here

259
10:06.040 --> 10:10.560
or here or here, that traffic is identified if it matches a permit statement.

260
10:10.560 --> 10:13.480
The ACL in combination with the class map are identifying that traffic.

261
10:13.480 --> 10:16.630
The policy map says what we want to do and if it's applied to the control plane

262
10:16.630 --> 10:17.040
, that's

263
10:17.040 --> 10:18.040
where it happens.

264
10:18.040 --> 10:21.780
So, regardless of which interface that traffic comes in on, if the action is to

265
10:21.780 --> 10:22.360
drop or to

266
10:22.360 --> 10:25.970
limit it beyond a certain point, when that traffic shows up at the control

267
10:25.970 --> 10:26.680
plane, that

268
10:26.680 --> 10:30.090
traffic will be limited or dropped based on our instructions as part of the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

268
10:26.680 --> 10:30.090
traffic will be limited or dropped based on our instructions as part of the

269
10:30.090 --> 10:31.280
policy map.

270
10:31.280 --> 10:32.280
And here's the great news.

271
10:32.280 --> 10:35.140
In this set of videos, we are going to walk through demonstrations of each of

272
10:35.140 --> 10:35.920
these components

273
10:35.920 --> 10:38.710
and then once again, as I mentioned, I'll put you on a hands-on lab so you can

274
10:38.710 --> 10:39.800
get practice

275
10:39.800 --> 10:43.320
in working with infrastructure ACLs and also control plane policing.

276
10:43.320 --> 10:46.670
So, I'll see you in the next video as we do a demonstration of setting up

277
10:46.670 --> 10:47.640
infrastructure

278
10:47.640 --> 10:49.720
ACLs on a Cisco router.