WEBVTT

1
00:00.000 --> 00:03.140
In this video, we're going to walk through an example of setting up some

2
00:03.140 --> 00:04.800
infrastructure ACL entries.

3
00:04.800 --> 00:08.600
And as part of our game plan, let's demonstrate a few things.

4
00:08.600 --> 00:11.200
Number one, let's demonstrate anti spoofing.

5
00:11.200 --> 00:15.200
And we'll imagine that our internal network here is 25 dot 25.

6
00:15.200 --> 00:18.500
And the reason I'm using 325 is that it's easy to recognize.

7
00:18.500 --> 00:22.300
So when you see 25, 25, 25, you just think, oh, that represents the internal

8
00:22.300 --> 00:25.000
management address space for infrastructure devices.

9
00:25.000 --> 00:29.390
So we want to do anti spoofing to stop any incoming traffic, we'll play inbound

10
00:29.390 --> 00:30.500
right here on R4.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:29.390 --> 00:30.500
right here on R4.

11
00:30.500 --> 00:34.800
And inbound traffic, that says it's coming from 25, 25, 25, 0.

12
00:34.800 --> 00:38.000
Let's also go ahead and set up some anti spoofing.

13
00:38.000 --> 00:44.900
So for source, we'll say no or deny for source 25, 25, 25, 0.

14
00:44.900 --> 00:49.940
Let's also say no to any source addresses that are pretending to come from 0

15
00:49.940 --> 00:51.000
dot 0 dot 0.

16
00:51.000 --> 00:54.200
And let's also throw in an RFC 1918 address space just for grins.

17
00:54.200 --> 01:01.200
So anything claiming to come from 10 dot 0 dot 0 or once to be 2 dot 16 dot 0
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

17
00:54.200 --> 01:01.200
So anything claiming to come from 10 dot 0 dot 0 or once to be 2 dot 16 dot 0

18
01:01.200 --> 01:04.200
dot 0 and this will be a slash 8 and this will be a slash 12.

19
01:04.200 --> 01:07.700
So we'll say no to all that will put a little red indicator there saying we're

20
01:07.700 --> 01:08.600
going to do a deny.

21
01:08.600 --> 01:12.770
And then we'll go ahead and we'll deny fragments that are going to our address

22
01:12.770 --> 01:17.800
base of our management network of 25 dot 25 dot 0.

23
01:17.800 --> 01:22.640
Let's also go ahead and deny options so an attacker could be using options in

24
01:22.640 --> 01:25.400
IP headers to help manipulate and trick our system.

25
01:25.400 --> 01:29.980
So let's also deny options going to our address base again for transit traffic

26
01:29.980 --> 01:32.800
that's going through our network and not to our network devices.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
01:29.980 --> 01:32.800
that's going through our network and not to our network devices.

27
01:32.800 --> 01:36.690
We can let those go, but we want to go ahead and deny fragments and options to

28
01:36.690 --> 01:38.200
our management address base.

29
01:38.200 --> 01:41.960
So those would also be denies to our address base and then for the permits and

30
01:41.960 --> 01:43.900
I'll go ahead and mark that in crane.

31
01:43.900 --> 01:47.620
So next we want to do our permits for traffic that's going to our management

32
01:47.620 --> 01:48.900
devices that we need.

33
01:48.900 --> 01:53.780
For example, we'd want to go ahead and permit traffic like BGP and lock it down

34
01:53.780 --> 01:58.300
between our devices in our infrastructure and our external BGP peers.

35
01:58.300 --> 02:02.820
So here I'm going to say permit BGP explicitly meaning just to the sources and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

35
01:58.300 --> 02:02.820
So here I'm going to say permit BGP explicitly meaning just to the sources and

36
02:02.820 --> 02:04.900
destinations that are needed.

37
02:04.900 --> 02:10.820
And the same thing would be true for SSH and possibly ICMP. Then we want to

38
02:10.820 --> 02:14.900
deny that traffic BGP and SSH and ICMP.

39
02:14.900 --> 02:20.270
It is going to 25 25 25 0 because if it wasn't permitted explicitly earlier, we

40
02:20.270 --> 02:24.540
want to go ahead and deny any of that type of traffic to our management address

41
02:24.540 --> 02:25.900
base of our devices.

42
02:25.900 --> 02:29.800
And then at the tail end, we'd want to permit IP any any just without all the

43
02:29.800 --> 02:32.900
transit traffic that didn't get explicitly denied.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

43
02:29.800 --> 02:32.900
transit traffic that didn't get explicitly denied.

44
02:32.900 --> 02:36.310
So with that in mind, let's go ahead and use some of that information and

45
02:36.310 --> 02:39.900
create an infrastructure ACL right here inbound on gig 00 on our four.

46
02:39.900 --> 02:43.380
So here in the lab environment, let me go ahead and double click on the top

47
02:43.380 --> 02:44.900
ology, making sure that we are on the right lab.

48
02:44.900 --> 02:48.750
That's always helpful for a good demo. So there's our topology that looks great

49
02:48.750 --> 02:48.900
.

50
02:48.900 --> 02:52.900
And just for grins, I'm going to go to this client nug computer for a moment,

51
02:52.900 --> 02:54.900
which is up in the upper right, double click on it to bring it up.

52
02:54.900 --> 02:56.900
That's the little Windows 11 machine.

53
02:56.900 --> 03:00.980
It's one of verify that I can reach server one nug just to confirm all of our
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
02:56.900 --> 03:00.980
It's one of verify that I can reach server one nug just to confirm all of our

54
03:00.980 --> 03:02.900
network routing is in place.

55
03:02.900 --> 03:06.100
So here's the console coming up for client nug in the upper left hand corner of

56
03:06.100 --> 03:06.900
our topology.

57
03:06.900 --> 03:10.900
And if you do an IP config, you'll show us the IP address 100150.

58
03:10.900 --> 03:11.900
That looks good.

59
03:11.900 --> 03:16.900
And we'll do a ping access to a trace a trace RT space dash deeper.

60
03:16.900 --> 03:20.900
Don't bother doing name resolution over to our server at 23 dot 1 dot 2 dot 100

61
03:20.900 --> 03:20.900
.

62
03:20.900 --> 03:21.900
And there's the hop.

63
03:21.900 --> 03:26.650
So the first hop is based on the last octet. That's our one and then our two

64
03:26.650 --> 03:30.900
and then our four and I can't reach the server.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

64
03:26.650 --> 03:30.900
and then our four and I can't reach the server.

65
03:30.900 --> 03:34.560
Why is that? Let's do control C. Oh, there it is. I just didn't wait long

66
03:34.560 --> 03:34.900
enough.

67
03:34.900 --> 03:37.900
And there's the final destination of our server 23 dot 1 dot 2 dot 100.

68
03:37.900 --> 03:40.900
So the path is going through the network like this.

69
03:40.900 --> 03:45.900
So I verify we had basic connectivity and we do great, great, great.

70
03:45.900 --> 03:48.900
So let me go ahead and minimize client nug in case we need to use them again.

71
03:48.900 --> 03:52.270
And let's go to server one nug which will give us console access to all of our

72
03:52.270 --> 03:52.900
routers.

73
03:52.900 --> 03:55.900
So here's the console access to router four.

74
03:55.900 --> 03:58.900
And that's where we're going to create our infrastructure ACL.

75
03:58.900 --> 04:01.900
And we'll just put a few examples in to give you the feel of it.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
03:58.900 --> 04:01.900
And we'll just put a few examples in to give you the feel of it.

76
04:01.900 --> 04:04.640
The first thing we should do in our four is verify we don't yet have an access

77
04:04.640 --> 04:05.900
list that we're going to build upon.

78
04:05.900 --> 04:10.390
So show access list and press center and we have an IPV six ACL, but we don't

79
04:10.390 --> 04:11.900
have any IPV four.

80
04:11.900 --> 04:16.520
Also, by the way, the same type of filtering we would use for IPV four for

81
04:16.520 --> 04:19.900
filtering out bogus or incoming traffic.

82
04:19.900 --> 04:24.030
Also, because that's showing up, we would also want to create the same types of

83
04:24.030 --> 04:27.900
access control list if we're using IPV six as we're doing with IPV four.

84
04:27.900 --> 04:31.300
So in this demo, I should get focused on IPV four, but the concepts are very
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
04:27.900 --> 04:31.300
So in this demo, I should get focused on IPV four, but the concepts are very

85
04:31.300 --> 04:31.900
similar.

86
04:31.900 --> 04:35.020
So now that we know that we don't have any IPV four access control list, let's

87
04:35.020 --> 04:37.980
go ahead and go into configuration mode and let's create IP access list

88
04:37.980 --> 04:38.900
extended.

89
04:38.900 --> 04:43.900
And let's call it our dash I ACL, just remind ourselves of what it is.

90
04:43.900 --> 04:46.900
And then we're in extended access list configuration mode.

91
04:46.900 --> 04:50.640
So let's go ahead and deny source traffic if it claims to be coming from the

92
04:50.640 --> 04:53.900
address base at zero zero zero zero trying to go anywhere.

93
04:53.900 --> 04:55.900
We'll kill that fantastic.

94
04:55.900 --> 05:01.780
And let's also let's take one more from RFC 3030 and how about deny IP coming
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

94
04:55.900 --> 05:01.780
And let's also let's take one more from RFC 3030 and how about deny IP coming

95
05:01.780 --> 05:03.900
from 127 anything.

96
05:03.900 --> 05:07.170
So for our wildcard, we'll match on the first octet and not care about the

97
05:07.170 --> 05:09.900
second one, third one or fourth one going to anywhere.

98
05:09.900 --> 05:12.900
So once this ACL is applied, this could deny those two.

99
05:12.900 --> 05:15.900
And let's pick one example from the RFC 1918 address base.

100
05:15.900 --> 05:18.900
Let's do a deny about once a two dot 16 dot zero zero.

101
05:18.900 --> 05:20.900
So let's say slash 12.

102
05:20.900 --> 05:24.900
So the range is once a two is 16 through once a two 31.

103
05:24.900 --> 05:30.480
So the wildcard bits there would be zero dot for the first octet for the second
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

103
05:24.900 --> 05:30.480
So the wildcard bits there would be zero dot for the first octet for the second

104
05:30.480 --> 05:32.900
octet be 15, meaning we only care about matching on the first page.

105
05:32.900 --> 05:38.140
So that second octet and then 55 that 55 meaning we don't care about mentioning

106
05:38.140 --> 05:41.900
any of the bits from octet three or four going to anywhere.

107
05:41.900 --> 05:43.900
And I thought IP, but I didn't say it.

108
05:43.900 --> 05:46.900
So I need to say IP fantastic.

109
05:46.900 --> 05:50.910
And let's do a do show access list and we'll specify the name of our access

110
05:50.910 --> 05:54.900
control list, our dash I ACL press enter.

111
05:54.900 --> 05:56.900
And there's our access control list so far.

112
05:56.900 --> 06:00.390
So that's an example of some of the addressing space that we want to deny as
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

112
05:56.900 --> 06:00.390
So that's an example of some of the addressing space that we want to deny as

113
06:00.390 --> 06:03.900
source addresses before allowing them to come into our network.

114
06:03.900 --> 06:08.230
However, another deny that we should do is deny IP anything claiming to come

115
06:08.230 --> 06:10.900
from 25 dot 25 dot 25 dot zero.

116
06:10.900 --> 06:12.900
That's our internal address base.

117
06:12.900 --> 06:16.610
We don't want anybody claiming their source address coming in from the outside

118
06:16.610 --> 06:18.900
world is coming from that same address space.

119
06:18.900 --> 06:22.560
So the wildcard bits there to be zero dot and then two to five dot two to five

120
06:22.560 --> 06:24.900
dot two to five space going to anywhere.

121
06:24.900 --> 06:25.900
Perfect.

122
06:25.900 --> 06:30.900
Now here is our access control list so far and I love that.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

122
06:25.900 --> 06:30.900
Now here is our access control list so far and I love that.

123
06:30.900 --> 06:33.900
I wanted to match on the first three octets.

124
06:33.900 --> 06:39.500
So let's go ahead and fix that with a no 40 remove that 40 entry and then we'll

125
06:39.500 --> 06:46.180
go ahead and we'll do deny IP 25 dot 25 dot 25 dot zero space and we want to

126
06:46.180 --> 06:47.900
match on the first three octets of zero dot zero dot zero dot.

127
06:47.900 --> 06:51.900
And then the last octet we don't care about and that looks much better.

128
06:51.900 --> 06:54.900
Another good reason to check our work going to any destination.

129
06:54.900 --> 06:58.900
So we'll do a do show access list our IACL and that looks way better.

130
06:58.900 --> 07:00.900
So we'll check this as we go.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

130
06:58.900 --> 07:00.900
So we'll check this as we go.

131
07:00.900 --> 07:05.310
So next listed I fragments they're trying to go into our management address

132
07:05.310 --> 07:05.900
space.

133
07:05.900 --> 07:09.420
So we'll say deny and let's go ahead and do TCP source from anywhere going to

134
07:09.420 --> 07:14.360
our management network of 25 dot 25 dot zero with the wildcard mass saying we

135
07:14.360 --> 07:17.900
want to match on this first three octets space and then we're going to use the

136
07:17.900 --> 07:19.900
key word fragments right there.

137
07:19.900 --> 07:21.900
Check on non initial fragments.

138
07:21.900 --> 07:26.570
So that's going to deny those and it'll do the same thing for fragments for UDP

139
07:26.570 --> 07:29.900
coming to our management space and also for ICMP.

140
07:29.900 --> 07:33.010
Again, these are the examples of what we might want to include in an
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

140
07:29.900 --> 07:33.010
Again, these are the examples of what we might want to include in an

141
07:33.010 --> 07:36.900
infrastructure access control list to protect our infrastructure devices.

142
07:36.900 --> 07:40.620
So now even if it's coming in from authorized source and it's for example an

143
07:40.620 --> 07:41.900
authorized session.

144
07:41.900 --> 07:51.900
If there's fragments involved, it'll block that on the way in.

145
07:51.900 --> 07:53.900
Next list deny options.

146
07:53.900 --> 07:59.420
So do deny IP coming from any to our address base of 25 dot 25 dot 25 dot zero

147
07:59.420 --> 08:03.900
with the wildcard mask of zero dot zero dot zero dot two fifty five.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

147
07:59.420 --> 08:03.900
with the wildcard mask of zero dot zero dot zero dot two fifty five.

148
08:03.900 --> 08:06.900
We'll use the keyword option and then which options do you want to match on.

149
08:06.900 --> 08:10.900
So what do we want to match on a record route and there's tons of options here.

150
08:10.900 --> 08:11.900
I'm going to go ahead for the demo and say any options.

151
08:11.900 --> 08:16.700
So we'll go ahead and do any options press enter and let's check our access

152
08:16.700 --> 08:17.900
control list.

153
08:17.900 --> 08:20.900
So so far we have a whole bunch of denies fantastic.

154
08:20.900 --> 08:23.900
And now let's go ahead and start permitting some traffic.

155
08:23.900 --> 08:25.900
How about BGP?

156
08:25.900 --> 08:30.140
So if we had BGP peers that we need to allow BGP traffic in on or we weren't
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

156
08:25.900 --> 08:30.140
So if we had BGP peers that we need to allow BGP traffic in on or we weren't

157
08:30.140 --> 08:32.900
sure who's going to initiate the session.

158
08:32.900 --> 08:37.590
We'd want to allow for both sides of that conversation. So we do permit TCP and

159
08:37.590 --> 08:40.900
let's say for example we had a host out at nine dot nine dot nine dot nine.

160
08:40.900 --> 08:45.110
That's who we're appearing with. So we put in the peers address of nine nine

161
08:45.110 --> 08:45.900
nine nine.

162
08:45.900 --> 08:47.900
So I will use the keyword of host in front of that.

163
08:47.900 --> 08:49.900
And then we can specify our internal address space.

164
08:49.900 --> 08:54.400
Now it'd be even better if we locked it down to a specific BGP speaker that was

165
08:54.400 --> 08:55.900
in our address base.

166
08:55.900 --> 09:01.560
But for the demo I'll go ahead and say the destination can be 25 dot 25 dot 25
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

166
08:55.900 --> 09:01.560
But for the demo I'll go ahead and say the destination can be 25 dot 25 dot 25

167
09:01.560 --> 09:04.900
dot anything if the destination port equals BGP.

168
09:04.900 --> 09:10.120
And we could also hit the upper key and say permit TCP host nine nine nine nine

169
09:10.120 --> 09:11.900
with a source port of BGP.

170
09:11.900 --> 09:16.900
And the keyword BGP points to port 179 and that's where BGP operates.

171
09:16.900 --> 09:18.900
So this next entry would allow an external host.

172
09:18.900 --> 09:24.510
For example, nine nine nine nine that's our external BGP speaker. If they're

173
09:24.510 --> 09:27.900
sourcing their traffic from port 179 coming into our address base.

174
09:27.900 --> 09:29.900
This permit statement would allow that to happen.

175
09:29.900 --> 09:34.900
Oh, my wildcard mouse there. So I'll go ahead and update that.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

175
09:29.900 --> 09:34.900
Oh, my wildcard mouse there. So I'll go ahead and update that.

176
09:34.900 --> 09:38.150
I just washed my hands and can't do a thing with them. So I'll do a no 100 and

177
09:38.150 --> 09:41.900
I will fix that with the wildcard mask of 255.

178
09:41.900 --> 09:46.450
So one thing that's interesting about access controllers is that the bits the

179
09:46.450 --> 09:48.900
wildcard bits do not have to be contiguous.

180
09:48.900 --> 09:52.690
So I'm going to go ahead and put that back in, but with the correct wildcard

181
09:52.690 --> 09:54.900
mask of 255 and that last octet.

182
09:54.900 --> 09:58.230
And then we'll check our work with a quick show command. All right, that looks

183
09:58.230 --> 09:58.900
better.

184
09:58.900 --> 10:02.020
And if that's the only BGP we need, we then want to go ahead and delete all
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

184
09:58.900 --> 10:02.020
And if that's the only BGP we need, we then want to go ahead and delete all

185
10:02.020 --> 10:03.900
other BGP going to our address base.

186
10:03.900 --> 10:09.900
So we can do a denied TCP any to the address base of 25 dot 25 dot 25.

187
10:09.900 --> 10:13.900
If the destination port equals BGP just like that.

188
10:13.900 --> 10:18.420
We can also flip that and specify if it's the source port equals BGP and then

189
10:18.420 --> 10:21.900
the tail end go ahead and take off the equal BGP there.

190
10:21.900 --> 10:26.900
And so now anything that's not explicitly permitted here in lines 90 and 100

191
10:26.900 --> 10:32.190
are going to be explicitly denied by these next two entries, which would be 110
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

191
10:26.900 --> 10:32.190
are going to be explicitly denied by these next two entries, which would be 110

192
10:32.190 --> 10:32.900
and 120.

193
10:32.900 --> 10:38.900
So we do a quick show command. Next, let's allow SSH. So we'll permit TCP.

194
10:38.900 --> 10:43.330
And let's imagine that we want to permit SSH from this one server coming to

195
10:43.330 --> 10:45.900
anything in our 25 address space.

196
10:45.900 --> 10:51.510
We'll say permit TCP host and the server is out there at 23 dot 1 dot 2 dot 100

197
10:51.510 --> 10:56.420
space question mark and the destination is going to be 25 dot 25 dot 25 dot

198
10:56.420 --> 10:56.900
anything.

199
10:56.900 --> 11:01.170
If the destination port equals 22, which is SSH and that will allow that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

199
10:56.900 --> 11:01.170
If the destination port equals 22, which is SSH and that will allow that

200
11:01.170 --> 11:01.900
traffic.

201
11:01.900 --> 11:05.630
And if that's the only traffic we want, we then want to go ahead and deny all

202
11:05.630 --> 11:07.900
other SSH coming into our address base.

203
11:07.900 --> 11:13.900
So we'll do deny TCP from anyone coming to 25 dot 25 dot 25 dot 0 24 bit mask.

204
11:13.900 --> 11:16.900
If that destination port is 22 just like that.

205
11:16.900 --> 11:19.900
And let's do a quick check of our work with the show access list.

206
11:19.900 --> 11:21.900
And so far I think we're on track.

207
11:21.900 --> 11:26.700
We'll do a more for ICMP. So for ICMP list also allow ICMP from server one nug

208
11:26.700 --> 11:29.900
out here to anything in our 25 address base.

209
11:29.900 --> 11:35.490
So say permit ICMP from host 23 dot 1 dot 2 dot 100 going to anything in the 25
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

209
11:29.900 --> 11:35.490
So say permit ICMP from host 23 dot 1 dot 2 dot 100 going to anything in the 25

210
11:35.490 --> 11:37.900
dot 25 dot 25 address base.

211
11:37.900 --> 11:42.990
And then we can lock it down to specifics regarding ICMP, but for the demo, I

212
11:42.990 --> 11:43.900
'll leave it open.

213
11:43.900 --> 11:48.740
And if that's the only ICMP we want to address base, we then do a deny ICMP

214
11:48.740 --> 11:53.900
from anywhere going to 25 dot 25 dot 0 with the last eight bits not mattering.

215
11:53.900 --> 11:57.900
And let's do a quick verification of our work with a show access list.

216
11:57.900 --> 12:00.900
And that looks pretty good to know the very tail end of this.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

216
11:57.900 --> 12:00.900
And that looks pretty good to know the very tail end of this.

217
12:00.900 --> 12:02.900
This is all for infrastructure control.

218
12:02.900 --> 12:07.120
The last thing we want to do is allow other traffic that, for example, might be

219
12:07.120 --> 12:07.900
transiting our network.

220
12:07.900 --> 12:08.900
So we're going to add one more line.

221
12:08.900 --> 12:09.900
It'll be 170.

222
12:09.900 --> 12:12.900
We'll say permit IP any any.

223
12:12.900 --> 12:16.490
And if we want to also we could add the log keyword on these, but I've also

224
12:16.490 --> 12:18.900
discovered that because we have hit counts, you can go back.

225
12:18.900 --> 12:22.880
You can see it counts and identify that an access list control entry has been

226
12:22.880 --> 12:24.900
hit even without the log keyword.

227
12:24.900 --> 12:29.880
So our next step then would be to apply this inbound on our four gig zero zero

228
12:29.880 --> 12:30.900
interface.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

228
12:29.880 --> 12:30.900
interface.

229
12:30.900 --> 12:32.900
So let's go ahead and do that.

230
12:32.900 --> 12:37.180
So we'll go into interface configuration mode for gig zero slash zero and we

231
12:37.180 --> 12:38.900
use the command IP access group.

232
12:38.900 --> 12:42.520
The name of our access control list, which I will copy paste so I don't have a

233
12:42.520 --> 12:42.900
typo.

234
12:42.900 --> 12:45.900
And we want it to be applied inbound.

235
12:45.900 --> 12:46.900
Awesome.

236
12:46.900 --> 12:51.740
So if we look at our access control list, let's do a show access list, our dash

237
12:51.740 --> 12:53.900
I ACL press center.

238
12:53.900 --> 12:57.320
We've already had some matches here at the very end to catch all the permit IP

239
12:57.320 --> 12:57.900
any any.

240
12:57.900 --> 12:59.900
But let's go ahead and test the SSH here.

241
12:59.900 --> 13:05.650
So this line right here says that we are permitting TCP traffic from the server
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

241
12:59.900 --> 13:05.650
So this line right here says that we are permitting TCP traffic from the server

242
13:05.650 --> 13:07.900
2312100 going to anywhere in the 25.

243
13:07.900 --> 13:09.900
A dress base 252525, etc.

244
13:09.900 --> 13:15.990
If the destination port is 22, I just realized that I don't have SSH running on

245
13:15.990 --> 13:16.900
my router.

246
13:16.900 --> 13:18.900
So let's let's do this.

247
13:18.900 --> 13:24.900
Let's set up SSH here on our one so that we can go ahead and connect there.

248
13:24.900 --> 13:29.280
And it's also set up a loop back address that's reachable at 25 dot 25 dot 25

249
13:29.280 --> 13:29.900
dot one.

250
13:29.900 --> 13:33.900
So let me go ahead to our one and let me set that up.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

250
13:29.900 --> 13:33.900
So let me go ahead to our one and let me set that up.

251
13:33.900 --> 13:36.900
It'll make for a much better demo.

252
13:36.900 --> 13:40.450
Also in our infrastructure access control list if we're not allowing telnet for

253
13:40.450 --> 13:43.900
example, we want to block that as well as any other management protocols to our

254
13:43.900 --> 13:44.900
address base.

255
13:44.900 --> 13:45.900
So here are our one.

256
13:45.900 --> 13:51.060
Let's go ahead and do an IP domain name of nuggetlab.com that will be needed as

257
13:51.060 --> 13:52.900
we do our crypto key generate RSA.

258
13:52.900 --> 13:56.900
So the next crypto key generate RSA module.

259
13:56.900 --> 13:57.900
Let's use 2048.

260
13:57.900 --> 14:02.280
So these are commands we learned back in CCNA level training about setting up
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

260
13:57.900 --> 14:02.280
So these are commands we learned back in CCNA level training about setting up

261
14:02.280 --> 14:03.900
basic SSH capabilities.

262
14:03.900 --> 14:08.320
Let's do IP SH version two and let's do a do show run pipe section line just to

263
14:08.320 --> 14:12.900
take a look at our line configurations and we'll do a little work there.

264
14:12.900 --> 14:15.900
So let's go ahead and take off the no login.

265
14:15.900 --> 14:16.900
We want to then be able to go ahead and log in.

266
14:16.900 --> 14:17.900
So we'll need a local user as well.

267
14:17.900 --> 14:24.900
Let's create a username of admin and and privilege 15 and secret.

268
14:24.900 --> 14:28.730
In fact, let's use capital C ISCO exclamation mark two three because that's the

269
14:28.730 --> 14:31.900
one that rolls off of my fingertips the easiest and handle.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

269
14:28.730 --> 14:31.900
one that rolls off of my fingertips the easiest and handle.

270
14:31.900 --> 14:36.660
So I'm going to use a simple password like that and then we'll go to line VTY

271
14:36.660 --> 14:39.900
zero through 15 and I'll do a login local.

272
14:39.900 --> 14:43.300
We could also turn on for a new model if you want, but it's going to say login

273
14:43.300 --> 14:44.900
local and also transport input.

274
14:44.900 --> 14:48.310
That's the thing and that way we're not even allowing input telnet on this

275
14:48.310 --> 14:48.900
router.

276
14:48.900 --> 14:51.900
So we're just eliminating the telnet option altogether.

277
14:51.900 --> 14:54.760
So now that's done, let's go ahead and test it locally. Let's do a show IP

278
14:54.760 --> 14:55.900
interface brief.

279
14:55.900 --> 14:59.890
I'll say please exclude anything that has the output of an assigned in it and

280
14:59.890 --> 15:02.900
let's do a telnet to 1.1.1.1.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

280
14:59.890 --> 15:02.900
let's do a telnet to 1.1.1.1.

281
15:02.900 --> 15:03.900
I'm not telling it.

282
15:03.900 --> 15:09.510
Let's do SSH 1.1.1.1 locally and it says no user specified with the show run

283
15:09.510 --> 15:10.900
pipe section line.

284
15:10.900 --> 15:13.900
Take a layer of line configuration real quick login local.

285
15:13.900 --> 15:17.900
That looks good and oh, and I forgot the specify user here.

286
15:17.900 --> 15:23.810
So SSH my fault dash L for login as admin to that address in the password is

287
15:23.810 --> 15:27.900
capital C. I SEO exclamation mark 23 boom and we are in.

288
15:27.900 --> 15:33.110
So if you do a show users fantastic if we do a show SSH and press enter
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

288
15:27.900 --> 15:33.110
So if you do a show users fantastic if we do a show SSH and press enter

289
15:33.110 --> 15:33.900
fantastic.

290
15:33.900 --> 15:37.900
We are logged in. We know SSH works. So I'm going to go ahead and type in exit.

291
15:37.900 --> 15:40.900
Let's also go ahead and create a loop back address in the 25 address range.

292
15:40.900 --> 15:45.030
So do a config D and specify interface loop back. Let's make interface loop

293
15:45.030 --> 15:45.900
back 25.

294
15:45.900 --> 15:53.020
I'll do IP address 25 dot 25 dot 25 dot 1 with a 32 bit mask and fantastic and

295
15:53.020 --> 15:53.900
then we'll add that to OSPF.

296
15:53.900 --> 15:56.900
Let's do show IP OSPF interface brief.

297
15:56.900 --> 15:59.760
Yep. I don't have a network state. Oh, it's already covered. Great, great,

298
15:59.760 --> 15:59.900
great.

299
15:59.900 --> 16:03.660
So I must have a network statement that's wide open and it's included fantastic
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

299
15:59.900 --> 16:03.660
So I must have a network statement that's wide open and it's included fantastic

300
16:03.660 --> 16:03.900
.

301
16:03.900 --> 16:08.130
So now that address is reachable. Let's go ahead and do a ping out to the

302
16:08.130 --> 16:14.180
server at 23 dot 1 dot 2 dot 100 will source it from loop back 25 just to

303
16:14.180 --> 16:16.900
verify we have reach ability there and back and we do great, great, great.

304
16:16.900 --> 16:20.740
So now if we went to the server now in our topology server one nug is this

305
16:20.740 --> 16:23.900
server that we're currently sitting at right here.

306
16:23.900 --> 16:28.430
So if we went to a command prompt on this server, let's do that by clicking on

307
16:28.430 --> 16:29.900
the command prompt icon.

308
16:29.900 --> 16:34.070
So here, let's go ahead and type in SSH press enter and let's take a look at
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

308
16:29.900 --> 16:34.070
So here, let's go ahead and type in SSH press enter and let's take a look at

309
16:34.070 --> 16:37.900
our options here so we can go ahead and do a user at host fantastic work force.

310
16:37.900 --> 16:45.900
So we'll do a SSH space admin 25 dot 25 dot 25 dot 1 and no matching cipher.

311
16:45.900 --> 16:46.900
All right.

312
16:46.900 --> 16:51.160
Well, I know based on earlier on our output, let's go take a look that if we

313
16:51.160 --> 16:54.900
did when we did a show SSH, it does support this.

314
16:54.900 --> 16:59.800
So I'm going to go ahead and copy that go back to the command prompt and we'll

315
16:59.800 --> 17:01.900
just add that in so be SSH space.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

315
16:59.800 --> 17:01.900
just add that in so be SSH space.

316
17:01.900 --> 17:05.900
And then we'll do a dash C for cipher based on the legend up here.

317
17:05.900 --> 17:10.590
And we'll go ahead and paste that in and then we'll go ahead and log in as

318
17:10.590 --> 17:14.900
admin 25 dot 25 dot 25 dot 1 center and okay.

319
17:14.900 --> 17:16.900
Yeah, I'll accept the thumbprint and yes.

320
17:16.900 --> 17:19.900
And boom, we'll put in the password and we are in fantastic.

321
17:19.900 --> 17:24.030
So if we go back to our four and we take a look at the access control list, let

322
17:24.030 --> 17:24.900
's do that real quick.

323
17:24.900 --> 17:27.900
We'll do a upper key show access list.

324
17:27.900 --> 17:31.900
There were our pings that we did for testing and here's our traffic for SSH.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

324
17:27.900 --> 17:31.900
There were our pings that we did for testing and here's our traffic for SSH.

325
17:31.900 --> 17:37.140
The permit statement permitting that server 2312 100 to use SSH to anything in

326
17:37.140 --> 17:38.900
the address space of 25 25 25.

327
17:38.900 --> 17:42.900
So if we change the IP address on server one, let's do that from just a moment.

328
17:42.900 --> 17:47.920
So back at server one, if we exit out of our existing session, we do a n CPA

329
17:47.920 --> 17:50.900
dot CPL to change our IP address here real quick.

330
17:50.900 --> 17:52.900
And I just change this the lab net care.

331
17:52.900 --> 17:57.120
Look at the properties and let me change the IPB for address to have about one

332
17:57.120 --> 17:57.900
zero one.

333
17:57.900 --> 17:59.900
So now the address has changed.

334
17:59.900 --> 18:00.900
We'll click OK.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

334
17:59.900 --> 18:00.900
We'll click OK.

335
18:00.900 --> 18:01.900
We'll go back now.

336
18:01.900 --> 18:04.900
Now we try to do an SSH to that same host.

337
18:04.900 --> 18:05.900
It's going to fail.

338
18:05.900 --> 18:08.900
And that's because the access control list says, hey, you know what?

339
18:08.900 --> 18:12.640
You weren't permitted earlier and I'm denying all other state traffic or that

340
18:12.640 --> 18:13.900
specific IP address.

341
18:13.900 --> 18:18.100
So if we go back to our console session previously, we had no matches here on

342
18:18.100 --> 18:20.900
line 140 and now we have the upper key and press center.

343
18:20.900 --> 18:25.160
Now we have some denies on 140 and before I forget, I'm going to go back to

344
18:25.160 --> 18:27.900
server one and change this IP address back.

345
18:27.900 --> 18:31.390
So we'll go to properties, go back to IPB for change it back to 100, click on
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

345
18:27.900 --> 18:31.390
So we'll go to properties, go back to IPB for change it back to 100, click on

346
18:31.390 --> 18:33.900
OK a couple of times and then go back to the command line.

347
18:33.900 --> 18:37.900
And now that same upper key, now we're able to log in to our one because the

348
18:37.900 --> 18:39.900
access control list is permitted.

349
18:39.900 --> 18:43.900
So the login is admin with our password type correctly and we are in.

350
18:43.900 --> 18:46.900
So we do a show SH and we are good to go.

351
18:46.900 --> 18:50.280
So I'll type in exit and I close that command prompt and come back into a

352
18:50.280 --> 18:50.900
refresh here.

353
18:50.900 --> 18:55.170
So as a summary here of our infrastructure access controllers, we want to deny

354
18:55.170 --> 18:58.570
traffic that should never be coming into our network based on their source

355
18:58.570 --> 18:58.900
addresses.

356
18:58.900 --> 19:03.110
And that includes our own block of dresses being used as a source coming in
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

356
18:58.900 --> 19:03.110
And that includes our own block of dresses being used as a source coming in

357
19:03.110 --> 19:07.900
from the outside or RC 1918 addresses or RC 3330 addresses.

358
19:07.900 --> 19:12.390
Next words, the nine fragments that are coming in to our management address

359
19:12.390 --> 19:13.900
space of 25, etc.

360
19:13.900 --> 19:18.070
And then we're also denying traffic that is using options coming into our 25

361
19:18.070 --> 19:21.530
address space and then we'll get very specific on permitting traffic that we

362
19:21.530 --> 19:26.510
need, for example, permitting BGP and then denying BGP from everything else

363
19:26.510 --> 19:26.900
going to our address space.

364
19:26.900 --> 19:31.300
And then for this example, printing SSH and then explicitly denying a sage to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

364
19:26.900 --> 19:31.300
And then for this example, printing SSH and then explicitly denying a sage to

365
19:31.300 --> 19:33.900
our address space from everywhere else.

366
19:33.900 --> 19:36.970
And then permitting explicitly the ICMP traffic, we want to go to our address

367
19:36.970 --> 19:40.150
space and then denying everything else coming to our address space, then

368
19:40.150 --> 19:43.900
finally allowing everything else to transit traffic to go through.

369
19:43.900 --> 19:48.000
So now that we've taken a look at an example of an infrastructure ACL on the

370
19:48.000 --> 19:51.900
next video, I'd like to turn our attention to control plain policing.

371
19:51.900 --> 19:55.900
So I'll see you there in the next video in just a moment.