WEBVTT 00:00:01.000 --> 00:00:05.120 So now that we've wrapped up Standard Access Control Lists, let's dive into 00:00:05.120 --> 00:00:09.360 Extended Access Control Lists. So the thing about Extended Access Control Lists 00:00:09.360 --> 00:00:13.800 is that you will have to be really, really great at reading them and 00:00:13.800 --> 00:00:19.320 understanding what each and every single entry does. So when you look at what we 00:00:19.320 --> 00:00:26.200 have here now is we have an entry that has permits and denies just like our 00:00:26.200 --> 00:00:34.599 standard, but now we have protocols specified like IP, TCP, UDP, EIGRP, OSPF. 00:00:34.599 --> 00:00:46.200 We have then the source of the packet, so source IP address, which would match. So 00:00:46.200 --> 00:00:51.279 we're gonna specify either the exact IP address with host or we'll specify a 00:00:51.279 --> 00:00:56.959 range with a network ID and a wildcard mask and so on and so forth. And then we 00:00:56.959 --> 00:01:01.040 even have operators and port numbers that go into there, followed by the 00:01:01.040 --> 00:01:05.680 destination information, followed by operators and port numbers for the 00:01:05.680 --> 00:01:14.959 destination. Whoo, that's a lot. A lot. So let's go out to our router, our number 00:01:14.959 --> 00:01:19.120 one, and let's go ahead and take a peek at all the different options that we have 00:01:19.120 --> 00:01:23.480 available to us that are relevant for the certification exam. So Access List 00:01:23.480 --> 00:01:28.440 101 is an example for an Extended Access Control List, and you'll see here that we 00:01:28.440 --> 00:01:34.480 have permit, deny, and we have remarked. There's also dynamic as an option, but we 00:01:34.480 --> 00:01:39.480 will not get into dynamic here. That's a Dynamic Access Control List, and Dynamic 00:01:39.480 --> 00:01:43.800 Access Control Lists are added based on some other condition. For example, like 00:01:43.800 --> 00:01:51.320 if somebody successfully authenticates, then we could have a Dynamic Entry added 00:01:51.320 --> 00:01:55.400 to the Access Control List based on their successful authentication to allow 00:01:55.400 --> 00:02:00.680 them to do what they need to do, but then once that authentication period expires, 00:02:00.680 --> 00:02:05.599 then they will no longer be, that entry will be removed. So it's a Dynamic Entry 00:02:05.599 --> 00:02:10.520 that gets added and removed based on some other condition that happens. But 00:02:10.520 --> 00:02:14.520 for this exam, those will not show up. So let's just use permit in this example, 00:02:14.520 --> 00:02:19.399 and then you'll see here, this is where we're going to specify our protocol. So IP 00:02:19.399 --> 00:02:24.720 is listed there. As you can see, IP means all protocols. So if you type IP, it 00:02:24.720 --> 00:02:30.500 really means any, but if you wanted to do TCP specific, or UDP specific, or PIM 00:02:30.500 --> 00:02:38.199 specific, or OSPS specific, or IGMP, or ICMP, or ESP, or AAH, you can see a lot 00:02:38.199 --> 00:02:41.080 of them are listed there that we've talked about in this course. But then 00:02:41.080 --> 00:02:45.520 also, if you know of one that's not listed, but you know its protocol number 00:02:45.520 --> 00:02:49.600 by looking it up on IANA's website, then you can just specify the protocol number 00:02:49.600 --> 00:02:53.919 here instead of the actual name. So the name is only listed because those are 00:02:53.919 --> 00:02:57.759 the most common ones that might be used on your Cisco iOS router, but if there's 00:02:57.759 --> 00:03:00.880 an uncommon one, and you know its protocol number from IANA's list, then 00:03:00.880 --> 00:03:03.759 you can go ahead and just put the protocol number in there instead. For 00:03:03.759 --> 00:03:07.199 example, like TCP's protocol number 6, so you could type in 6 here, or you could 00:03:07.199 --> 00:03:13.800 type in TCP. UDP is 117, so you can type in 17 or UDP. OSPF is 89, so you can type 00:03:13.800 --> 00:03:19.759 in OSPF or 89. It would be the same thing. Then after you type in something like IP, 00:03:19.759 --> 00:03:24.839 so we'll do an IP example here, then we can specify the source address. We can 00:03:24.839 --> 00:03:32.759 specify, and when we specify source address, that would mean the first part 00:03:32.880 --> 00:03:38.839 of your address slash wildcard mask pairing, so like 10.0.0.0 or 10.0.0.10, 00:03:38.839 --> 00:03:42.800 whatever the address that you would put in for the source. If you wanted to do 00:03:42.800 --> 00:03:47.240 all source addresses, you put any. If you wanted to do just a specific source 00:03:47.240 --> 00:03:50.759 address, a single source address, you could type in host. Now you don't have to 00:03:50.759 --> 00:03:56.039 type in host because you could type in, for example, 10.0.0.10 and then type 00:03:56.039 --> 00:04:00.839 in 0.0.0.0, and you get the same result because 0.0.0.0 means 00:04:00.839 --> 00:04:04.080 match, match, match, match, match, match, match, match, match, match, match, match, match, match, match every 00:04:04.080 --> 00:04:08.559 single IP address bit, which means this exact address. So you can either do 0.0.0.0.0 00:04:08.559 --> 00:04:12.839 or you could type it in this way if you wanted to. They mean the 00:04:12.839 --> 00:04:17.720 exact same thing. And then what else do we have? We have object group, which is 00:04:17.720 --> 00:04:21.200 beyond the scope of this course, and certification exam. So let's type in 00:04:21.200 --> 00:04:26.559 something like 10.0.0.0. Then we've got what? Our source wildcard bits, so 00:04:26.559 --> 00:04:33.399 let's match every address from 10.0.0.0 to 10.0.0.255. Let's do that. So this is 00:04:33.399 --> 00:04:38.000 what our wildcard mask would be. And then once we do that, it asks us for the 00:04:38.000 --> 00:04:46.040 destination information. So let's say something like 10.0.254.0, and 00:04:46.040 --> 00:04:52.000 then the wildcard mask would be 0.0.0.255 for fun. All right, so that 00:04:52.000 --> 00:05:01.160 would be any traffic coming from 10.0.0.0 through 10.0.0.255 going to 00:05:01.160 --> 00:05:08.119 10.0.254.0 to 10.0.254.255. We want to permit that traffic, right? So being able 00:05:08.119 --> 00:05:10.519 to do that on the certification exam is really important for you to be 00:05:10.519 --> 00:05:16.200 successful. Now you can see there's some other values we can match here. So you're 00:05:16.200 --> 00:05:19.720 not gonna have to worry about matching like the time to live of the packet or 00:05:19.720 --> 00:05:23.640 the type of service value for quality of service for the packet or the DSCP 00:05:23.640 --> 00:05:29.720 value for quality services packet or even fragments. Log might come up and log 00:05:29.720 --> 00:05:35.720 would just be about you creating a log entry, a syslog entry for every 00:05:35.720 --> 00:05:40.359 match that you have on that particular entry. So not something you want to do 00:05:40.359 --> 00:05:47.320 unless it makes sense for you to log. Like if I want to log 00:05:47.359 --> 00:05:53.320 everybody who's trying to access my VTY line as an example, then maybe I want to 00:05:53.320 --> 00:05:58.640 log those ones so that way there I have a log of access, permitted access and 00:05:58.640 --> 00:06:02.040 maybe even and more importantly denied access. So maybe I'll create an entry in 00:06:02.040 --> 00:06:09.480 that one that says deny any log and that way there when people try to access my 00:06:09.480 --> 00:06:13.160 VTY lines if they are not coming from the appropriate IP address and they've 00:06:13.200 --> 00:06:18.959 been denied, then I'll have a log entry for that. Log input would also log the 00:06:18.959 --> 00:06:24.600 input interface in that particular case. So if the exam talks about just logging 00:06:24.600 --> 00:06:28.959 your match entries and log, if they talk about logging your entries plus 00:06:28.959 --> 00:06:34.679 including the input interface, then you would put log input in that case. Time 00:06:34.679 --> 00:06:38.679 range we'll talk about later. So time range will come up possibly on the exam 00:06:38.679 --> 00:06:41.559 so we'll definitely come back and talk about that one when we get to our time 00:06:41.559 --> 00:06:46.480 based access control. Alright so there's just a simple example. So do show access 00:06:46.480 --> 00:06:51.600 hyphen list 101. That's what we have for an IP example. So now let's talk about a 00:06:51.600 --> 00:06:59.279 TCP example. So I'm just going to type in access list 101 and then we will type in 00:06:59.279 --> 00:07:05.559 permit and we'll type in now TCP as an example. Because once you type in TCP as 00:07:05.559 --> 00:07:11.040 your protocol, so TCP, now things are going to change slightly for us. We still 00:07:11.040 --> 00:07:15.119 get asked what our source is. So let's type in something like 10.0, source 00:07:15.119 --> 00:07:23.239 doesn't really matter right now, or 1.0. 0.0.0.255. Now it's 00:07:23.239 --> 00:07:28.519 going to ask me for what? It's going to ask me for an operator and then followed 00:07:28.519 --> 00:07:35.839 by the operator it's going to ask me for a port number associated with TCP. This 00:07:35.839 --> 00:07:40.640 is where you are going to have to be very, very, very, very extra careful on 00:07:40.640 --> 00:07:49.160 the certification exam. So why do I say that? Why do I say extra, extra, 00:07:49.160 --> 00:07:54.320 extra, extra careful in the certification exam? Because you, if not paying 00:07:54.320 --> 00:08:01.200 attention, may miss out on the operator and port number as potentially part of 00:08:01.200 --> 00:08:07.600 the problem. So let's diagram something up here on the screen. So let's go ahead 00:08:07.600 --> 00:08:16.079 and put a PC here in this example. Let's put a router here. Let's put a server 00:08:16.079 --> 00:08:28.399 here as an example. And traffic folks is flowing this way. Do we know the exact 00:08:28.399 --> 00:08:37.559 port number of the source in this case? Yes or no? Let's say this is a web server. 00:08:37.559 --> 00:08:49.280 Do we know the exact source port number that that client is using? No we don't, 00:08:49.280 --> 00:08:55.479 right? Because it is dynamically chosen by the client when establishing that TCP 00:08:55.479 --> 00:09:02.260 session. Now would we know a range potentially? Sure, right? We know it's the 00:09:02.260 --> 00:09:08.020 ephemeral port range. So we could actually put in, as you can see, the range 00:09:08.020 --> 00:09:13.580 in this particular case if we wanted to. Or you can leave a blank. If you leave a 00:09:13.580 --> 00:09:21.380 blank, then that means all source port numbers from 0 to 65,535. So if it's 00:09:21.380 --> 00:09:25.059 blank, it means all source. If there's something in there, then it means that. 00:09:25.179 --> 00:09:36.539 Think about this. What if we accidentally typed in equal to 443 here? Would that make sense in 00:09:36.539 --> 00:09:48.820 this scenario? If this is 10.0.1.0 network? No, it doesn't, right? That does not make sense because 00:09:48.820 --> 00:09:55.140 this is source port when it comes after the source address, right? That is what? 00:09:55.140 --> 00:10:00.460 That is the destination port, not the source. So be mindful of that. Be very 00:10:00.460 --> 00:10:07.539 careful. So let's put in something like this instead. Range. And our range is 00:10:07.539 --> 00:10:14.739 going to be a 1024 to 65,535. Just for fun, just for demonstration purposes. 00:10:19.820 --> 00:10:28.380 Now, when I put in question mark, now I can put in my destination. So let's say this is a server 00:10:28.380 --> 00:10:42.140 in our server farm. And let's say the subnet or the network for that is 10.0.50.0. And it's 0.0.0.255 00:10:42.140 --> 00:10:47.820 for our wildcard mask, right? Now, again, you'll see it's going to ask us for a lot of different 00:10:47.820 --> 00:10:54.659 options. So all of the options that we saw for the IP example we did. So if I go back here, 00:10:54.659 --> 00:10:59.859 this were all the options for the IP example. So they're all there as well. But now what else do 00:10:59.859 --> 00:11:10.099 we have? We have TCP specific values like matching established TCP sessions, or packets only with 00:11:10.099 --> 00:11:18.619 a fin bit set, or packets only with the push bit set, or the reset bit, or the sin bit set. So you 00:11:18.619 --> 00:11:23.020 get pretty granular here. Those are not exam relevant. The established one might be. For 00:11:23.020 --> 00:11:30.380 example, if you have to match only established TCP session, then you would have to type in what? You 00:11:30.380 --> 00:11:36.299 would have to type in established. And then that way there, it's only established TCP sessions 00:11:36.299 --> 00:11:39.700 don't match. If it's not established, then you won't match it. So pay attention to the details 00:11:39.700 --> 00:11:46.419 on the certification exam. And then that way there, you'll be able to pick the right option 00:11:46.419 --> 00:11:54.539 or even craft an access control list to meet that. So it is possible that, you know, they 00:11:54.539 --> 00:11:59.700 might ask you about ACK, right? Match the ones with ACK. Well, remember that there's an ACK 00:11:59.700 --> 00:12:06.539 option for TCP. Match the ones with push, right? So the odds of that coming up are slim, but, 00:12:06.539 --> 00:12:12.179 but, right, just remember, when you specify TCP as your protocol, those becomes options at the end, 00:12:12.179 --> 00:12:20.580 and therefore you can match it. You can match it. But here, let's make sure we understand our port 00:12:20.580 --> 00:12:27.780 numbering. So this is the destination. What's the destination port number? The destination port 00:12:27.780 --> 00:12:42.820 number is going to be 443. So in this case, we could type in equal to 443. Would be beautiful. 00:12:42.820 --> 00:12:49.140 So you have to make sure that you understand the scenario, the situation, the traffic flow, 00:12:49.140 --> 00:12:56.020 and that the ACL matches that perfectly. If not, that's your problem. If it is, if it does match 00:12:56.099 --> 00:13:00.780 perfectly, then that's not your problem. Move on to the next entry, and the next entry. Now, 00:13:00.780 --> 00:13:04.940 by a question mark here, again, you'll see whatever is left are things like what, 00:13:04.940 --> 00:13:09.099 ACK and everything else. So again, you could still match the time range if you want to, 00:13:09.099 --> 00:13:13.780 or steps. Yes, they get lengthy, but we'll leave it at that for right now. So do show 00:13:13.780 --> 00:13:24.059 access-list 101. All right, so there you go. Now, just to show you what those port numbers, 00:13:24.219 --> 00:13:29.979 let's go back to that. I'm going to back up. I'll hit question mark. You'll see here how 00:13:31.500 --> 00:13:37.659 there are common names for common port numbers according to Cisco iOS. You might be looking at 00:13:37.659 --> 00:13:43.099 some of these and going, that's not common for me. I know. But you'll see, I could type in www 00:13:45.020 --> 00:13:50.619 if I wanted to, and that would be for port 80. If I wanted to type in something like 00:13:50.619 --> 00:13:56.380 Telnet, I could actually type in Telnet versus port, for example, 23. 00:13:57.580 --> 00:14:04.299 So you have the opportunity to either do name or port number in these particular cases. 00:14:04.299 --> 00:14:10.219 And what you see in this list, though, are only TCP-related services. You would not see 00:14:10.219 --> 00:14:16.059 UDP-related services in here. Why? Because we specified TCP. And if we look now at my 00:14:16.059 --> 00:14:21.020 access control list, it doesn't know that I created the same one twice, does it? Yeah, 00:14:21.020 --> 00:14:25.500 it does. So notice when I typed in 23, because I already had Telnet for that, 00:14:25.500 --> 00:14:30.619 it didn't even create it for me. It doesn't matter. It knows. It's a little smart, 00:14:30.619 --> 00:14:33.580 the Cisco iOS, to figure that stuff out, which is good. 00:14:35.659 --> 00:14:43.419 All right, let's look at a UDP example then. So access-list 101, permit. It could be denied, 00:14:43.419 --> 00:14:45.979 doesn't matter, but I'm not going to give you the permit versus deny examples here, 00:14:45.979 --> 00:14:49.260 because it doesn't really matter in the end. It's just about reading it on the exam. If it 00:14:49.260 --> 00:14:53.340 says permit, it means permit. If it says deny, it means deny. All right, so now we've got UDP. So 00:14:53.340 --> 00:15:01.419 again, we're going to do sources. So 10.0.2.0 for fun, 000255. Again, the wildcard mask in that 00:15:01.419 --> 00:15:05.580 number can be a variation of a multitude of things, as we've talked about. And then we've got 00:15:05.580 --> 00:15:10.539 our source operator and port number that we're going to have to specify. So I'm just going to 00:15:10.539 --> 00:15:15.020 leave a blank this time, instead of specifying a specific port number. And then from there, 00:15:15.020 --> 00:15:20.380 we're going to have what? We're going to have destination. So destination address instead. So 00:15:20.380 --> 00:15:28.219 let's say any. So any destination. And then now it's showing us various options that would be 00:15:28.219 --> 00:15:32.859 related to UDP, which are not very many, but typically we've got our IP options here, like 00:15:32.859 --> 00:15:40.460 we saw before, plus also the operators. So for example, equal to a certain type of port, 00:15:41.179 --> 00:15:45.340 could be greater than, less than a certain port, range of port numbers if we wanted to specify. 00:15:45.340 --> 00:15:50.140 So again, what's the destination? What service are we trying to reach? So in this case, 00:15:50.140 --> 00:15:57.099 maybe a syslog server. Maybe a TFTP server. Maybe it's an NTP server. Maybe it's RIP we want to 00:15:57.099 --> 00:16:03.260 permit here in this case. So let's, let's pretend it's NTP. So one, two, three, as an example, 00:16:05.500 --> 00:16:10.700 right? So the key here is to make sure that you have the ability to look at your access control 00:16:10.700 --> 00:16:20.140 list and double check and verify. Is this really, is this really UDP? Because what if Cisco on the 00:16:20.140 --> 00:16:27.260 exam has this as TCP? Well, then that's your problem, right? What if they had this as UDP, 00:16:27.260 --> 00:16:34.299 or this is UDP, or this is UDP? Well, that's your problem. Because 443 is TCP. Port 80, 00:16:34.299 --> 00:16:42.619 it's TCP. Port 23, Telnet, TCP. Port 22, SSH, is TCP. So knowing the difference between UDP 00:16:43.580 --> 00:16:47.020 port numbers and TCP port numbers for this exam is valuable. 00:16:47.580 --> 00:16:51.020 So that way there, you have the ability to pick them out of a lineup when you need to. 00:16:53.340 --> 00:16:58.940 And also pay attention on the exam to what they're asking you to match versus not match. Because 00:16:59.500 --> 00:17:05.099 although I've shown you equal to, and I've shown you range, don't forget there's greater than. 00:17:05.099 --> 00:17:10.619 So if you are told, hey, make sure that you match every port number greater than 80. 00:17:10.699 --> 00:17:17.260 Greater than 80. Well, then you type in greater than 80. That would be port number 00:17:17.260 --> 00:17:22.859 81 and higher. That's not port 80 and higher, that's port 81 and higher, greater than 80. 00:17:25.739 --> 00:17:31.579 What about LT? Less than whatever number you specify. So if they say you want to match port 00:17:31.579 --> 00:17:36.380 80 and higher, then it'd be greater than 79, right? Pay attention to the words. 00:17:37.339 --> 00:17:41.020 Port 80 and higher would be greater than 79. 00:17:42.780 --> 00:17:46.859 Because we don't have a greater than or equal to or less than or equal to here. We don't have that. 00:17:49.979 --> 00:17:53.739 They tell you a range. You want to match this value to this value, then range. 00:17:54.380 --> 00:17:59.900 So even this, if they said greater than or less than 70, or sorry, greater than 79, 00:17:59.900 --> 00:18:13.339 greater than 79, less than 91. Greater than 79, less than 91. 00:18:13.339 --> 00:18:26.380 Greater than 79, less than 71. Less than 91. You see that? 00:18:28.780 --> 00:18:30.380 So even though they say greater than or less than, 00:18:30.380 --> 00:18:40.780 doesn't mean that's what you got to use. Things to keep in mind. 00:18:43.819 --> 00:18:57.819 So it's nice here that, oh no, wait, I typed in something wrong. 00:18:58.939 --> 00:19:02.459 So here's an example of something that would be bad that you'd want to pick out on the exam. 00:19:04.060 --> 00:19:09.579 See, it doesn't know. It doesn't know, right, that 22 is supposed to be TCP, 00:19:09.579 --> 00:19:18.060 but you need to know that. 00:19:20.780 --> 00:19:24.060 And then if you see examples with EIG or P or OSPF in them, 00:19:24.060 --> 00:19:26.699 so for example, like access list, we'll just do one-on-one again. 00:19:30.140 --> 00:19:33.500 And then let's just say permit and you type in OSPF. 00:19:34.140 --> 00:19:38.300 Then you have the opportunity to put the source address, whatever you need. So let's say it's 00:19:38.300 --> 00:19:53.020 coming from 10.40.12.1. No, it's 23.1 on that interface, 0.0.0.0. And then notice there's 00:19:53.020 --> 00:20:02.619 no source port that they ask for. So destination 224.0.0.5 wildcard mask would have to be 0.0.0.0 00:20:02.619 --> 00:20:05.020 because that's the hello packet, right? That's the hello packet. 00:20:07.739 --> 00:20:10.780 And then you've got options for all of these, which don't really matter 00:20:12.060 --> 00:20:16.140 when it's all said and done. But there's just another example of how 00:20:19.260 --> 00:20:23.900 being able to read that, oh, that's for OSPF. Does that make sense for the destination? Sure, 00:20:23.900 --> 00:20:29.099 why? Because that is the destination multicast address 224.0.0.5. That's an IP address of the 00:20:29.099 --> 00:20:33.180 interface that hello packet's going out of. But here's the thing I also want you to realize 00:20:33.819 --> 00:20:38.619 that outbound ACLs do not affect your dynamic routing protocols, but inbound ACLs do. 00:20:40.619 --> 00:20:47.979 If I apply any ACL on an interface outbound, it's not going to affect my OSPF or EIGRP traffic at 00:20:47.979 --> 00:20:53.099 all. It's not going to affect it at all. Any locally generated traffic by the router, so like 00:20:53.099 --> 00:21:00.300 a ping, a telnet, a traceroute, anything generated locally by the router, OSPF packet, EIGRP packet, 00:21:00.300 --> 00:21:04.780 BGP packet, doesn't matter. Anything locally generated is not affected by outbound ACLs, 00:21:04.780 --> 00:21:12.060 only inbound ACLs, meaning that I don't have to put in the permit statements for all the 00:21:12.060 --> 00:21:19.739 locally generated traffic by the router if it's an outbound ACL. But if it's an inbound ACL, I would 00:21:19.739 --> 00:21:25.579 not be affected because that's traffic coming to me. It's not locally generated by me. So, any locally 00:21:25.579 --> 00:21:29.660 generated traffic is not going to be affected by your ACLs. 00:21:34.540 --> 00:21:40.140 All right, let's take a peek at our slides here. IP access list, extended test. So, in this case, 00:21:40.140 --> 00:21:45.260 this is about creating an extended access control list using named access control list configuration 00:21:45.260 --> 00:21:51.900 mode. So, just like we saw with our standard example, I can go ahead and I can type an IP 00:21:51.900 --> 00:21:57.180 access list extended, give it a name, and then put all my entries in, just like we did here with our 00:21:58.140 --> 00:22:04.300 numbered ACL. Just put them in. They'll be created in that order. And again, like we talked about, 00:22:04.300 --> 00:22:10.380 editing those ACLs. So, you can go ahead and you can go back into the ACL configuration mode at 00:22:10.380 --> 00:22:15.900 any time and delete things based on their sequence number. So, this means delete sequence 00:22:15.900 --> 00:22:22.619 number 20. Now, sequence number 20 is gone. So, regardless whether it's a named or numbered ACL, 00:22:22.619 --> 00:22:26.780 as I said, put the name here if it's a named ACL. But if it's a numbered ACL, 00:22:26.780 --> 00:22:31.020 go ahead and put the number in there and it'll let you edit your numbered ACL as well. 00:22:33.339 --> 00:22:36.780 And then if you ever want to add an entry, move an entry, do anything like that, well, 00:22:36.780 --> 00:22:41.660 in this case is what it looks like now. And if I want to add in this sequence, sequence number five, 00:22:41.660 --> 00:22:45.579 I put the sequence number in and I can go ahead and do that. So, sequence numbers are not something 00:22:45.579 --> 00:22:52.219 that's available with your actual numbered ACLs unless you are using named ACL configuration 00:22:52.219 --> 00:22:58.300 mode. So, named ACL, it lets you put in sequence numbers and control the order and reorder as you 00:22:58.300 --> 00:23:03.420 need to. And then, so if you want to do that with your numbered ACLs, go ahead and use named ACL 00:23:03.420 --> 00:23:07.339 configuration mode for your numbers by just typing in the number here as an example and 00:23:07.339 --> 00:23:14.780 that'll put you in the named ACL configuration mode for that numbered ACL. Let's go back to 00:23:14.780 --> 00:23:23.979 this right now and remind ourselves that order matters this way as well. So, not only does order 00:23:23.979 --> 00:23:31.500 matter this way in our ACLs, but order also matters this way. And why do I say that? I say that because 00:23:31.500 --> 00:23:38.780 of this, right? When you look at this ACL, it makes sense for all traffic that is flowing from 00:23:38.780 --> 00:23:45.979 the end users to some server, some service, or let's say the internet. That's what it makes 00:23:45.979 --> 00:23:51.020 sense because it's coming from the end user networks. What does that mean? It means that 00:23:51.420 --> 00:23:55.979 this is an ACL that I would apply either inbound here 00:23:58.699 --> 00:24:06.300 or outbound here. That's how I would apply this ACL because my destinations are always those 00:24:06.300 --> 00:24:10.939 servers, always those services in this ACL, whereas my sources are my users. 00:24:11.979 --> 00:24:18.219 What if all of this was flipped, folks? What if the sources were all the servers and services 00:24:18.219 --> 00:24:24.540 and what if the destinations were the end users? Well, that would mean that the traffic is flowing 00:24:24.540 --> 00:24:33.500 this way. And so, therefore, that ACL would be applied inbound here or outbound here. 00:24:34.219 --> 00:24:37.819 So, just another thing to keep in mind that when you're looking at the ACL, 00:24:38.540 --> 00:24:43.739 where is that network? If that network's over here and where are those networks that's over here, 00:24:44.619 --> 00:24:49.739 does that make sense? The users, is that the right ports? Is that the right services and ports for 00:24:49.739 --> 00:24:55.420 there? Yes, it is. So, it's got to be applied either traffic inbound here or outbound there. 00:24:55.979 --> 00:25:00.780 But if we had an access control list where the server addresses were first and the server port 00:25:00.780 --> 00:25:05.099 numbers were first and the destination were the clients, then it's for traffic flowing this way, 00:25:05.099 --> 00:25:10.380 which means it would have to be applied here or applied here. That's really critical because 00:25:10.380 --> 00:25:14.300 on the exam, you're at the professional level now. They're going to test you on your ability 00:25:14.300 --> 00:25:22.219 to recognize stuff like that. So, what does that mean? It means that we can apply the ACL either, 00:25:22.219 --> 00:25:29.099 this is our entire router, that's our entire router, either on our interface in the inbound 00:25:29.099 --> 00:25:35.180 direction. So, I can take that ACL and I can apply it inbound as long as it makes sense based on the 00:25:35.180 --> 00:25:42.219 entries that we have. So, entries matter up and down, but also right to left or left to right 00:25:42.219 --> 00:25:47.500 when you're looking at them. So, that way there, you are creating the ACLs that make sense for 00:25:47.500 --> 00:25:52.380 traffic flow. So, if I apply it on my interface in the inbound direction, that means when packets 00:25:52.380 --> 00:26:00.859 arrive, that ACL is now going to be checked before anything else happens. So, if there is an ACL, 00:26:00.859 --> 00:26:04.060 yes, there is. We test the statements. If not, then we just do our routing. 00:26:04.619 --> 00:26:09.260 So, let's say there is an ACL. Now, we test each statement against that traffic, 00:26:09.260 --> 00:26:12.699 top-down processing, immediate execution upon a match, plus denial at the end. 00:26:13.260 --> 00:26:16.859 So, the question is, is there a statement that matches? And if so, is it a permit? 00:26:17.579 --> 00:26:21.979 If there's no statement that matches or a statement that matches the denied, then you 00:26:21.979 --> 00:26:26.699 discard it. But if the statement that matches is a permit, now we get to do our routing. 00:26:27.260 --> 00:26:31.500 So, now that we route, is there a routing table entry? Yes or no. If there's not and there's no 00:26:31.500 --> 00:26:36.219 default route, then we discard it. But if there is an entry, regardless of whether it's a default 00:26:36.219 --> 00:26:40.619 route or some specific entry, then it's going to tell us what the outbound interface is. 00:26:40.619 --> 00:26:45.180 So, then we send it to the outbound interface. Now, at the outbound interface, we have an access 00:26:45.180 --> 00:26:49.739 controller. It's yes or no. If no, then we just simply send it out to the interface. 00:26:49.739 --> 00:26:54.540 But if there is an ACL, then we got to test the ACL statements. So, the question now is, 00:26:54.619 --> 00:26:58.219 the question now is, is based on these ACL statements, top-down processing, immediate 00:26:58.219 --> 00:27:03.819 execution upon a match and plus denial at the end, are you permitted or are you denied? So, 00:27:03.819 --> 00:27:07.579 if there's no entry, then you're automatically denied. If there's an entry that's denied, 00:27:07.579 --> 00:27:11.339 then you are denied. If there's an entry that's permit, then you're going to be allowed out that 00:27:11.339 --> 00:27:21.180 particular interface. So, how do we apply it to our interfaces? We apply it to our interfaces 00:27:21.180 --> 00:27:27.739 with the IP access group command. So, remember the VTY lines that we saw earlier today, we did 00:27:27.739 --> 00:27:35.500 the access class command. That's what we did, access class for the VTY lines. But for the 00:27:35.500 --> 00:27:43.260 interfaces, we do IP access group. And then you specify the name or the number and then the 00:27:43.260 --> 00:27:50.699 direction, in or out. So, in or out is in relation to our router. Inbound on the interface or 00:27:50.780 --> 00:28:01.420 outbound on the interface. And so, being able to orient yourself on the exam appropriately, 00:28:01.979 --> 00:28:06.459 so you can ensure that it's being applied correctly based on the entries that are in there 00:28:06.459 --> 00:28:13.660 is a critical skill to have. Also, only one ACL is allowed per protocol, per direction, 00:28:13.660 --> 00:28:20.459 per interface. What in the world does that even mean? Well, here's my router. Here's my interface. 00:28:24.140 --> 00:28:33.420 I'm allowed one ACL per protocol. So, there's IPv4 that exists. There's IPv6 that exists. 00:28:33.420 --> 00:28:42.939 Those are each protocols. So, I'm allowed one IPv4 ACL. I'm allowed one IPv6 ACL per interface. 00:28:44.060 --> 00:28:51.339 However, we got to add to that, it's per direction. So, one IPv4 ACL inbound, 00:28:51.339 --> 00:28:58.619 one IPv4 ACL outbound, one IPv6 ACL inbound, one IPv6 ACL outbound is an example 00:28:59.739 --> 00:29:07.020 on my interfaces. So, I'm actually allowed two IPv4 ACLs on each interface, 00:29:07.099 --> 00:29:13.739 one inbound, one outbound. I'm allowed two IPv6 ACLs on an interface, one inbound, 00:29:13.739 --> 00:29:19.020 one outbound. Why is that important for you to know? That is important for you to know 00:29:19.739 --> 00:29:26.300 because if on the exam there is already an existing access control list on the interface, 00:29:27.020 --> 00:29:33.420 let's say in the inbound direction, and your requirements are to make sure that you deny 00:29:33.420 --> 00:29:41.819 traffic from here to there. If you create a new access control list and apply it to the interface, 00:29:43.500 --> 00:29:47.739 that will remove the original access control list off that interface. 00:29:48.300 --> 00:29:53.099 So, even though you accomplished the objective, you destroyed the rest of the environment, 00:29:53.739 --> 00:29:59.099 which means you're wrong. So, on the exam, if there's already an access control list on the 00:29:59.099 --> 00:30:05.739 interface, you need to modify that access control list to accomplish your objective. 00:30:06.859 --> 00:30:12.380 That's why this is important to know. So, how do you check there's already an ACL on the interface? 00:30:12.380 --> 00:30:18.939 Type in show IP interface, the name, the number, and then if you go down, you'll see that they're 00:30:18.939 --> 00:30:25.739 listed right here. So, inbound access list is sales. So, there you go. We already have one called sales. 00:30:26.459 --> 00:30:33.339 So, because of that, I need to modify sales in order to meet the objections of the exam, 00:30:33.979 --> 00:30:38.619 not create a new one and apply it to the interface because if I did, that would be 00:30:38.619 --> 00:30:43.260 wrong because that would no longer be applied, which breaks something else. So, even though I 00:30:43.260 --> 00:30:47.420 accomplished the objective, I broke something else, which means I did not accomplish the objective. 00:30:48.380 --> 00:30:57.660 So, double check. And if you can't check, then that simply means that that is not a requirement 00:30:57.660 --> 00:31:03.260 you have to worry about. So, always keep that in mind too. If it's something you can't check 00:31:03.260 --> 00:31:07.979 because they're not giving you that information, then you have to assume there's no ACL on the 00:31:08.540 --> 00:31:16.540 interface. So, being able to read output like this or read output in the running config about 00:31:16.540 --> 00:31:22.540 your access control list and verify what interface they're on, what direction they're on, 00:31:23.099 --> 00:31:30.380 all important skills to have. If you ever need to remove an access control list off an interface, 00:31:30.380 --> 00:31:37.339 no IP access group. If you need to remove it off the VTY line, no access class. And then the name 00:31:37.339 --> 00:31:42.060 or number of the access control list and then the direction in or out. So, basically negate the 00:31:42.060 --> 00:31:48.219 command that you used to put it on the interface. And then if you want to delete an entire access 00:31:48.219 --> 00:31:55.260 control list, you can do that. If you want to delete an entire access control list, 00:31:55.339 --> 00:31:58.140 and then if you want to delete an entire access control list, 00:32:03.180 --> 00:32:07.819 then you can just type in no access list the number. That'll destroy your entire access 00:32:07.819 --> 00:32:12.300 control list. Or just delete a single entry and that'll destroy your entire 00:32:12.300 --> 00:32:20.140 numbered access control list as we saw earlier today. And if you want to delete a named ACL, 00:32:20.140 --> 00:32:25.180 then it's no IP access list standard or extended plus the name of the ACL. 00:32:27.579 --> 00:32:32.219 So, just some things to keep in mind while you're troubleshooting. Is the ACL logic correct? So, 00:32:32.219 --> 00:32:38.060 remember top-down processing, media execution upon a match, implicit deny all at the very end. 00:32:38.060 --> 00:32:42.699 Keep that in mind. That's going to pay dividends on the certification exam. Always remember that 00:32:42.699 --> 00:32:47.099 you got to just double check for any type of scenario. Is it applied properly? So, 00:32:47.099 --> 00:32:51.660 was it applied properly for PBR? Was it applied properly for network address translation? 00:32:51.660 --> 00:32:55.819 Is it applied properly for the directionality of the traffic flow for 00:32:55.819 --> 00:33:00.540 the ACLs for security purposes? So, if the traffic's flowing this way, 00:33:08.140 --> 00:33:14.619 do all of the entries make sense for the traffic flowing this way? The traffic's flowing this way, 00:33:14.619 --> 00:33:18.140 do all the ACL entries make sense for traffic flowing that way? 00:33:19.180 --> 00:33:25.420 And then, once you verify that, is it applied to the proper interface in the right direction? 00:33:26.219 --> 00:33:29.660 Because if it's applied to an interface outbound when it needs to be inbound, well, 00:33:29.660 --> 00:33:35.739 you got to fix that. All little things you got to keep in mind. All right. So, let's just do a 00:33:35.739 --> 00:33:41.420 simple troubleshooting scenario here, folks. This is overly simplified. Could be simple like this 00:33:41.420 --> 00:33:47.180 on the exam. It could be more complicated. But we'll see here that it simply says host 10.10.1.1 00:33:48.060 --> 00:33:56.780 has no connectivity with 10.1.1.2. So, first thing you have to do is find 10.10.1.1, find 10.1.1.2. 00:33:58.459 --> 00:34:03.260 And let's kind of get a general idea of how traffic would flow in this case. 00:34:04.219 --> 00:34:12.060 So, traffic would be flowing this way. So, that means we could be affected by an ACL inbound here, 00:34:12.060 --> 00:34:19.260 an ACL outbound here, even an ACL inbound here, or an ACL outbound there. There are four possible 00:34:19.260 --> 00:34:25.899 ACLs that could actually affect us on that router or even on this router. It tells us that there's 00:34:25.899 --> 00:34:31.179 an ACL applied here inbound. So, that's good. It narrows us down. Doesn't mean it's correct, 00:34:31.179 --> 00:34:36.699 though. Always keep that in mind. And now we can verify. That would show access list 10. 00:34:37.260 --> 00:34:43.419 And these are the three entries that we have. So, the question now is, based on what we see here, 00:34:43.419 --> 00:34:51.340 folks, why does 10.10.1.1 have no connectivity with 10.1.1.2? What's your answer? 00:34:51.820 --> 00:34:59.419 Because I see sequence number 20 actually says permit 10.10.1.1. So, we are, like, legitimately 00:34:59.979 --> 00:35:07.340 permitting 10.10.1.1. We are explicitly permitting them right here. So, I'm lost right now. I need 00:35:07.340 --> 00:35:17.340 help. Please save me, folks, from this trap I am in. Good. Yeah. So, I'm going to go ahead and 00:35:17.500 --> 00:35:28.060 from this trap I am in. Good. Yeah. So, all of you are saying we have a sequencing problem here. 00:35:28.060 --> 00:35:40.219 That's what we have. We are denying up here the entire range of IP addresses from 10.10.1.0 00:35:40.780 --> 00:35:49.659 to 10.10.1.255. As a result of that, when this traffic reaches here, 00:35:50.379 --> 00:35:57.659 our top-down processing hits sequence 10 first, and therefore that traffic is denied. 00:36:00.219 --> 00:36:06.860 So, the traffic is being denied because of sequence 10. Why? Well, it's an order of 00:36:06.860 --> 00:36:11.580 operations issue here. So, if we had to, if this was a multiple choice question, we could say 00:36:11.580 --> 00:36:16.139 sequence 10 is denying our traffic. Let's say that was the answer. But what if we had to fix 00:36:16.139 --> 00:36:20.620 the problem? Either pick the solution in the multiple choice or drag and drop the solution, 00:36:20.620 --> 00:36:24.699 or maybe this is a simulation. We actually have to type in the solution. Well, in this case, 00:36:24.699 --> 00:36:31.260 we'd have to move sequence 20 above sequence 10, right? So, this would be a good time for us to use 00:36:31.260 --> 00:36:35.659 named access control as configuration mode. So, IP access list standard 10, 00:36:36.379 --> 00:36:43.580 and then type in no 20, and then type in 5 permit 10.10.1.1. That's one solution. 00:36:43.580 --> 00:36:50.219 Or the other solution is type in no 10, and then type in 21, and type in deny 10.10.1.0, 00:36:50.219 --> 00:36:55.179 et cetera, et cetera. So, you know, different ways to solve the problem, obviously. But the idea here 00:36:55.179 --> 00:37:00.300 is to recognize that as you are preparing for the exam, as you are reviewing, remind yourself 00:37:00.300 --> 00:37:04.540 about how to look at these, how to walk through these, how would you likely fix this yourself. 00:37:04.540 --> 00:37:07.659 So, that way, you have the opportunity to do so on the certification exam. 00:37:09.659 --> 00:37:11.179 All right, what about this example here? 00:37:15.580 --> 00:37:24.139 Give me your answer in this case. 00:37:30.300 --> 00:37:50.139 Anybody see the problem yet? If you don't see the problem, put in question marks. 00:37:53.340 --> 00:37:54.780 Andrew says, hold on, hold on. 00:38:00.540 --> 00:38:18.620 So, in this case, we got 10.10.1.1, no HTTP connectivity. What does that mean? It means 00:38:19.340 --> 00:38:25.340 Cisco is actually narrowing our troubleshooting right down, right down. Like, this is great. I 00:38:25.340 --> 00:38:30.939 love it when they actually tell me which protocol, port, or service is having problems, because it 00:38:30.939 --> 00:38:34.860 allows me to narrow my focus. When I start going through a list, especially if it's a large list 00:38:35.419 --> 00:38:39.739 of IP addresses, it allows me to pick off the things that don't match really quickly. Because 00:38:39.739 --> 00:38:46.139 if we saw that it was equal to 23, or equal to 22, or equal to Telnet, or equal to different 00:38:46.139 --> 00:38:50.699 things like that, then we can immediately knock those off the list, because they don't matter. 00:38:50.699 --> 00:38:54.219 What matters is HTTP in this case. So, that's number one. I'm looking for anything that has 00:38:54.219 --> 00:39:02.060 HTTP in it, when it's all said and done. Port 80, port 443, stuff like that. So, again, our traffic 00:39:02.060 --> 00:39:07.899 is flowing this way. So, we could be inbound or outbound here, inbound or outbound here, because 00:39:07.899 --> 00:39:13.979 of bidirectional traffic flow. But in this case, 101's inbound, so we now get to narrow our attention 00:39:13.979 --> 00:39:23.580 down to 101. And when we look at sequence number 10, it says, permit TCP 10.10.1.0. Okay, that's 00:39:23.659 --> 00:39:32.300 10.10.1.0. Network, all the way to 0.0.0.0. So, 10.10.1.0 to 10.10.1.255. Okay, that matches that 00:39:32.300 --> 00:39:39.100 address. It's applied inbound here, inbound here. So, that would be the source. I like that. Okay. 00:39:39.899 --> 00:39:45.899 And then host 10.1.1.2 is the destination. So, that would be the destination. So, I like that, 00:39:45.899 --> 00:39:50.939 because that is source, that is destination. So far, so good. But then I look at that. 00:39:51.899 --> 00:40:01.260 Then I look at that. That is out of place in this case, because if this is the source, 00:40:03.500 --> 00:40:09.659 they would not be using port 80. They would be using one of those ephemeral ports. 00:40:10.620 --> 00:40:17.580 So, this needs to be changed, so it's here. That needs to be moved, so it's there. So, 00:40:17.659 --> 00:40:25.820 how do we solve this problem? Redo sequence number 10, so equal to www is at the very end. 00:40:33.820 --> 00:40:38.620 All right. You see that? So, great job. Now, pay attention, because I'm going to add on to this 00:40:39.340 --> 00:40:46.060 in my next troubleshooting scenario. What I want you to realize is, if you look right now, 00:40:47.979 --> 00:40:52.459 at this scenario, this situation, let me put that at the very end, 00:40:53.899 --> 00:40:58.860 but this entire situation has changed now, and I want you to be careful with that on 00:40:58.860 --> 00:41:04.620 the certification exam, because is it possible you could get the same image multiple times 00:41:06.139 --> 00:41:12.219 with just slightly different output and even the same answer options, 00:41:12.219 --> 00:41:16.620 but now the correct answer is different? Yes, that can totally happen. 00:41:17.820 --> 00:41:23.899 So, for example, same image, slight modifications, like what? This is where it's applied now. 00:41:24.699 --> 00:41:29.979 Notice it's inbound here. So, don't just assume that, oh, it's the same image. It must be the 00:41:29.979 --> 00:41:33.659 same question. Oh, same answer options. I must have gotten the same question twice. I'm just 00:41:33.659 --> 00:41:37.899 going to answer it the same way. No, no, no, no, no, no, no, no, no, no, no, no, no, no, no. Slow 00:41:37.899 --> 00:41:44.219 down, because now there's some slightly tiny differences that if we're not paying attention, 00:41:44.219 --> 00:41:49.500 we can miss. So, ACL's in a different direction now, but if we look at this, it says permit TCP 00:41:49.500 --> 00:41:58.219 host 10.1.1.2, right? So, that is the source now, and inbound, that makes sense. Source, 00:41:58.780 --> 00:42:06.459 source inbound, that makes sense. Destination is 10.10.1.0. Okay, that makes sense. That's 00:42:06.459 --> 00:42:13.580 my destination. So, that's good, but look, WWW's at the end this time, so don't just fall into the 00:42:13.580 --> 00:42:20.379 trap of thinking, oh, WWW's at the end. It's right. In this case, it's wrong, because the source 00:42:20.379 --> 00:42:28.459 is the server, the web server, and the web server, when responding to me, would be using what? A 00:42:28.459 --> 00:42:39.979 source port of WWW. So, that needs to be there, equal to WWW, or 80, or 443, however you have 00:42:39.979 --> 00:42:45.340 specified. HTTPS would be 443. So, that's what I want to point out to you. Just be extra careful 00:42:45.340 --> 00:42:52.060 with this stuff, folks, for the certification exam. So, if it's traffic going from you to the 00:42:52.060 --> 00:42:57.419 server, right, how does it have to look? If it's traffic, return traffic from the server back to 00:42:57.419 --> 00:43:08.860 you, how does it have to look in order to get the job done? And our BTY lines again. So, earlier 00:43:08.860 --> 00:43:15.500 today, you saw me create an access control list on my BTY lines, and I applied it using the access 00:43:15.500 --> 00:43:21.899 class command inbound, but I want to show you here the power of this log keyword if you've never seen 00:43:21.899 --> 00:43:26.699 it, but you've got to be careful with it, because the log keyword requires the CPU to get involved 00:43:26.699 --> 00:43:31.979 with processing the access control list, and so you don't want to use this for every single access 00:43:31.979 --> 00:43:37.739 control entry. It doesn't make sense to log everything, but it does make sense to log, for 00:43:37.739 --> 00:43:47.659 example, any denies on your BTY lines. Why is that? Because if this user is trying to log into my 00:43:47.659 --> 00:43:55.580 BTY line for management purposes, their address is going to be denied, because they are not part of 00:43:55.580 --> 00:44:02.540 my management subnet. My management subnet is permitted, everybody else is denied, but I'm also 00:44:03.179 --> 00:44:11.899 logging those denies. Why is that a good thing in this case? Because I will then have log messages 00:44:11.899 --> 00:44:18.379 generated, and it'll tell me the IP address of whoever tried to access that device. 00:44:23.179 --> 00:44:28.459 And if I also wanted to know the input interface, we could go ahead and log that as well, 00:44:29.340 --> 00:44:33.580 which is the BTY line, so it's not that big of a deal in this scenario. 00:44:36.459 --> 00:44:41.979 But that's just to give you an idea of the power of the log option, so any scenario on the exam 00:44:41.979 --> 00:44:49.820 that talks about you wanting to keep track, or be notified, or have syslog messages generated 00:44:49.820 --> 00:44:56.139 for certain ACL entries, then the log keyword is the one that is going to be the correct answer for 00:44:57.020 --> 00:45:06.939 you. All right, so I have you covered now, folks, for access control lists when it comes to extended 00:45:06.939 --> 00:45:08.060 and standard.