WEBVTT 00:00:01.000 --> 00:00:05.000 Alright, so let's now move into Access Control Lists. 00:00:05.000 --> 00:00:10.000 And as I've mentioned a few times in this course, your Access Control Lists, 00:00:10.000 --> 00:00:15.000 your knowledge of Access Control Lists is going to be critical for your success on the certification exam. 00:00:15.000 --> 00:00:17.000 And the reason why is you always have to remember this. 00:00:17.000 --> 00:00:23.000 Access Control Lists are purely a tool, a feature that we have 00:00:23.000 --> 00:00:32.000 that gives us the opportunity to identify things like source IPs, destination IPs, 00:00:32.000 --> 00:00:41.000 source ports, destination ports, transport layer protocols, or just any type of protocol, 00:00:41.000 --> 00:00:47.000 quality of service markings, as well as certain TCP flags, and so on and so forth. 00:00:47.000 --> 00:00:51.000 So ACLs are all about what? They're all about traffic identification. 00:00:51.000 --> 00:01:00.000 So anytime you have a service, a feature in use that requires you to differentiate different types of traffic, 00:01:00.000 --> 00:01:04.000 you're going to need an Access Control List in order to accomplish that. 00:01:04.000 --> 00:01:10.000 So for example, with network address translation, how do you define who's allowed to be network address translated? 00:01:10.000 --> 00:01:12.000 Access Control List. 00:01:12.000 --> 00:01:19.000 With a traffic filter, how do you define what traffic is going to be permitted or denied through that router? 00:01:19.000 --> 00:01:21.000 With an Access Control List. 00:01:21.000 --> 00:01:28.000 With quality of service, how do you identify, or I should say classify, different types of traffic? 00:01:28.000 --> 00:01:33.000 How do you classify it as voice versus video versus data versus this versus that? 00:01:33.000 --> 00:01:36.000 Again, you can use Access Control Lists for that. 00:01:36.000 --> 00:01:41.000 When it comes to policy-based routing, when we did our demonstration, what did we use? 00:01:41.000 --> 00:01:43.000 Access Control Lists. 00:01:44.000 --> 00:01:51.000 Even with route filters, like a distribute list, the EIGRP, you could use Access Control Lists if you want to. 00:01:51.000 --> 00:01:55.000 Prefix lists are better, but you can still use Access Control Lists. 00:01:55.000 --> 00:01:57.000 And the list goes on and on, folks. 00:01:57.000 --> 00:02:03.000 So as you can see, the Access Control List is really just about identifying things, 00:02:03.000 --> 00:02:07.000 and then how you apply it ultimately determines what it's being used for. 00:02:07.000 --> 00:02:12.000 So oftentimes in the security world, you hear Access Control Lists, security features, security. 00:02:12.000 --> 00:02:14.000 Well, yeah, it's one thing it can do. 00:02:14.000 --> 00:02:16.000 That's if you apply it as a security feature. 00:02:16.000 --> 00:02:19.000 But if you don't apply it as a security feature, you can use it for other things. 00:02:19.000 --> 00:02:26.000 But in this case, for this exam, we really are using it and going to be tested on it in multiple ways. 00:02:26.000 --> 00:02:29.000 So we already saw how we could use it for policy-based routing. 00:02:29.000 --> 00:02:30.000 Make sure you know that. 00:02:30.000 --> 00:02:32.000 We've already seen how you can use it for network access translation. 00:02:32.000 --> 00:02:33.000 Make sure you know that. 00:02:33.000 --> 00:02:37.000 So anytime we brought up Access Control Lists in this course, 00:02:37.000 --> 00:02:40.000 make sure you understand the Access Control Lists from that perspective. 00:02:40.000 --> 00:02:44.000 Now we're going to focus on it from a traffic filtering standpoint. 00:02:44.000 --> 00:02:51.000 So how can I apply it to permit or deny traffic as it's flowing through my environment? 00:02:51.000 --> 00:02:55.000 So regardless of whether we use it for traffic filter or anything else, what do we have? 00:02:55.000 --> 00:02:57.000 We have an Access Control List. 00:02:57.000 --> 00:02:59.000 Think of it like a clipboard. 00:02:59.000 --> 00:03:03.000 And then on that clipboard, you have a whole bunch of permit and deny statements. 00:03:03.000 --> 00:03:05.000 And the permit or deny statements are going to be all – 00:03:05.000 --> 00:03:08.000 what they do is ultimately dependent on what you apply it to. 00:03:08.000 --> 00:03:11.000 So whether it's for network access translation or quality of service 00:03:11.000 --> 00:03:14.000 or policy-based routing or traffic filtering, 00:03:14.000 --> 00:03:17.000 ultimately determines what permit or deny means when it's all said and done. 00:03:17.000 --> 00:03:21.000 So for this discussion on traffic filtering, permit means allow the traffic. 00:03:21.000 --> 00:03:23.000 Deny means drop the traffic. 00:03:23.000 --> 00:03:25.000 That's essentially what it means. 00:03:25.000 --> 00:03:28.000 And so when you think about it from that perspective, 00:03:28.000 --> 00:03:32.000 we are dealing legitimately with a type of clipboard, 00:03:32.000 --> 00:03:37.000 something that is going to control access to or from the environment 00:03:37.000 --> 00:03:42.000 through or not through an actual device. 00:03:42.000 --> 00:03:46.000 So when we look at our Avengers Headquarters here, 00:03:46.000 --> 00:03:50.000 we have an Access Control List, who's allowed in Avengers Headquarters 00:03:50.000 --> 00:03:53.000 versus who's not allowed in Avengers Headquarters. 00:03:53.000 --> 00:03:56.000 So you can see we have a list that starts at the top here. 00:03:56.000 --> 00:04:01.000 Obviously, Tony's first because, you know, he cries when he's not first. 00:04:01.000 --> 00:04:04.000 And then we have Steve's second because, you know, he's Captain America. 00:04:05.000 --> 00:04:09.000 So he's going to be right near the top, but Tony always trumps Steve. 00:04:09.000 --> 00:04:12.000 But then we go down our list, and you'll see some are permit, some are deny, 00:04:12.000 --> 00:04:16.000 some are permit, some are denies, and so on and so forth. 00:04:16.000 --> 00:04:21.000 And what we need to recognize is that when this list is being processed, 00:04:21.000 --> 00:04:26.000 it's going to be processed from the top of the list to the bottom of the list, 00:04:26.000 --> 00:04:30.000 which means smallest number to largest number. 00:04:30.000 --> 00:04:34.000 So we're going to start up here, and we're going to work our way down. 00:04:34.000 --> 00:04:39.000 So let's pretend right now that Thor shows up at the door, 00:04:39.000 --> 00:04:43.000 and Thor bangs his mighty hammer on the door. 00:04:43.000 --> 00:04:46.000 And what's going to happen, folks? 00:04:46.000 --> 00:04:50.000 Is Thor going to be permitted, or is Thor going to be denied? 00:04:50.000 --> 00:04:53.000 Well, let's start at the top, folks. 00:04:53.000 --> 00:04:58.000 Top-down processing and work our way down until we find a match for Thor. 00:04:58.000 --> 00:05:00.000 Do we have a match for Thor? 00:05:00.000 --> 00:05:02.000 I think we do. 00:05:02.000 --> 00:05:04.000 Sequence number four is a match. 00:05:04.000 --> 00:05:10.000 So, folks, is Thor permitted or denied from entering the building? 00:05:14.000 --> 00:05:19.000 It's important you realize that we immediately execute upon a match. 00:05:19.000 --> 00:05:21.000 You see that? 00:05:21.000 --> 00:05:23.000 So what does that mean? 00:05:23.000 --> 00:05:28.000 It means that when we find our match, we stop. 00:05:28.000 --> 00:05:34.000 And once we stop, we execute exactly what it says. 00:05:34.000 --> 00:05:37.000 In this case, Thor is denied. 00:05:37.000 --> 00:05:42.000 Now, why is this so critical to understand, and why am I presenting it to you this way? 00:05:42.000 --> 00:05:44.000 One, because a lot of people are MCU fans. 00:05:44.000 --> 00:05:49.000 But two, I want you to keep going down this list. 00:05:49.000 --> 00:05:55.000 Is there another entry, folks, that Thor matches, yes or no? 00:06:00.000 --> 00:06:04.000 John says all original Avengers. 00:06:04.000 --> 00:06:05.000 Yeah, exactly, John. 00:06:05.000 --> 00:06:08.000 So this one as well. 00:06:08.000 --> 00:06:12.000 And this is why step two is so critical. 00:06:12.000 --> 00:06:19.000 Because if Thor is an original Avenger, look, it says permit. 00:06:19.000 --> 00:06:28.000 That means Thor is allowed in the building if sequence number six was executed. 00:06:30.000 --> 00:06:39.000 So we need rules in place to make sure that the order of processing functions as we need it to. 00:06:39.000 --> 00:06:42.000 So the rules are top-down processing. 00:06:42.000 --> 00:06:46.000 And then as soon as you find a match, stop and execute. 00:06:46.000 --> 00:06:48.000 The rest don't matter. 00:06:48.000 --> 00:06:53.000 So in this scenario, none of this matters now. 00:06:53.000 --> 00:06:57.000 And if we didn't have this rule in place, then we'd have a conflict. 00:06:57.000 --> 00:07:01.000 Because four and six would be in conflict with each other. 00:07:01.000 --> 00:07:09.000 Also, this is imperative because if the order is wrong, you can really see how we could be messed up. 00:07:09.000 --> 00:07:15.000 Because now in this case, folks, is Thor permitted or is Thor denied? 00:07:15.000 --> 00:07:20.000 Well, if we were just looking for Thor, we would see that Thor is denied. 00:07:20.000 --> 00:07:23.000 But wait, is Thor really denied, yes or no? 00:07:23.000 --> 00:07:24.000 Let me know. 00:07:25.000 --> 00:07:27.000 Thor is permitted. 00:07:27.000 --> 00:07:30.000 Exactly, John, why? 00:07:30.000 --> 00:07:32.000 All original Avengers say permit. 00:07:32.000 --> 00:07:36.000 Thor belongs to that group. 00:07:36.000 --> 00:07:45.000 Since Thor belongs to that group, top-down processing, immediate execution upon a match, Thor is permitted. 00:07:45.000 --> 00:07:50.000 Even though the next entry right after that says deny, it doesn't matter. 00:07:50.000 --> 00:07:52.000 And that is what you have to be careful about. 00:07:52.000 --> 00:07:59.000 And that is what you have to be careful of on this certification exam for any question that has an ACL in it. 00:07:59.000 --> 00:08:02.000 It doesn't matter what the question is about. 00:08:02.000 --> 00:08:06.000 It could be about NAT, policy-based routing, traffic filtering, anything. 00:08:06.000 --> 00:08:13.000 You have to remember that the ACL could be the reason why that feature is not working. 00:08:13.000 --> 00:08:17.000 And it could be as simple as they have the order incorrect on you. 00:08:18.000 --> 00:08:22.000 So being able to read an ACL is critical for your success on the certification exam. 00:08:22.000 --> 00:08:28.000 In addition, don't forget that at the very bottom, we have the implicit deny all. 00:08:28.000 --> 00:08:29.000 It's right here. 00:08:29.000 --> 00:08:30.000 You see it? 00:08:30.000 --> 00:08:31.000 You see it? 00:08:31.000 --> 00:08:32.000 No, you can't. 00:08:32.000 --> 00:08:33.000 You can't see it. 00:08:33.000 --> 00:08:34.000 It's not there. 00:08:34.000 --> 00:08:36.000 It's implicit deny all. 00:08:36.000 --> 00:08:37.000 It's invisible. 00:08:37.000 --> 00:08:38.000 It doesn't exist. 00:08:38.000 --> 00:08:40.000 But it's there. 00:08:40.000 --> 00:08:45.000 Meaning that if you're not on the list, you're not getting in. 00:08:46.000 --> 00:08:54.000 Whenever I provide this discussion, I always think of Stanley Ipkiss. 00:08:54.000 --> 00:08:58.000 Does anybody remember poor Stanley Ipkiss? 00:09:00.000 --> 00:09:03.000 Let's see how many of you are old enough to know what I'm talking about. 00:09:05.000 --> 00:09:06.000 Yes! 00:09:06.000 --> 00:09:13.000 Jim Carrey's character in the movie The Mask in 1994 with Cameron Diaz. 00:09:14.000 --> 00:09:15.000 I think it was 1994. 00:09:15.000 --> 00:09:16.000 I think it might have been 92. 00:09:16.000 --> 00:09:18.000 I think it was 94 though. 00:09:20.000 --> 00:09:24.000 Before he puts on the mask, his character is Stanley Ipkiss. 00:09:27.000 --> 00:09:32.000 He goes to the Coco Bongo Club and he's not allowed to get in the club. 00:09:32.000 --> 00:09:33.000 Why? 00:09:33.000 --> 00:09:34.000 He's not on the list. 00:09:34.000 --> 00:09:35.000 He's not cool enough. 00:09:35.000 --> 00:09:36.000 He's not popular enough. 00:09:36.000 --> 00:09:37.000 Whatever. 00:09:37.000 --> 00:09:38.000 It doesn't matter. 00:09:38.000 --> 00:09:39.000 He's just not on the list. 00:09:40.000 --> 00:09:46.000 Stanley Ipkiss got hit by the implicit denial rule because he just simply wasn't on the list. 00:09:48.000 --> 00:09:53.000 He puts on the mask and he shows up with a bunch of Benjamins in his hands and starts tossing them around. 00:09:53.000 --> 00:09:55.000 Of course, he gets into the Coco Bongo Club that way. 00:09:57.000 --> 00:09:58.000 Thanos showed up. 00:09:58.000 --> 00:10:00.000 If you're an MCU fan, Thanos shows up. 00:10:00.000 --> 00:10:01.000 Thanos, you're not on the list. 00:10:01.000 --> 00:10:02.000 I'm sorry. 00:10:02.000 --> 00:10:03.000 You're not getting in. 00:10:03.000 --> 00:10:06.000 I don't care if you have the Infinity Gauntlet on your hand. 00:10:06.000 --> 00:10:07.000 It doesn't matter. 00:10:07.000 --> 00:10:08.000 I don't care if you have all the stones. 00:10:08.000 --> 00:10:09.000 You're not getting in. 00:10:09.000 --> 00:10:10.000 I'm sorry. 00:10:10.000 --> 00:10:12.000 He can brute force his way in, but still. 00:10:12.000 --> 00:10:14.000 The idea is implicit denial at the very end. 00:10:14.000 --> 00:10:15.000 You're not getting in. 00:10:15.000 --> 00:10:16.000 It's that simple. 00:10:19.000 --> 00:10:20.000 Order of operations. 00:10:20.000 --> 00:10:21.000 This is another way to view this here. 00:10:21.000 --> 00:10:26.000 You've got your incoming traffic or your outgoing traffic on your router interfaces. 00:10:27.000 --> 00:10:35.000 As a result of that with your ACLs, for traffic filtering standpoint, if traffic arrives in on an interface or is leaving an interface and there's an ACL on that interface, 00:10:36.000 --> 00:10:39.000 the question is, does that traffic match any of our entries? 00:10:40.000 --> 00:10:43.000 If it does match, we stop, and then we do what it says. 00:10:43.000 --> 00:10:44.000 Permit or deny. 00:10:44.000 --> 00:10:46.000 If it doesn't match, then we go to the next one. 00:10:47.000 --> 00:10:48.000 If that one doesn't match, we go to the next one. 00:10:48.000 --> 00:10:50.000 If that one doesn't match, we go to the next one. 00:10:50.000 --> 00:10:51.000 If that one doesn't match, we go to the next one. 00:10:52.000 --> 00:10:55.000 If you don't match each entry, you keep going. 00:10:55.000 --> 00:10:56.000 Keep going. 00:10:56.000 --> 00:10:57.000 Keep going. 00:10:57.000 --> 00:10:58.000 Then if you find a match, you stop. 00:10:58.000 --> 00:10:59.000 You execute. 00:11:00.000 --> 00:11:03.000 If you don't find anything, you get to the very bottom, and you're automatically denied. 00:11:06.000 --> 00:11:09.000 Critical for your exam success. 00:11:09.000 --> 00:11:10.000 That's why we go over this. 00:11:11.000 --> 00:11:16.000 When you look at this video access control list, if this is what I was showing on the certification exam, what does this do? 00:11:16.000 --> 00:11:27.000 This permits and allows every single private IP address from the RFC 1918 address spaces and denies everything else. 00:11:27.000 --> 00:11:38.000 Even though it doesn't say denies everything else, you have to recognize that it is denying everything else because there's nothing else listed there. 00:11:39.000 --> 00:11:42.000 If we look here, we'll see that it's applied to this particular interface. 00:11:43.000 --> 00:11:50.000 As traffic arrives inbound on this interface, this is my router. 00:11:51.000 --> 00:11:53.000 This is my interface. 00:11:53.000 --> 00:11:54.000 That's inbound. 00:11:54.000 --> 00:12:00.000 When it arrives in on that interface, then this access control list gets applied. 00:12:00.000 --> 00:12:06.000 In this case, if the source of the traffic is within that range, you are permitted. 00:12:06.000 --> 00:12:09.000 If it's outside of that range, you are denied. 00:12:13.000 --> 00:12:16.000 We have two types of ACLs we need to be aware of. 00:12:16.000 --> 00:12:21.000 We need standard IPv4 ACLs. 00:12:21.000 --> 00:12:24.000 We have extended IPv4 ACLs. 00:12:26.000 --> 00:12:29.000 Standard only filters based on the source IP address. 00:12:29.000 --> 00:12:30.000 It's a great way to remember that. 00:12:30.000 --> 00:12:31.000 S and S. 00:12:31.000 --> 00:12:33.000 Source of the IP address. 00:12:33.000 --> 00:12:39.000 These access control lists are typically very simple, very easy to implement. 00:12:40.000 --> 00:12:46.000 Basically, you're just specifying, hey, if the source IP of the packet matches this range, then you're permitted or you're denied. 00:12:46.000 --> 00:12:47.000 What have you specified? 00:12:47.000 --> 00:12:49.000 It's not very granular control in this case. 00:12:49.000 --> 00:12:53.000 Whereas, if you need granular control, you've got to go for your extended access control list. 00:12:53.000 --> 00:12:58.000 Your extended access control list, we can filter based on our source address. 00:12:58.000 --> 00:13:00.000 We can filter based on our destination address. 00:13:00.000 --> 00:13:03.000 We can filter based on source ports and destination ports. 00:13:03.000 --> 00:13:15.000 We can filter based on protocol types like TCP versus UDP versus EIGRP versus OSPF versus ICMP versus IGMP versus GRE versus ESP versus AH, right? 00:13:15.000 --> 00:13:21.000 Different types of protocols that exist or even just all IP traffic when it's all said and done. 00:13:21.000 --> 00:13:25.000 And then even quality of service markings can come into play here. 00:13:25.000 --> 00:13:30.000 Various TCP flags or whether the TCP session is established or not established. 00:13:30.000 --> 00:13:36.000 There's a lot of different things you can match on in an access control list when you're using an extended ACL. 00:13:36.000 --> 00:13:42.000 Now, when it comes to IPv4 standard and extended ACLs, there's two different ways we can identify them, which just frustrates me to no end. 00:13:42.000 --> 00:13:47.000 And that is via numbers or via names. 00:13:47.000 --> 00:13:49.000 Via numbers or via names. 00:13:49.000 --> 00:13:55.000 So, numbering-wise, this is your numbering scheme for standard ACLs. 00:13:55.000 --> 00:13:57.000 This is your numbering scheme for extended ACLs. 00:13:57.000 --> 00:14:01.000 And if you're using named ACLs where you don't provide numbers, you just simply give it a name. 00:14:01.000 --> 00:14:09.000 And so, the numbering scheme helps the router understand whether it should give you standard syntax or extended syntax. 00:14:09.000 --> 00:14:14.000 So, if I create an access control list and number it five, it's going to be standard syntax. 00:14:14.000 --> 00:14:18.000 If I number it 105, then it's going to give me extended syntax. 00:14:19.000 --> 00:14:28.000 Whereas down here when we're using named, I actually have to tell the router whether it's a standard one I'm creating or whether it's an extended one I'm creating in my configuration. 00:14:28.000 --> 00:14:31.000 And so, if I specify standard, then it gives me standard syntax. 00:14:31.000 --> 00:14:34.000 If I specify extended, then it gives me extended syntax. 00:14:34.000 --> 00:14:44.000 So, here's an example of creating an entry, a single entry for an access control list that is a standard numbered ACL. 00:14:45.000 --> 00:14:51.000 So, access list in global configuration mode, followed by the number, followed by permit or deny, followed by your IP source range. 00:14:53.000 --> 00:15:00.000 So, in this case, if we just go to router number five in this example, configure terminal, and we type in access list, we give it access list number five. 00:15:00.000 --> 00:15:02.000 Do I already have access list five on there? 00:15:09.000 --> 00:15:11.000 I actually do from earlier, remember? 00:15:11.000 --> 00:15:12.000 We were using it. 00:15:12.000 --> 00:15:13.000 All right. 00:15:13.000 --> 00:15:15.000 So, let's save an access hyphen list. 00:15:15.000 --> 00:15:18.000 We'll go with, what do we got, 540. 00:15:18.000 --> 00:15:19.000 Let's just do 10. 00:15:19.000 --> 00:15:27.000 So, access list 10, and then you'll see that you've got your permit, your deny, or even a remark to make a comment to give it a description. 00:15:27.000 --> 00:15:29.000 So, let's just simply say permit in this particular example. 00:15:29.000 --> 00:15:34.000 And then if I type in something like host, that means this exact host IP address. 00:15:34.000 --> 00:15:38.000 So, let's just say 10.40.23.10 as an example. 00:15:39.000 --> 00:15:45.000 Now, if I wanted to create another entry within the same one, then you just simply type in access list again. 00:15:45.000 --> 00:15:48.000 You type in 10, and then let's say it's permit. 00:15:48.000 --> 00:15:54.000 And let's say instead of permitting a specific host, we want to specify an addressing space, a range. 00:15:54.000 --> 00:16:03.000 So, let's do something like 10.40.12.0, and then 0.0.0. 00:16:03.000 --> 00:16:05.000 So, this is a wildcard mask. 00:16:05.000 --> 00:16:10.000 And in this case, it's going to be 61.31. 00:16:14.000 --> 00:16:16.000 Nope. 00:16:16.000 --> 00:16:19.000 I want 63 instead. 00:16:19.000 --> 00:16:20.000 That's what I wanted. 00:16:20.000 --> 00:16:29.000 And I'm doing this on purpose here now because I want to show you if I type in do show access list, it didn't delete or erase what I did before. 00:16:32.000 --> 00:16:34.000 It just simply added another one. 00:16:34.000 --> 00:16:41.000 As you can see, every time you do it, every time you do it, you're just adding, adding, adding, adding, adding, adding, adding to that list. 00:16:44.000 --> 00:16:50.000 If you want to do a specific deny, you can go ahead and do a specific deny if you want by just putting in the deny parameter. 00:16:53.000 --> 00:16:54.000 But that's all. 00:16:54.000 --> 00:16:56.000 You create it in global configuration mode. 00:16:56.000 --> 00:17:01.000 So, do show run pipe to section access list with these commands. 00:17:05.000 --> 00:17:08.000 And the order you create them in is the order they show up. 00:17:12.000 --> 00:17:16.000 And then you have your named standard access control list. 00:17:16.000 --> 00:17:21.000 So, with named standard access control list, you're going to type in IP access list first instead. 00:17:22.000 --> 00:17:25.000 And then you specify that you want a standard access control list. 00:17:26.000 --> 00:17:29.000 And then you're going to specify the name of that access control list. 00:17:35.000 --> 00:17:41.000 And now you're in a special configuration mode for standard named access control list configuration mode. 00:17:42.000 --> 00:17:48.000 So, again, just like before, we could type in permit and dump this in. 00:17:49.000 --> 00:17:50.000 We can type this in. 00:17:51.000 --> 00:17:56.000 So, basically, you're doing the same thing, but you don't specify everything else in front of it because that stuff doesn't matter. 00:17:56.000 --> 00:18:12.000 And so, if I type in do show access hyphen list 10 and do show access list on core standard, you'll see they're the same for this demonstration. 00:18:12.000 --> 00:18:23.000 But what I want to point out to you now is that with standard access control list, pardon me, with numbered access control list, you can't really edit them. 00:18:23.000 --> 00:18:24.000 That's right, you can't really edit them. 00:18:25.000 --> 00:18:26.000 Let's go ahead and try and edit this one. 00:18:27.000 --> 00:18:28.000 So, let's do a do show run. 00:18:30.000 --> 00:18:31.000 Go global configuration mode. 00:18:31.000 --> 00:18:32.000 Do show run. 00:18:34.000 --> 00:18:35.000 Pipe to section. 00:18:36.000 --> 00:18:37.000 Access. 00:18:39.000 --> 00:18:41.000 So, these are the three access control lists here. 00:18:42.000 --> 00:18:46.000 So, folks, how do you typically delete something in your config that you don't want anymore? 00:18:47.000 --> 00:18:48.000 You would type a no. 00:18:49.000 --> 00:18:50.000 And then you would put it in. 00:18:50.000 --> 00:18:51.000 There you go. 00:18:51.000 --> 00:18:52.000 Deleted, right? 00:18:52.000 --> 00:18:54.000 Okay, let's take a look at our running config now. 00:18:56.000 --> 00:18:57.000 Oops. 00:18:57.000 --> 00:18:58.000 Okay, where's the other ones? 00:18:59.000 --> 00:19:00.000 Where's the other ones? 00:19:04.000 --> 00:19:05.000 They're all gone, eh? 00:19:06.000 --> 00:19:09.000 Do show access list 10. 00:19:11.000 --> 00:19:12.000 I deleted the whole thing. 00:19:13.000 --> 00:19:14.000 I deleted the whole thing. 00:19:15.000 --> 00:19:16.000 So, you can't edit them. 00:19:16.000 --> 00:19:17.000 I deleted the whole thing. 00:19:18.000 --> 00:19:19.000 I deleted the whole thing. 00:19:20.000 --> 00:19:23.000 So, you can't edit your numbered access control list. 00:19:25.000 --> 00:19:26.000 How would you edit them? 00:19:26.000 --> 00:19:33.000 Well, the old school way is to copy and paste your access control list into notepad, make the changes you want, 00:19:34.000 --> 00:19:39.000 then delete the access control list and copy and paste the new one onto the device. 00:19:42.000 --> 00:19:44.000 How many of you have ever had to do it that way? 00:19:45.000 --> 00:19:46.000 It's no fun. 00:19:46.000 --> 00:19:47.000 It's no fun. 00:19:50.000 --> 00:19:52.000 All right, let me just put it back in right now. 00:19:53.000 --> 00:19:59.000 Let me show you a way that we can edit named access control lists. 00:20:00.000 --> 00:20:02.000 That's the power of your named access control list. 00:20:03.000 --> 00:20:08.000 So, right now, if I type in do show access-list. 00:20:11.000 --> 00:20:12.000 And what was it called again? 00:20:12.000 --> 00:20:15.000 Encore standard, right? 00:20:16.000 --> 00:20:19.000 What we could do is we could go back into the configuration mode. 00:20:19.000 --> 00:20:25.000 So, we could type in ip access-list standard encore standard. 00:20:26.000 --> 00:20:28.000 And what I can do is I can do something like this, no 10. 00:20:30.000 --> 00:20:34.000 So, by typing in no 10, what does that do for me? 00:20:34.000 --> 00:20:35.000 What does that do for me? 00:20:36.000 --> 00:20:43.000 Typing in no 10, I can just get rid of that one entry and that doesn't affect the whole access list. 00:20:44.000 --> 00:20:54.000 So, using named access lists gives you a lot more flexibility when it comes to configuration and editing and all that stuff. 00:20:55.000 --> 00:21:02.000 And so, now if I want to apply something in somewhere else, you could specify the sequence number where you want it to go. 00:21:02.000 --> 00:21:05.000 So, for example, let's say I type in sequence number 27. 00:21:06.000 --> 00:21:09.000 And let's say I want to deny a specific address. 00:21:10.000 --> 00:21:20.000 Let's go ahead and say we're going to deny 10.40.13.00.00. 00:21:23.000 --> 00:21:24.000 Let's do that. 00:21:27.000 --> 00:21:28.000 Right, there you go. 00:21:29.000 --> 00:21:30.000 You see how I was able to put it in there? 00:21:30.000 --> 00:21:34.000 And let's say we want to go ahead and add that other one in we took out. 00:21:35.000 --> 00:21:38.000 But we want to, instead of having it sequence 10, I want to have it sequence 5. 00:21:39.000 --> 00:21:47.000 So, you have a lot of flexibility here when it comes to editing your access control list without having to use notepad and copying and pasting and destroying the whole ACL. 00:21:48.000 --> 00:21:49.000 So, what does that mean? 00:21:50.000 --> 00:21:54.000 It means you can do the same thing with your numbered ACLs. 00:21:55.000 --> 00:21:59.000 So, let's type in do show access-list number 10 in this case. 00:22:00.000 --> 00:22:07.000 What I'm going to show you now is what if I type in IP access-list standard, but just put in the number 10. 00:22:09.000 --> 00:22:11.000 So, our Cisco iOS devices let us do this. 00:22:12.000 --> 00:22:23.000 So, if I wanted to say no 20, like we wanted to delete this one before, but it deleted the whole ACL, well now it only deletes that one entry. 00:22:24.000 --> 00:22:36.000 So, I encourage you, even if you have numbered ACLs nowadays, use the named ACL configuration mode syntax in order to work with your numbered ACLs. 00:22:36.000 --> 00:22:52.000 This is going to allow you to do the changes you need without having to copy and paste and doing everything else you want to do outside of the actual iOS environment. 00:22:53.000 --> 00:22:54.000 So, just something to keep in mind. 00:22:56.000 --> 00:23:05.000 So, now that we've got some of that stuff out of the way, let's talk about the elephant in the room, and that is the wildcard mask. 00:23:06.000 --> 00:23:11.000 How many of you feel comfortable with the wildcard mask that you don't need to have a conversation with me about it? 00:23:12.000 --> 00:23:13.000 Anybody here? 00:23:21.000 --> 00:23:22.000 Andrew wants to skip it? 00:23:24.000 --> 00:23:25.000 Anybody else? 00:23:26.000 --> 00:23:27.000 I can't skip it. 00:23:28.000 --> 00:23:29.000 Alright, here's the deal. 00:23:30.000 --> 00:23:41.000 If you can't read wildcard masks, you will bomb every question, bomb every question on the exam that has access control lists in it. 00:23:42.000 --> 00:23:49.000 So, my goal today is to teach you how to shortcut your success on the certification exam. 00:23:50.000 --> 00:23:51.000 That's my goal, because you can't waste time. 00:23:52.000 --> 00:23:57.000 On average, Cisco says you should be able to answer every question in a minute 15 seconds, on average. 00:23:58.000 --> 00:24:04.000 So, an ACL question should take you a little longer, obviously, than some of the other ones, but on average, a minute 15. 00:24:05.000 --> 00:24:09.000 Well, the only way to average that out, including with access control, is to have shortcuts at your disposal. 00:24:10.000 --> 00:24:15.000 So, let's go ahead and teach you how to understand what a wildcard mask is, but then I'll show you how to shortcut it. 00:24:16.000 --> 00:24:18.000 And on the exam, the shortcuts will work. 00:24:18.000 --> 00:24:20.000 Like 99.8% of the time. 00:24:21.000 --> 00:24:22.000 Those are odds I like. 00:24:23.000 --> 00:24:26.000 Go with them, and you're going to have no problems on the exam being successful. 00:24:29.000 --> 00:24:31.000 So, what is a wildcard mask? 00:24:32.000 --> 00:24:36.000 Okay, so the wildcard mask, as we talked about, remember in OSPF, with the network command? 00:24:49.000 --> 00:24:56.000 The wildcard mask on Cisco IOS, as we talked about, with the network command for OSPF, is to do what? 00:24:57.000 --> 00:25:02.000 Identify all of the IP addresses that must match. 00:25:03.000 --> 00:25:04.000 That's it. 00:25:05.000 --> 00:25:16.000 So, in this case, this example here says, all IP addresses from 10.1.1.0 through 10.1.1.255. 00:25:16.000 --> 00:25:17.000 That's all that means. 00:25:18.000 --> 00:25:19.000 That's all that means. 00:25:20.000 --> 00:25:21.000 It doesn't mean anything else. 00:25:22.000 --> 00:25:34.000 The combination of these two values is to define a range of IP addresses to match. 00:25:37.000 --> 00:25:39.000 Define a range of IP addresses to match. 00:25:40.000 --> 00:25:42.000 Now, I know it looks like a backwards subnet mask. 00:25:43.000 --> 00:25:45.000 It looks like an inverted subnet mask, but it's not. 00:25:46.000 --> 00:25:51.000 It has a completely different purpose, and it works totally different than a subnet mask. 00:25:54.000 --> 00:26:03.000 So, a question is, is it fair to say that they are used to indicate the size of network address spaces when the masks don't need to be contiguous? 00:26:04.000 --> 00:26:10.000 No, no, because they have to be contiguous, or it doesn't work. 00:26:11.000 --> 00:26:20.000 And if you want to match network spaces that are not contiguous, then yes, you can do that with a wildcard mask. 00:26:21.000 --> 00:26:23.000 So, let's go back and let's look at what you said again. 00:26:24.000 --> 00:26:30.000 So, you said, is it fair to say that they are used to indicate the size of a network address space when the masks don't need to be contiguous? 00:26:31.000 --> 00:26:35.000 So, we'll say that is sort of true. 00:26:36.000 --> 00:26:37.000 That is sort of correct. 00:26:37.000 --> 00:26:39.000 Because it's not about, one, the masks. 00:26:40.000 --> 00:26:42.000 It's not about the masks at all. 00:26:43.000 --> 00:26:44.000 It's about the addressing space. 00:26:45.000 --> 00:26:47.000 So, it doesn't matter what subnet masks are. 00:26:48.000 --> 00:26:52.000 It matters what are all of the addresses we want to match. 00:26:53.000 --> 00:27:01.000 And so, the easiest and simplest way to do that is with contiguous IP addresses, regardless of what the subnets are. 00:27:02.000 --> 00:27:20.000 So, for example, if I wanted to match 10.0.0.0 to 10.255.255.255, that would be every single IP address from 10.0.0.0 to 10.255.255, right? 00:27:21.000 --> 00:27:22.000 And that would be, it doesn't matter what the subnet is. 00:27:23.000 --> 00:27:25.000 So, I've got an example of that because of yesterday. 00:27:26.000 --> 00:27:34.000 If we go back to R1 from yesterday, we have an access list on R1, remember? 00:27:35.000 --> 00:27:37.000 And this access list was from what? 00:27:38.000 --> 00:27:45.000 This access list right here, we created for the IPsec VPN. 00:27:46.000 --> 00:28:05.000 So, when you look at 10.0.0.0, 0255.255.255, that says every single address from 10.0.0.0 to 10.255.255.255, which means it doesn't matter if you're in the 10.0.0.0 subnet or the 10.0.1.0 subnet or the 10.0.2.0 subnet. 00:28:06.000 --> 00:28:07.000 Like, the subnet doesn't matter. 00:28:08.000 --> 00:28:09.000 The mask doesn't matter. 00:28:09.000 --> 00:28:15.000 It is purely based on the IP addresses in the source and destination of the packet. 00:28:17.000 --> 00:28:36.000 So, if you wanted to match addresses, though, that were not contiguous, let's say you wanted to match all the addresses in 10.0.0.0 and all the addresses in 10.0.2.0 at the same time and 10.0.4.0 and 10.0.6.0, 00:28:37.000 --> 00:28:42.000 then could you get crafty with your wildcard mask and accomplish that? 00:28:44.000 --> 00:28:45.000 It's hard to do that, though. 00:28:46.000 --> 00:28:47.000 It's really hard to do that. 00:28:48.000 --> 00:28:52.000 And so, the exam is not going to go crazy like that on you. 00:28:53.000 --> 00:28:54.000 The exam is going to keep it simple. 00:28:55.000 --> 00:28:56.000 Simple. 00:28:57.000 --> 00:28:58.000 And what does simple mean? 00:28:58.000 --> 00:29:12.000 It means simple wildcard masks that in each octet would only typically have either 0 or 127 or 63 or 31. 00:29:13.000 --> 00:29:14.000 Let's do this instead. 00:29:14.000 --> 00:29:15.000 We'll go with 255 first. 00:29:16.000 --> 00:29:22.000 127, 63, 31, 15, 7, 3, 1, 0. 00:29:22.000 --> 00:29:26.000 So, those would be the only possible values that you would see. 00:29:29.000 --> 00:29:32.000 In reality, though, could you have other values? 00:29:32.000 --> 00:29:33.000 Sure, you could. 00:29:34.000 --> 00:29:37.000 You could have any value you want in a wildcard mask. 00:29:37.000 --> 00:29:39.000 Can you have any value you want in a subnet mask? 00:29:39.000 --> 00:29:40.000 No. 00:29:40.000 --> 00:29:47.000 In a subnet mask, you have 255, 128, 192, 224, 240, right? 00:29:48.000 --> 00:29:54.000 Contiguous ones followed by contiguous zeros, whereas there's no rules here for wildcard masks. 00:29:55.000 --> 00:30:01.000 So, something like Conrad, you typed in of 0, 255, 0, 255. 00:30:02.000 --> 00:30:10.000 Although those are valid values that I'm talking about here, what you need to realize is that this is not simple. 00:30:11.000 --> 00:30:16.000 This is 8 zeros followed by 8 ones followed by 8 zeros followed by 8 ones. 00:30:17.000 --> 00:30:19.000 That is actually extremely complicated. 00:30:20.000 --> 00:30:23.000 When it's all said and done, when you combine it together with an address. 00:30:24.000 --> 00:30:30.000 Because what we're basically saying in the end is that the entire first octet has to match. 00:30:30.000 --> 00:30:32.000 The entire second octet is wild. 00:30:32.000 --> 00:30:33.000 It can be anything we want it to be. 00:30:33.000 --> 00:30:40.000 The entire third octet has to be a match to the IP address. 00:30:40.000 --> 00:30:43.000 And then the last octet could be wild. 00:30:43.000 --> 00:30:44.000 It could be anything we want it to be. 00:30:45.000 --> 00:30:50.000 So, that would actually create a very interesting combination of addresses that we are trying to match. 00:30:50.000 --> 00:30:54.000 But it would be based on this first value that's included as well. 00:30:54.000 --> 00:30:58.000 And I'll show you how the binary works here momentarily if you've never seen me do this. 00:30:58.000 --> 00:31:01.000 So, for example, this one's simple, but this one's not. 00:31:01.000 --> 00:31:03.000 This one's not, and this one's not. 00:31:03.000 --> 00:31:04.000 They're legit not simple. 00:31:04.000 --> 00:31:13.000 Because when you convert these to binary, you have zeros followed by ones followed by zeros followed by ones followed by zeros followed by ones as an example. 00:31:14.000 --> 00:31:15.000 That makes it complicated. 00:31:16.000 --> 00:31:28.000 To make it simple, which the exam is going to do like 99.8% of the time, is your wildcard mask is always going to be zeros followed by ones. 00:31:29.000 --> 00:31:32.000 So, basically, yes, the backwards of a subnet mask. 00:31:34.000 --> 00:31:36.000 But that's the simplest way to do them. 00:31:36.000 --> 00:31:38.000 And even in the real world, I try to keep things simple. 00:31:38.000 --> 00:31:52.000 I would prefer to have multiple simple entries in my ACL than one really complex one where I don't know 100% if I'm only matching the exact IP addresses I want to match. 00:31:52.000 --> 00:31:53.000 Because just think about it this way. 00:31:54.000 --> 00:31:59.000 All it takes is for you to match one IP address you did not intend to match. 00:32:00.000 --> 00:32:02.000 And that might be permitting it or denying it. 00:32:02.000 --> 00:32:11.000 If you're permitting it, that could allow a cyber criminal to do damage to your network if they get through that one address that you've permitted that you shouldn't have permitted. 00:32:12.000 --> 00:32:19.000 Or if you're denying that address, it means somebody or something can't do what it needs to do all because you tried to get way too creative with your wildcard masks. 00:32:20.000 --> 00:32:21.000 So we keep it simple. 00:32:22.000 --> 00:32:42.000 So, basically, in any given octet, it would be something like 000255 or 00255255 or 00127255 or 0063255 or 007255 or 0007 or 00015. 00:32:43.000 --> 00:32:46.000 That's simple because it'd be ones followed by zeros. 00:32:47.000 --> 00:32:48.000 So let's look at it now this way. 00:32:49.000 --> 00:32:51.000 And let's go through this example. 00:32:52.000 --> 00:32:57.000 When you see zeros in the wildcard mask and you see ones, what do they mean? 00:32:58.000 --> 00:32:59.000 I've seen it referred to in many different ways. 00:33:00.000 --> 00:33:02.000 A lot of documentation, zero bit means match. 00:33:03.000 --> 00:33:04.000 One bit means ignore. 00:33:05.000 --> 00:33:09.000 I've seen it says, I care about this bit, use this bit, preserve this bit, carry this bit down for zeros. 00:33:10.000 --> 00:33:14.000 Or one meaning, I don't care about this bit, don't use this bit, don't preserve this bit, don't carry this bit down. 00:33:15.000 --> 00:33:18.000 All right, let me explain what all that means here by actually looking at it in binary. 00:33:19.000 --> 00:33:21.000 And in the end, I don't want you to use binary on the exam, all right? 00:33:22.000 --> 00:33:23.000 So let's be clear about that. 00:33:24.000 --> 00:33:25.000 You're wasting your time if you are. 00:33:26.000 --> 00:33:27.000 I'm going to show you some shortcuts. 00:33:28.000 --> 00:33:32.000 When it's all said and done, that only works because everything is simple and perfect on the exam 99.8% of the time. 00:33:33.000 --> 00:33:38.000 I'll take those odds and take my shortcuts so I can save time. 00:33:39.000 --> 00:33:42.000 All right, so this is the IP address. 00:33:42.000 --> 00:33:43.000 This is the IP address. 00:33:44.000 --> 00:33:48.000 This is the wildcard mask in binary. 00:33:49.000 --> 00:33:51.000 So let's underline our zeros. 00:33:52.000 --> 00:33:53.000 Let's underline our ones. 00:33:54.000 --> 00:33:57.000 Zero, as we said, means match. 00:33:58.000 --> 00:33:59.000 I care, use this, preserve. 00:34:00.000 --> 00:34:01.000 All this simply means is this. 00:34:02.000 --> 00:34:04.000 I cannot touch these. 00:34:05.000 --> 00:34:06.000 I cannot touch these. 00:34:07.000 --> 00:34:10.000 They must remain exactly as they are. 00:34:10.000 --> 00:34:11.000 That's all that means. 00:34:12.000 --> 00:34:14.000 So let's go ahead and rewrite them all down here. 00:34:15.000 --> 00:34:16.000 Boop, boop, boop, there you go. 00:34:17.000 --> 00:34:18.000 That's all that means. 00:34:19.000 --> 00:34:21.000 A zero wildcard bit means the IP address bit cannot be touched. 00:34:22.000 --> 00:34:23.000 Good, done. 00:34:24.000 --> 00:34:27.000 The ones mean that these, all of these, are wild. 00:34:32.000 --> 00:34:34.000 Wild means what in a game of cards, folks? 00:34:35.000 --> 00:34:39.000 If we were playing crazy eights and I said eights are wild, what does that mean? 00:34:40.000 --> 00:34:44.000 It means an eight can be anything I want it to be. 00:34:46.000 --> 00:34:49.000 So if I'm playing and I want my eight to be a three right now, my eight can be a three. 00:34:55.000 --> 00:34:58.000 So let's represent wild with X's. 00:35:05.000 --> 00:35:07.000 So let me ask you this, folks. 00:35:08.000 --> 00:35:10.000 An X is wild, which means it can be anything I want it to be. 00:35:11.000 --> 00:35:13.000 In binary, we have two possible values. 00:35:14.000 --> 00:35:16.000 We have a zero and we have a one. 00:35:18.000 --> 00:35:21.000 So an X, each X can be a zero or a one. 00:35:22.000 --> 00:35:26.000 So the lowest, lowest option we have here is all of them to be zeros. 00:35:30.000 --> 00:35:31.000 So let's convert this to decimal now. 00:35:31.000 --> 00:35:32.000 We've got 10. 00:35:33.000 --> 00:35:34.000 We've got one. 00:35:35.000 --> 00:35:36.000 We've got one. 00:35:37.000 --> 00:35:39.000 Folks, what would this octet be if all of those are zero? 00:35:40.000 --> 00:35:41.000 It's a simple answer. 00:35:42.000 --> 00:35:43.000 It's not too hard. 00:35:44.000 --> 00:35:46.000 If they're all zero in binary, they are exactly zero. 00:35:47.000 --> 00:35:48.000 There you go. 00:35:49.000 --> 00:35:50.000 There's one value that I have. 00:35:51.000 --> 00:35:52.000 I need to figure out one more value. 00:35:53.000 --> 00:35:55.000 What if all the X's are the maximum possible value? 00:35:58.000 --> 00:35:59.000 Now what is that? 00:35:59.000 --> 00:36:00.000 That's right. 00:36:01.000 --> 00:36:02.000 Good job. 00:36:02.000 --> 00:36:03.000 It's 255. 00:36:04.000 --> 00:36:06.000 What have we just discovered by doing this? 00:36:08.000 --> 00:36:10.000 The range of IPs. 00:36:12.000 --> 00:36:14.000 This means this. 00:36:21.000 --> 00:36:22.000 That's it. 00:36:30.000 --> 00:36:37.000 So access list five permit 10.1.1.0 through 10.1.1.255. 00:36:38.000 --> 00:36:39.000 That's how you read that. 00:36:40.000 --> 00:36:41.000 Let me show you a shortcut here. 00:36:42.000 --> 00:36:43.000 Why? 00:36:43.000 --> 00:36:44.000 Because everything is perfect. 00:36:46.000 --> 00:36:48.000 We have zeros followed by ones. 00:36:49.000 --> 00:36:52.000 This is a beautiful network ID. 00:36:53.000 --> 00:36:55.000 If we had a subnet of a slash 24, 00:36:55.000 --> 00:37:00.000 that would be the exact backwards of a slash 24 subnet mask. 00:37:01.000 --> 00:37:02.000 If we flipped all of this around, 00:37:03.000 --> 00:37:04.000 if these were all zeros and these were all ones, 00:37:05.000 --> 00:37:06.000 that would be a slash 24 subnet mask. 00:37:07.000 --> 00:37:08.000 So all those things make this perfect. 00:37:09.000 --> 00:37:10.000 So all you have to do for the exam, 00:37:11.000 --> 00:37:12.000 if you're looking at this, is go. 00:37:26.000 --> 00:37:30.000 10.1.1.0 through 10.1.1.255. 00:37:31.000 --> 00:37:32.000 There you go. 00:37:32.000 --> 00:37:33.000 No binary involved. 00:37:33.000 --> 00:37:34.000 You just figured out the same range. 00:37:36.000 --> 00:37:37.000 And you might be asking, 00:37:37.000 --> 00:37:38.000 Raymond, when you took the exam, 00:37:38.000 --> 00:37:39.000 did you do this? 00:37:39.000 --> 00:37:40.000 Yeah, I did. 00:37:40.000 --> 00:37:41.000 How'd you do? 00:37:41.000 --> 00:37:42.000 Really well. 00:37:46.000 --> 00:37:47.000 If it didn't work for me, 00:37:47.000 --> 00:37:48.000 I wouldn't be showing it to you. 00:37:48.000 --> 00:37:49.000 Let's put it that way. 00:37:50.000 --> 00:37:51.000 And so this is the same thing. 00:37:51.000 --> 00:37:52.000 When we were working with OSPF, 00:37:53.000 --> 00:37:54.000 I was able to quickly give you examples. 00:37:55.000 --> 00:37:56.000 Okay, well, this means this. 00:37:56.000 --> 00:37:57.000 This means that. 00:37:57.000 --> 00:37:58.000 Because that's all I'm doing in my head. 00:37:58.000 --> 00:37:59.000 That's what I'm doing. 00:38:00.000 --> 00:38:01.000 I'm keeping things simple 00:38:01.000 --> 00:38:02.000 in order to accomplish that objective. 00:38:04.000 --> 00:38:05.000 All right, let's look at another example. 00:38:08.000 --> 00:38:09.000 Let me ask you this, folks, though. 00:38:09.000 --> 00:38:10.000 For those of you here today, 00:38:11.000 --> 00:38:13.000 is this the first time you're seeing something like this? 00:38:14.000 --> 00:38:15.000 And right now you're going, 00:38:15.000 --> 00:38:16.000 hey, that's pretty good. 00:38:16.000 --> 00:38:17.000 If I can use that on the exam, 00:38:17.000 --> 00:38:18.000 that's pretty good. 00:38:19.000 --> 00:38:20.000 Just want to know. 00:38:21.000 --> 00:38:22.000 So. 00:38:22.000 --> 00:38:23.000 Look at this one. 00:38:23.000 --> 00:38:25.000 We have a different wildcard mass now. 00:38:26.000 --> 00:38:27.000 So if I convert it, 00:38:28.000 --> 00:38:29.000 let's do the long way, 00:38:29.000 --> 00:38:30.000 which you're not going to do it this way on the exam, 00:38:30.000 --> 00:38:31.000 but let's do the long way. 00:38:32.000 --> 00:38:33.000 Let's underline 00:38:34.000 --> 00:38:35.000 what we have. 00:38:37.000 --> 00:38:38.000 Here's our ones. 00:38:38.000 --> 00:38:39.000 Here's our zeros 00:38:39.000 --> 00:38:40.000 that we need to keep, 00:38:41.000 --> 00:38:42.000 that we need to keep. 00:38:42.000 --> 00:38:43.000 Why? 00:38:43.000 --> 00:38:44.000 Because these are zeros for the wildcard mass, 00:38:44.000 --> 00:38:46.000 so I got to keep all the IP bits. 00:38:47.000 --> 00:38:48.000 And then we got our ones at the end. 00:38:48.000 --> 00:38:49.000 So the ones at the end, 00:38:50.000 --> 00:38:51.000 are wild. 00:38:51.000 --> 00:38:53.000 So these are wild. 00:38:54.000 --> 00:38:55.000 So let's put X's here instead. 00:38:57.000 --> 00:39:00.000 Now, if these X's are all zero, 00:39:01.000 --> 00:39:04.000 then we get 10.1.1.0. 00:39:05.000 --> 00:39:07.000 If all these X's are ones, folks, 00:39:07.000 --> 00:39:08.000 what do we get? 00:39:10.000 --> 00:39:11.000 If all those X's are ones, 00:39:11.000 --> 00:39:12.000 what do we get now? 00:39:12.000 --> 00:39:13.000 What do we get now? 00:39:18.000 --> 00:39:19.000 10.1.1.15. 00:39:21.000 --> 00:39:22.000 That's right. 00:39:22.000 --> 00:39:23.000 So there's our range. 00:39:24.000 --> 00:39:25.000 So let's do the shortcut. 00:39:26.000 --> 00:39:27.000 So the shortcut instead would be 00:39:27.000 --> 00:39:32.000 10.1.1.0 plus 0.0.0.15. 00:39:33.000 --> 00:39:35.000 10.1.1.15. 00:39:36.000 --> 00:39:37.000 There's your start. 00:39:37.000 --> 00:39:38.000 There's your end. 00:39:38.000 --> 00:39:40.000 Very easy to do for the exam. 00:39:42.000 --> 00:39:43.000 Now let's do another one. 00:39:43.000 --> 00:39:45.000 But instead, let's change this value here. 00:39:46.000 --> 00:39:48.000 So if we change that value instead, 00:39:48.000 --> 00:39:50.000 now we have 10.1.1.64. 00:39:50.000 --> 00:39:51.000 0.0.0.15. 00:39:52.000 --> 00:39:54.000 So let's go ahead and put our binary for the IP, 00:39:54.000 --> 00:39:56.000 the binary for the wildcard, 00:39:56.000 --> 00:39:57.000 draw our lines, 00:39:57.000 --> 00:39:58.000 yada, yada, yada, 00:39:58.000 --> 00:39:59.000 et cetera, et cetera. 00:39:59.000 --> 00:40:00.000 Put X's here. 00:40:02.000 --> 00:40:03.000 And now what? 00:40:04.000 --> 00:40:07.000 Well, if all of these X's are ones, 00:40:07.000 --> 00:40:08.000 well, if all of these are zeros, 00:40:08.000 --> 00:40:10.000 be very careful with this example 00:40:10.000 --> 00:40:12.000 because look, there's a one here, right? 00:40:12.000 --> 00:40:15.000 This one, this one got preserved, folks. 00:40:16.000 --> 00:40:19.000 So now we've got 64. 00:40:19.000 --> 00:40:20.000 That's what we have. 00:40:23.000 --> 00:40:24.000 And if these are all ones, 00:40:26.000 --> 00:40:32.000 now you got 64 plus 8 plus 4 plus 2 plus 1 00:40:32.000 --> 00:40:35.000 for a grand total of, that's right, 79. 00:40:38.000 --> 00:40:39.000 There we go. 00:40:40.000 --> 00:40:42.000 Only pressed it six times. 00:40:43.000 --> 00:40:45.000 So now we have our total range. 00:40:47.000 --> 00:40:49.000 So doing our shortcut, 00:40:49.000 --> 00:40:52.000 10.1.1.64. 00:40:53.000 --> 00:40:55.000 0.0.0.15. 00:40:56.000 --> 00:40:58.000 10.1.1.79. 00:41:00.000 --> 00:41:02.000 So now we have our total range. 00:41:02.000 --> 00:41:03.000 79. 00:41:07.000 --> 00:41:08.000 All right. 00:41:10.000 --> 00:41:11.000 Now this is where I tell you 00:41:11.000 --> 00:41:13.000 that you have to be very careful 00:41:14.000 --> 00:41:15.000 in the real world 00:41:15.000 --> 00:41:16.000 because you might be going like, 00:41:16.000 --> 00:41:18.000 oh my gosh, I could use this in the real world. 00:41:18.000 --> 00:41:19.000 It'd be so easy. 00:41:19.000 --> 00:41:21.000 Nah, yes and no 00:41:21.000 --> 00:41:23.000 because you got to understand what I said 00:41:23.000 --> 00:41:25.000 is everything is perfect. 00:41:26.000 --> 00:41:28.000 Everything is perfect, remember? 00:41:28.000 --> 00:41:31.000 So let's make this not perfect now. 00:41:32.000 --> 00:41:34.000 What if we accidentally put this in here? 00:41:44.000 --> 00:41:45.000 What if we did that? 00:41:47.000 --> 00:41:49.000 Well, let's look at this. 00:41:53.000 --> 00:41:59.000 All right, so 66 is now 64 plus 2, that's 66. 00:42:00.000 --> 00:42:03.000 So wildcard mask being that. 00:42:05.000 --> 00:42:07.000 So we preserve this one, 00:42:07.000 --> 00:42:09.000 but you see that one there? 00:42:10.000 --> 00:42:11.000 That's wild now. 00:42:11.000 --> 00:42:13.000 That's wild, you see that? 00:42:16.000 --> 00:42:18.000 So it's still X's. 00:42:19.000 --> 00:42:22.000 So if it's still X's, this is still my range. 00:42:22.000 --> 00:42:25.000 This is still my range, folks, 00:42:25.000 --> 00:42:27.000 even if I type that in. 00:42:27.000 --> 00:42:28.000 That's why you got to be careful 00:42:28.000 --> 00:42:30.000 with access control lists. 00:42:30.000 --> 00:42:32.000 So we use our shortcut here 00:42:32.000 --> 00:42:34.000 and we did this. 00:42:44.000 --> 00:42:46.000 That's not correct. 00:42:47.000 --> 00:42:49.000 That's not correct. 00:42:50.000 --> 00:42:55.000 Does that make, no, that's 64, that's 66, that's 81. 00:42:55.000 --> 00:42:58.000 So you see the shortcut here is not going to work 00:42:58.000 --> 00:42:59.000 because this is actually not perfect. 00:42:59.000 --> 00:43:01.000 That is not accurate. 00:43:01.000 --> 00:43:03.000 That would never be a network ID 00:43:03.000 --> 00:43:07.000 if we had a 255, 255, 255, 240 something mask. 00:43:08.000 --> 00:43:09.000 Would never be possible. 00:43:10.000 --> 00:43:13.000 So in this case, it fails. 00:43:13.000 --> 00:43:17.000 So this is not something I would worry about on the exam 00:43:17.000 --> 00:43:22.000 and I would not worry about things being inaccurate. 00:43:22.000 --> 00:43:27.000 I would worry, I would be focused on the fact 00:43:27.000 --> 00:43:31.000 that Cisco is giving me good, accurate, solid, 00:43:31.000 --> 00:43:35.000 typical, best practice access control lists 00:43:35.000 --> 00:43:37.000 and I can go ahead and use Raymond's shortcut 00:43:37.000 --> 00:43:40.000 in this particular case and be successful, quick, fast 00:43:40.000 --> 00:43:42.000 on the certification exam. 00:43:47.000 --> 00:43:49.000 So that is your goal if you can do that. 00:43:49.000 --> 00:43:51.000 Now I'm going to show you a couple of things 00:43:51.000 --> 00:43:53.000 just in case it comes up. 00:43:55.000 --> 00:43:57.000 This is interesting because that is not 00:43:57.000 --> 00:43:59.000 what we classify as a simple wildcard mask 00:43:59.000 --> 00:44:03.000 because look, it's zeros followed by ones 00:44:03.000 --> 00:44:05.000 followed by a zero. 00:44:08.000 --> 00:44:10.000 So when you look at it this way now, 00:44:11.000 --> 00:44:16.000 you'll see that all of these can be anything 00:44:17.000 --> 00:44:22.000 I want them to be, but this always has to be a zero. 00:44:26.000 --> 00:44:31.000 Folks, if that very last binary bit always has to be a zero, 00:44:32.000 --> 00:44:37.000 then when it comes to the binary numbers in this octet, 00:44:39.000 --> 00:44:42.000 if that final binary value is always, 00:44:43.000 --> 00:44:45.000 let me rephrase that, 00:44:47.000 --> 00:44:51.000 when it comes to the decimal numbers of those octets, 00:44:51.000 --> 00:44:55.000 of that octet, if that binary value always has to be zero, 00:44:55.000 --> 00:44:58.000 then what are the numbers going to be in the end? 00:44:58.000 --> 00:45:01.000 Andrew says even, exactly, Andrew. 00:45:01.000 --> 00:45:04.000 Because if that has to be zero, 00:45:04.000 --> 00:45:06.000 then the one bit is never set. 00:45:06.000 --> 00:45:07.000 If the one bit is never set, 00:45:07.000 --> 00:45:09.000 then we're always counting by twos. 00:45:09.000 --> 00:45:10.000 So it could be zero. 00:45:10.000 --> 00:45:12.000 If this is all zeros, 00:45:14.000 --> 00:45:16.000 then the answer is what? 00:45:17.000 --> 00:45:18.000 Zero. 00:45:18.000 --> 00:45:21.000 But then we had 0, 0, 0, 0, 0, 0, 1, 0 00:45:21.000 --> 00:45:23.000 because it always has to be zero the last one. 00:45:23.000 --> 00:45:24.000 Now we've got two. 00:45:24.000 --> 00:45:28.000 What about 0, 0, 0, 0, 0, 1, 0, 0? 00:45:28.000 --> 00:45:29.000 Now you've got four. 00:45:29.000 --> 00:45:34.000 What about 0, 0, 0, 0, 0, 1, 1, 0? 00:45:34.000 --> 00:45:35.000 Now you've got six. 00:45:35.000 --> 00:45:37.000 You see, we're counting by twos. 00:45:37.000 --> 00:45:38.000 Even numbers only. 00:45:38.000 --> 00:45:40.000 Even numbers only, as Andrew said. 00:45:41.000 --> 00:45:43.000 But what if we change this right here? 00:45:43.000 --> 00:45:44.000 Look at this. 00:45:44.000 --> 00:45:46.000 Just change this value here. 00:45:46.000 --> 00:45:48.000 So instead of saying 1, 9, 2, 1, 6, 8, 0, 0, 00:45:48.000 --> 00:45:50.000 I say 1, 9, 2, 1, 6, 8, 0, 1. 00:45:51.000 --> 00:45:53.000 If I use the same wildcard mask, 00:45:53.000 --> 00:45:55.000 now you see this always has to be a what? 00:45:55.000 --> 00:45:57.000 This always has to be a one. 00:45:57.000 --> 00:45:59.000 It always has to be a one 00:46:00.000 --> 00:46:01.000 because of the wildcard mask. 00:46:01.000 --> 00:46:04.000 It says I have to match that. 00:46:08.000 --> 00:46:10.000 So now, since that always has to be a one, 00:46:10.000 --> 00:46:13.000 now it's every single odd number. 00:46:13.000 --> 00:46:15.000 So here's the deal. 00:46:15.000 --> 00:46:19.000 If you see this wildcard mask at all, 00:46:19.000 --> 00:46:20.000 then I want you to think, 00:46:20.000 --> 00:46:25.000 ooh, ooh, even or odd. 00:46:25.000 --> 00:46:27.000 That's immediately what I want you to think, 00:46:27.000 --> 00:46:28.000 even or odd. 00:46:28.000 --> 00:46:31.000 And then what I want you to do is look at this value here. 00:46:33.000 --> 00:46:36.000 If that is a one, then you think odd. 00:46:37.000 --> 00:46:40.000 If it is a zero, then you think even. 00:46:40.000 --> 00:46:41.000 That's it. 00:46:41.000 --> 00:46:42.000 Keep it that simple, folks. 00:46:42.000 --> 00:46:44.000 Don't overcomplicate it 00:46:44.000 --> 00:46:46.000 because it's already overcomplicated. 00:46:49.000 --> 00:46:50.000 All right. 00:46:50.000 --> 00:46:52.000 So there's some good shortcuts for you 00:46:52.000 --> 00:46:55.000 and things to keep in mind for the certification exam. 00:46:55.000 --> 00:46:57.000 Now, here's something else I want to show you really quickly 00:46:57.000 --> 00:47:00.000 that's going to help you get through things on the exam really fast. 00:47:00.000 --> 00:47:04.000 Let's say that you are given a network as such 00:47:04.000 --> 00:47:09.000 and you have a multitude of different ways that you can be tested on this. 00:47:09.000 --> 00:47:11.000 For example, they might turn around and say, 00:47:11.000 --> 00:47:14.000 create an access control list that matches that, 00:47:14.000 --> 00:47:16.000 permits it or denies it, whatever. 00:47:18.000 --> 00:47:21.000 They could already have an access control list created 00:47:21.000 --> 00:47:23.000 and you are troubleshooting. 00:47:23.000 --> 00:47:26.000 So you know the network because it's in a diagram 00:47:26.000 --> 00:47:28.000 and you want to confirm if there's an access control list 00:47:28.000 --> 00:47:30.000 that matches that or not. 00:47:30.000 --> 00:47:31.000 Again, how are you going to do that? 00:47:31.000 --> 00:47:35.000 Well, you've got to figure out what that would be 00:47:35.000 --> 00:47:39.000 as an access control list entry with the network ID 00:47:39.000 --> 00:47:41.000 and the wildcard mask. 00:47:41.000 --> 00:47:43.000 That's what you're going to have to figure out. 00:47:45.000 --> 00:47:49.000 So the best and easiest way to do that 00:47:49.000 --> 00:47:54.000 is to take 255, 255, 255, 255 00:47:54.000 --> 00:47:59.000 and subtract the subnet mask from it. 00:47:59.000 --> 00:48:03.000 255, 255, 255.0 00:48:03.000 --> 00:48:08.000 and that actually will give you the perfect wildcard mask 00:48:08.000 --> 00:48:10.000 for that network ID. 00:48:10.000 --> 00:48:16.000 So now 10.1.1.0 through 10.1.1.255, right? 00:48:16.000 --> 00:48:19.000 That's every IP address in that subnet. 00:48:19.000 --> 00:48:22.000 So now if you had to create an access control list, 00:48:22.000 --> 00:48:24.000 well then just use those two values now. 00:48:24.000 --> 00:48:27.000 Use this value and use this value. 00:48:27.000 --> 00:48:28.000 You're done. 00:48:28.000 --> 00:48:31.000 If you were trying to confirm if this was correct, 00:48:31.000 --> 00:48:34.000 well now you have 100% confirmation 00:48:34.000 --> 00:48:37.000 that that is correct, that it actually matches. 00:48:39.000 --> 00:48:42.000 What about this scenario here, 10.1.1.0.28? 00:48:42.000 --> 00:48:45.000 Well, take 255, 255, 255, 255, 00:48:45.000 --> 00:48:49.000 subtract 255, 255, 255, 240 from it 00:48:51.000 --> 00:48:53.000 and you get 00015. 00:48:53.000 --> 00:48:55.000 Now you've got this value and this value. 00:48:55.000 --> 00:48:57.000 So if you had to create an access control list, 00:48:57.000 --> 00:48:59.000 there you go, you got your values. 00:48:59.000 --> 00:49:01.000 If you had to verify an already existing access control list, 00:49:01.000 --> 00:49:03.000 well now you can verify it. 00:49:04.000 --> 00:49:07.000 Well, what about this one, 10.1.1.64.28? 00:49:07.000 --> 00:49:11.000 Same thing, just go ahead and do the subtraction 00:49:11.000 --> 00:49:14.000 and then take the first number, 10.1.1.64, 00:49:14.000 --> 00:49:17.000 combine it with the wildcard mask and there you go. 00:49:17.000 --> 00:49:19.000 You're able to verify, you're able to confirm, 00:49:19.000 --> 00:49:21.000 you're able to get what you want. 00:49:21.000 --> 00:49:23.000 So as you can see, a lot of little tips, tricks, techniques 00:49:23.000 --> 00:49:26.000 here to help you get really, really fast with ACLs in the exam 00:49:26.000 --> 00:49:29.000 so that way there, you're not wasting time. 00:49:29.000 --> 00:49:31.000 If you're wasting time, you run out of time. 00:49:31.000 --> 00:49:33.000 When you run out of time, you fail the exam. 00:49:36.000 --> 00:49:38.000 All right, what about scenarios where you might have 00:49:38.000 --> 00:49:40.000 to combine values together? 00:49:40.000 --> 00:49:44.000 Look at this, we have 172.16.00.24 00:49:44.000 --> 00:49:48.000 all the way to 172.16.31.0.24. 00:49:48.000 --> 00:49:52.000 So how many different networks do we have here? 00:49:52.000 --> 00:49:54.000 We have 32 different entries. 00:49:55.000 --> 00:49:56.000 So on modern-day equipment, folks, 00:49:56.000 --> 00:49:58.000 I could do something like this. 00:49:58.000 --> 00:50:00.000 I really could. 00:50:00.000 --> 00:50:03.000 Why? Because access control lists are processed in TCAM 00:50:03.000 --> 00:50:06.000 and doing something like this is probably not going to cause 00:50:06.000 --> 00:50:09.000 any issues with the performance on my device. 00:50:11.000 --> 00:50:14.000 And this way I keep it simple, I created one entry 00:50:14.000 --> 00:50:16.000 for each and every single one of them. 00:50:24.000 --> 00:50:28.000 But Cisco on the exam may force you not to do it this way 00:50:29.000 --> 00:50:32.000 or they may present to you an access control list 00:50:32.000 --> 00:50:35.000 that is something like this instead. 00:50:36.000 --> 00:50:41.000 It is an ACL that is a single entry that covers 00:50:41.000 --> 00:50:44.000 every single IP address from here to here, 00:50:44.000 --> 00:50:47.000 every single IP address, not every single subnet, okay, 00:50:47.000 --> 00:50:49.000 every single IP address. 00:50:49.000 --> 00:50:50.000 Always remember that. 00:50:50.000 --> 00:50:51.000 When you're dealing with access control lists, 00:50:51.000 --> 00:50:53.000 it's not about subnets, it's about IP addresses. 00:50:53.000 --> 00:50:56.000 So yes, does it match every single IP address 00:50:56.000 --> 00:50:57.000 in all of those subnets? 00:50:57.000 --> 00:50:58.000 Yes, it does. 00:50:58.000 --> 00:51:00.000 But it's not matching a subnet mask, 00:51:00.000 --> 00:51:02.000 it's just matching the IP addresses. 00:51:02.000 --> 00:51:04.000 The subnet mask doesn't matter 00:51:05.000 --> 00:51:07.000 when it's all said and done with the ACL. 00:51:09.000 --> 00:51:11.000 So, right, you have two different options. 00:51:12.000 --> 00:51:13.000 Two different options. 00:51:13.000 --> 00:51:14.000 So if you can do this way, do this way. 00:51:14.000 --> 00:51:16.000 It's simpler, right? 00:51:16.000 --> 00:51:17.000 Maybe take you a little bit more time, 00:51:17.000 --> 00:51:19.000 but a little bit of copying and pasting, 00:51:19.000 --> 00:51:20.000 a little of this, a little of that, 00:51:20.000 --> 00:51:21.000 you can go ahead and do it. 00:51:21.000 --> 00:51:23.000 But if you're forced to do something like this, 00:51:23.000 --> 00:51:25.000 or you're forced to verify something like this, 00:51:25.000 --> 00:51:27.000 it's gonna require a little bit of work on your part. 00:51:29.000 --> 00:51:30.000 Because you're gonna have to figure out 00:51:30.000 --> 00:51:34.000 exactly what this wildcard mask is, 00:51:34.000 --> 00:51:35.000 and how are you gonna get that? 00:51:36.000 --> 00:51:40.000 So to do that, take the first value and the last value, 00:51:43.000 --> 00:51:45.000 and then write them out like this. 00:51:45.000 --> 00:51:48.000 Now this is very, very, very, very similar 00:51:48.000 --> 00:51:53.000 to what we did with our summarization discussion for OSPF. 00:51:58.000 --> 00:52:02.000 Remember we had 10.0.0.0, 10.0.1.0, 00:52:02.000 --> 00:52:07.000 10.0.2.0, 10.0.3.0, slash 24, 24, 24, 24, right? 00:52:09.000 --> 00:52:10.000 That's what we had. 00:52:10.000 --> 00:52:12.000 And what did I tell you to do? 00:52:12.000 --> 00:52:15.000 I said, well, if you're gonna figure it out in this case, 00:52:15.000 --> 00:52:16.000 then what I want you to do 00:52:16.000 --> 00:52:19.000 is I want you to keep the 10, the zero, 00:52:19.000 --> 00:52:20.000 and then what is that? 00:52:20.000 --> 00:52:25.000 That is one, two, three, four, five, six, seven, eight, zero, 00:52:25.000 --> 00:52:26.000 and then do the last one. 00:52:26.000 --> 00:52:31.000 So 10.0.1, two, three, four, five, six, seven, eight. 00:52:31.000 --> 00:52:32.000 There you go. 00:52:32.000 --> 00:52:34.000 And then we work our way from here to here. 00:52:34.000 --> 00:52:39.000 We find out exactly where things change. 00:52:39.000 --> 00:52:40.000 And then based on that, 00:52:40.000 --> 00:52:44.000 then these are all ones and these are all zeros. 00:52:45.000 --> 00:52:47.000 And this is our new subnet mask. 00:52:47.000 --> 00:52:52.000 Would it be 255, 255, 255? 00:52:52.000 --> 00:52:54.000 Oops, nope. 00:52:54.000 --> 00:52:59.000 Would we have 248, 248, 252? 00:52:59.000 --> 00:53:01.000 Oh my gosh, I'm drawing a blank right now. 00:53:01.000 --> 00:53:07.000 22, 22, 252.0, 252.0 in that case, I believe. 00:53:07.000 --> 00:53:09.000 I'm trying to do it all in my head right now 00:53:09.000 --> 00:53:11.000 without writing it down properly. 00:53:11.000 --> 00:53:13.000 It's a slash 22. 00:53:13.000 --> 00:53:14.000 So it's a slash 22. 00:53:14.000 --> 00:53:19.000 So it would be 10.0.0.0 slash 22 because it would be 22 ones here. 00:53:19.000 --> 00:53:20.000 That's summarization, though. 00:53:20.000 --> 00:53:21.000 That's summarization. 00:53:21.000 --> 00:53:24.000 But same kind of idea is happening here. 00:53:24.000 --> 00:53:28.000 So in reality, I could just write 172, 16, 00:53:28.000 --> 00:53:29.000 write this out like this, 00:53:29.000 --> 00:53:31.000 and then write all of these out as zero. 00:53:31.000 --> 00:53:32.000 We could totally do that. 00:53:32.000 --> 00:53:33.000 And then what are we going to do? 00:53:33.000 --> 00:53:38.000 We're going to figure out where do the binary values change. 00:53:38.000 --> 00:53:41.000 We see they change right there. 00:53:41.000 --> 00:53:44.000 So now instead of ones and zeros, it's zeros and ones. 00:53:44.000 --> 00:53:45.000 That's it. 00:53:45.000 --> 00:53:49.000 Zeros and ones instead of ones and zeros. 00:53:49.000 --> 00:53:52.000 And so put our zeros in. 00:53:52.000 --> 00:53:55.000 Put our ones in. 00:53:55.000 --> 00:53:58.000 Convert it to decimal. 00:53:58.000 --> 00:54:02.000 And now we have the first value, 172, 16, 0, 0, 00:54:02.000 --> 00:54:07.000 and then the wildcard mask. 00:54:07.000 --> 00:54:08.000 And there you go. 00:54:08.000 --> 00:54:09.000 You figured it out. 00:54:09.000 --> 00:54:13.000 So now something like this, again, only works if it's perfect. 00:54:13.000 --> 00:54:14.000 And that's true for the real world. 00:54:14.000 --> 00:54:22.000 If these are not contiguous subnets, it's not going to work. 00:54:22.000 --> 00:54:25.000 Number two, they have to be a power of two because of how binary works. 00:54:25.000 --> 00:54:30.000 If they're not a power of two, it's not going to work. 00:54:30.000 --> 00:54:36.000 Number three, if I convert this to a subnet mask, 00:54:36.000 --> 00:54:39.000 flip it to a subnet mask, so convert all the zeros to ones 00:54:39.000 --> 00:54:43.000 and all the ones to zeros in the wildcard mask, 00:54:43.000 --> 00:54:47.000 with that subnet mask combined with that network ID, 00:54:47.000 --> 00:54:51.000 would that actually be the network ID for that subnet mask? 00:54:51.000 --> 00:54:55.000 If it's not, then, again, this shortcut wouldn't work. 00:54:55.000 --> 00:54:58.000 It has to do with binaries, powers of two, stuff like that, 00:54:58.000 --> 00:55:01.000 and network IDs and counting and everything. 00:55:01.000 --> 00:55:05.000 So even in the real world, if you want to combine networks together, 00:55:05.000 --> 00:55:07.000 you can't just combine whatever you want. 00:55:07.000 --> 00:55:11.000 If you did, then you might be permitting things you don't want to permit 00:55:11.000 --> 00:55:16.000 and denying things you don't want to deny. 00:55:16.000 --> 00:55:23.000 So take this example here, 172.16.10.0 to 172.16.26.0. 00:55:23.000 --> 00:55:27.000 So we got 17 in this case, so not a power of two. 00:55:27.000 --> 00:55:32.000 They are contiguous, but this wouldn't be the network ID anyways 00:55:32.000 --> 00:55:35.000 when it's all said and done once we do the binary math. 00:55:35.000 --> 00:55:41.000 So let's do the binary math here. 00:55:41.000 --> 00:55:43.000 Wait, that's the same answer. 00:55:43.000 --> 00:55:45.000 That's right. 00:55:45.000 --> 00:55:51.000 So even this range of addresses, if we combined this range of addresses, 00:55:51.000 --> 00:56:01.000 it would actually be everything from 172.16.0.0 all the way to 172.31.255. 00:56:01.000 --> 00:56:03.000 No, what do we have? 00:56:03.000 --> 00:56:07.000 172.16.31.255. 00:56:07.000 --> 00:56:10.000 That's what it is. 00:56:10.000 --> 00:56:15.000 So even though those are the only addresses, if we try to combine them together, 00:56:15.000 --> 00:56:17.000 the entire range is this no matter what. 00:56:17.000 --> 00:56:19.000 Why? Powers of two. 00:56:19.000 --> 00:56:20.000 Binary. 00:56:20.000 --> 00:56:23.000 So just keep that in mind in the real world. 00:56:23.000 --> 00:56:25.000 The exam, it's not going to happen to you more than likely 00:56:25.000 --> 00:56:28.000 because Cisco's not going to give you stuff that doesn't work. 00:56:28.000 --> 00:56:31.000 Cisco's going to give you stuff that does work. 00:56:31.000 --> 00:56:36.000 So you can totally use this really quickly and get it done on the exam. 00:56:36.000 --> 00:56:38.000 But in the real world, just be careful. 00:56:38.000 --> 00:56:41.000 You can't just use shortcuts anytime you want and say, well, Raymond said so. 00:56:41.000 --> 00:56:43.000 Well, no, I'm helping you get through an exam right now. 00:56:43.000 --> 00:56:45.000 That's what I'm doing. 00:56:45.000 --> 00:56:47.000 You've got to be careful in the real world because, remember, 00:56:47.000 --> 00:56:49.000 you're still dealing with binary powers of two. 00:56:49.000 --> 00:56:55.000 So therefore, you know, 0, 1, 2, 4, 8, 16, 32, 64, 128. 00:56:55.000 --> 00:57:00.000 That really makes a difference in what you can group together. 00:57:00.000 --> 00:57:02.000 So take a look at something like this. 00:57:02.000 --> 00:57:05.000 If you're presenting something like this on the certification exam, 00:57:05.000 --> 00:57:10.000 how could you combine all of these addresses together into one? 00:57:10.000 --> 00:57:13.000 Into one. 00:57:13.000 --> 00:57:15.000 So notice this is not networks I'm talking about. 00:57:15.000 --> 00:57:17.000 This is just straight-up addresses. 00:57:17.000 --> 00:57:22.000 I'm saying, hey, every address from 10.10.10.248 to 10.10.10.255. 00:57:22.000 --> 00:57:25.000 So one of the things you can do is you know you've got 10.10.10. 00:57:25.000 --> 00:57:26.000 Those are all the same. 00:57:26.000 --> 00:57:29.000 So it's 10.10.10. 00:57:29.000 --> 00:57:33.000 And now you need 248 converted into binary. 00:57:33.000 --> 00:57:36.000 So it would be 248 in binary. 00:57:36.000 --> 00:57:43.000 We've got 1, 2, 3, 4, 5, 6, 7, 8. 00:57:43.000 --> 00:57:45.000 That's what we have. 00:57:45.000 --> 00:57:49.000 And then the other 255 would be 1, 2, 3, 4, 5, 6, 7, 8. 00:57:49.000 --> 00:57:51.000 There we go. 00:57:51.000 --> 00:57:53.000 So what does that mean? 00:57:53.000 --> 00:57:55.000 Oh, wait, did I have 248 right or wrong? 00:57:55.000 --> 00:57:57.000 That's 1, 2, 3, 4. 00:57:57.000 --> 00:57:59.000 240. 00:57:59.000 --> 00:58:01.000 1, 2, 3, 4. 00:58:01.000 --> 00:58:05.000 1, 2, 3, 4. 00:58:05.000 --> 00:58:06.000 No, I had it wrong. 00:58:06.000 --> 00:58:07.000 I just realized that. 00:58:07.000 --> 00:58:08.000 There we go. 00:58:08.000 --> 00:58:09.000 That's what I want. 00:58:09.000 --> 00:58:12.000 So 248 and 255. 00:58:12.000 --> 00:58:13.000 So now what do you do? 00:58:13.000 --> 00:58:15.000 Well, come from left to right. 00:58:15.000 --> 00:58:17.000 Draw your line. 00:58:17.000 --> 00:58:22.000 All of these are now going to be 0's. 00:58:25.000 --> 00:58:26.000 These are all going to be 1's. 00:58:26.000 --> 00:58:27.000 So what do you have? 00:58:27.000 --> 00:58:30.000 You have 0, 2, 3, 4, 5, 6, 7, 8, 9, et cetera, et cetera, et 00:58:30.000 --> 00:58:31.000 cetera, et cetera, et cetera. 00:58:31.000 --> 00:58:33.000 And in your very last octet, you're 00:58:33.000 --> 00:58:38.000 going to have 1, 2, 3, 4, 5, 6, 7, 8. 00:58:38.000 --> 00:58:41.000 So then you have 0.0.0. 00:58:41.000 --> 00:58:42.000 What would this be? 00:58:42.000 --> 00:58:43.000 7. 00:58:43.000 --> 00:58:44.000 So there's your wildcard mask. 00:58:44.000 --> 00:58:51.000 So then take your first address, this one here, 10.10.10.248 00:58:51.000 --> 00:58:54.000 with a wildcard mask of 0007. 00:58:54.000 --> 00:58:57.000 That would be every single IP address from there 00:58:57.000 --> 00:58:58.000 all the way up to 255. 00:59:03.000 --> 00:59:08.000 And so then here's an example using network IDs or networks. 00:59:08.000 --> 00:59:11.000 So in this case here, we've got contiguous networks 00:59:11.000 --> 00:59:16.000 from 32 to 39. 00:59:16.000 --> 00:59:18.000 But let me show you a shortcut here 00:59:18.000 --> 00:59:20.000 that we could have done on the last one. 00:59:20.000 --> 00:59:22.000 I'm going to teach you how to shortcut it. 00:59:22.000 --> 00:59:24.000 And again, shortcutting. 00:59:24.000 --> 00:59:26.000 Actually, let's do the shortcut on the other one first. 00:59:26.000 --> 00:59:29.000 Shortcutting is going to work for you in this case. 00:59:29.000 --> 00:59:30.000 Why? 00:59:30.000 --> 00:59:32.000 Because again, perfect values, powers of 2, 00:59:32.000 --> 00:59:34.000 contiguous, et cetera, et cetera. 00:59:34.000 --> 00:59:36.000 So what I want you to do, if you were on the exam, 00:59:36.000 --> 00:59:39.000 instead of doing all this, if you don't want to do this, 00:59:39.000 --> 00:59:47.000 do 10.10.10.255 minus 10.10.10.248. 00:59:52.000 --> 00:59:53.000 There's your wildcard mask. 00:59:59.000 --> 01:00:01.000 Wait. 01:00:01.000 --> 01:00:04.000 Go back for a second, Raymond. 01:00:04.000 --> 01:00:05.000 Really? 01:00:05.000 --> 01:00:06.000 You want me to go back? 01:00:06.000 --> 01:00:08.000 OK, I can go back. 01:00:08.000 --> 01:00:09.000 Can we do that here? 01:00:14.000 --> 01:00:15.000 Yeah, sure. 01:00:35.000 --> 01:00:37.000 This is where you've got to be careful. 01:00:37.000 --> 01:00:38.000 This is where you've got to be careful. 01:00:38.000 --> 01:00:40.000 There's a little exception to the rule. 01:00:40.000 --> 01:00:43.000 0 minus 0. 01:00:43.000 --> 01:00:44.000 The answer is not 0. 01:00:44.000 --> 01:00:45.000 You've got to remember. 01:00:45.000 --> 01:00:49.000 Once you've messed around with the octet that's changing, 01:00:49.000 --> 01:00:51.000 everything after that is going to be 1's. 01:00:51.000 --> 01:00:53.000 So always remember that it's going to be. 01:00:53.000 --> 01:00:55.000 So if you're going to shortcut it this way, 01:00:55.000 --> 01:00:58.000 remember that after that middle octet that's changing, 01:00:58.000 --> 01:01:00.000 then it's 255 after that. 01:01:00.000 --> 01:01:04.000 So yeah, it works there as well. 01:01:04.000 --> 01:01:06.000 So you could totally do that. 01:01:06.000 --> 01:01:09.000 If you're comfortable enough doing that. 01:01:09.000 --> 01:01:11.000 And here, because we were in the last octet, 01:01:11.000 --> 01:01:13.000 it wasn't a big deal. 01:01:13.000 --> 01:01:15.000 In this case, we're in the third octet. 01:01:15.000 --> 01:01:17.000 So we've got to be careful with that very last octet. 01:01:17.000 --> 01:01:18.000 So let me show you that. 01:01:18.000 --> 01:01:19.000 We'll just shortcut this one. 01:01:19.000 --> 01:01:21.000 No binary on this one. 01:01:29.000 --> 01:01:32.000 Then remember, this is going to be 255 then. 01:01:32.000 --> 01:01:38.000 So now you've got 10.10.32.0007255. 01:01:38.000 --> 01:01:40.000 So again, all these shortcuts I show you, 01:01:40.000 --> 01:01:44.000 because I have used them on certification exams, 01:01:44.000 --> 01:01:49.000 and I have been successful so many times, 01:01:49.000 --> 01:01:54.000 like super high 90 percentile range of being successful, 01:01:54.000 --> 01:01:57.000 that it is my duty to teach you this stuff 01:01:57.000 --> 01:01:58.000 to get you ready for the exam. 01:01:58.000 --> 01:02:00.000 Because in the real world, folks, 01:02:00.000 --> 01:02:02.000 sometimes your access control list, 01:02:02.000 --> 01:02:04.000 there's tools for that. 01:02:04.000 --> 01:02:06.000 There's tools for that. 01:02:06.000 --> 01:02:09.000 And you have a lot of time to figure them out, 01:02:09.000 --> 01:02:11.000 craft them, verify them, get them approved, 01:02:11.000 --> 01:02:13.000 and so on and so forth. 01:02:13.000 --> 01:02:17.000 We just don't have that on the certification exam. 01:02:17.000 --> 01:02:18.000 So there you go. 01:02:18.000 --> 01:02:20.000 Make sure you know a lot of that stuff. 01:02:20.000 --> 01:02:21.000 Why? 01:02:21.000 --> 01:02:22.000 Because that's going to help you read, help you verify, 01:02:22.000 --> 01:02:23.000 help you look at things and go, what's that, what's that, 01:02:23.000 --> 01:02:25.000 what's that, what's that, what's that, what's that. 01:02:25.000 --> 01:02:28.000 And you may never actually have to use what I just showed you 01:02:28.000 --> 01:02:30.000 from a configuration standpoint. 01:02:30.000 --> 01:02:33.000 But you may be always using it from a verification standpoint, 01:02:33.000 --> 01:02:35.000 meaning, okay, does that one match what I'm looking at? 01:02:35.000 --> 01:02:37.000 Okay, let's do a quick math calculation. 01:02:37.000 --> 01:02:38.000 Okay, good. 01:02:38.000 --> 01:02:39.000 Yeah, no, it doesn't. 01:02:39.000 --> 01:02:40.000 There's my problem. 01:02:40.000 --> 01:02:41.000 Okay, let's look at the multiple choice questions. 01:02:41.000 --> 01:02:42.000 Yes, there's one. 01:02:42.000 --> 01:02:45.000 Change access control list entry, da, da, da, two, da, da, da. 01:02:45.000 --> 01:02:46.000 Good. 01:02:46.000 --> 01:02:47.000 There's the answer. 01:02:47.000 --> 01:02:48.000 We're done. 01:02:48.000 --> 01:02:49.000 Right? 01:02:49.000 --> 01:02:50.000 It's about helping you verify and get to your answer 01:02:50.000 --> 01:02:51.000 really, really quick.