WEBVTT

00:00:01.000 --> 00:00:05.000
Alright, and lastly here, VLAN Access Control Lists.

00:00:05.000 --> 00:00:19.000
I struggle with VLAN Access Control Lists because of the way that I see other documents, people, trainers describing them.

00:00:20.000 --> 00:00:29.000
I want to make sure that you leave here fully understanding and comprehending what in the world a VACL is really about.

00:00:31.000 --> 00:00:48.000
The primary reason why VACLs exist, VLAN Access Control Lists, is to control traffic flowing within a subnet, within a VLAN, within a broadcast domain.

00:00:50.000 --> 00:00:56.000
Let's think about right now the Access Control Lists we've been talking about.

00:00:57.000 --> 00:01:04.000
Every Access Control List we've talked about up to this point in time has really focused, today anyways, on what?

00:01:05.000 --> 00:01:08.000
Traffic going from one subnet to another subnet.

00:01:09.000 --> 00:01:12.000
So traffic going through, let's say, a router.

00:01:13.000 --> 00:01:17.000
Coming from one subnet over here, going to one subnet over here.

00:01:19.000 --> 00:01:22.000
So these are Access Control Lists we apply to router interfaces.

00:01:23.000 --> 00:01:27.000
We apply them to what? Our SVIs on our default gateway.

00:01:28.000 --> 00:01:41.000
So if I want to deny my users in the VLAN 10 subnet, 10.0.0.0, from going to a particular resource, I could go to my SVI, set up an Access Control List that says,

00:01:41.000 --> 00:01:52.000
Deny traffic from 10.0.0.0, using this port, this protocol, this service, going to this destination, with these ports and protocols, etc., and apply it to the SVIs.

00:01:53.000 --> 00:01:59.000
And that would be doing what? Denying traffic or permitting traffic going in and out of the subnet.

00:02:01.000 --> 00:02:04.000
But what about traffic between users in the same subnet?

00:02:05.000 --> 00:02:08.000
That's right, let me repeat that. What about traffic between users in the same subnet?

00:02:08.000 --> 00:02:13.000
How do I make sure, for example, these two devices can't talk to each other?

00:02:14.000 --> 00:02:20.000
Well, if I apply my Access Control List to the SVI folks, is that going to stop them from talking to each other?

00:02:24.000 --> 00:02:26.000
No, because I'm not routing, right?

00:02:27.000 --> 00:02:35.000
Same thing here, if we created an SVI here, just for fun, and then applied the Access Control List on the SVI, would that stop them from talking?

00:02:36.000 --> 00:02:39.000
No, because again, we're not routing, we're not routing.

00:02:41.000 --> 00:02:52.000
So what we want to recognize here is that with VLAN Access Control Lists, I can actually control the flow of traffic within that subnet VLAN or broadcast to me.

00:02:53.000 --> 00:03:00.000
So I can create an Access Control List and then prevent somebody like 10.0.0.10 from talking to 10.0.0.20.

00:03:01.000 --> 00:03:04.000
I can totally do that in the same subnet VLAN or broadcast to me.

00:03:05.000 --> 00:03:07.000
That is what they were really intended for.

00:03:08.000 --> 00:03:17.000
Now, notice it also says here, entering or leaving a subnet VLAN or broadcast to me, entering or leaving a subnet VLAN or broadcast to me.

00:03:19.000 --> 00:03:29.000
So I can create a VLAN Access Control List and say, if traffic is coming from 10.0.0.0, size 24, going to 10.0.254.0, I want to drop it, deny it.

00:03:30.000 --> 00:03:31.000
Sure, of course you could.

00:03:31.000 --> 00:03:33.000
But that's not really what it's intended purpose for.

00:03:33.000 --> 00:03:34.000
Can you accomplish that?

00:03:34.000 --> 00:03:35.000
Sure, go ahead.

00:03:35.000 --> 00:03:37.000
But that's not what it's real intended purpose is for.

00:03:37.000 --> 00:03:40.000
The intended purpose is really for within your subnet, your VLAN, your broadcast to me.

00:03:41.000 --> 00:03:46.000
If you want to control traffic, enter or leaving a subnet, just do a Router Access Control List or RACL.

00:03:47.000 --> 00:03:53.000
So what we talked about in our previous three discussions were RACLs, Router Access Control Lists, RACLs on Layer 3 interfaces.

00:03:54.000 --> 00:03:57.000
This is a VACL, a VLAN Access Control List for controlling what?

00:03:57.000 --> 00:04:02.000
Layer 2 traffic, traffic within the same subnet VLAN broadcast to me, even though you can't do it this way.

00:04:03.000 --> 00:04:09.000
Now, back in the day, and I think I'm allowed to say this now, because I mean, the exam doesn't exist and the simulations don't exist anymore.

00:04:10.000 --> 00:04:12.000
I've taken a lot of Cisco exams over the years.

00:04:13.000 --> 00:04:15.000
And at one time, there was an exam called Switch.

00:04:16.000 --> 00:04:17.000
Did anybody ever take the Switch exam?

00:04:17.000 --> 00:04:25.000
Anybody here ever take the old CCNP Switch exam when you had like the Route Switch and T-Shoot?

00:04:25.000 --> 00:04:27.000
Okay, Jeffrey, Jeffrey, you might remember this.

00:04:28.000 --> 00:04:32.000
There was a VLAN Access Control List simulation on that exam, right?

00:04:33.000 --> 00:04:34.000
There was.

00:04:35.000 --> 00:04:36.000
It was wrong, okay?

00:04:37.000 --> 00:04:38.000
It was wrong.

00:04:39.000 --> 00:04:41.000
Most people didn't realize that, right?

00:04:42.000 --> 00:04:45.000
You essentially set it up for this purpose.

00:04:46.000 --> 00:04:51.000
The requirements were to control traffic entering or leaving your subnet.

00:04:52.000 --> 00:04:54.000
And I'm like, why are we testing people on this?

00:04:55.000 --> 00:05:03.000
Like, you have somebody who created this simulation and spent all that time, and it's not even how you're supposed to use it.

00:05:05.000 --> 00:05:06.000
It was awful, awful.

00:05:07.000 --> 00:05:10.000
Anyways, thank goodness that is gone.

00:05:13.000 --> 00:05:19.000
And it's quite possible on this exam, whether it's multiple choice, drag and drops, or simulations,

00:05:19.000 --> 00:05:22.000
they may actually have it right this time, which is nice.

00:05:23.000 --> 00:05:24.000
But again, you can do both, right?

00:05:25.000 --> 00:05:27.000
And the thing is, but this is what I want you to realize.

00:05:28.000 --> 00:05:30.000
If you're going to control traffic within your subnet, do a VLAN VACL.

00:05:31.000 --> 00:05:34.000
If you're going to control it between subnets, don't use a VACL.

00:05:35.000 --> 00:05:36.000
You don't have to.

00:05:36.000 --> 00:05:37.000
It's not worth it.

00:05:37.000 --> 00:05:38.000
Set it up on your default gateway instead.

00:05:39.000 --> 00:05:45.000
But maybe in the real world, your requirement is you must stop your traffic right here.

00:05:46.000 --> 00:05:54.000
Then I guess you could use a VACL on this device to stop the traffic from going any further to leave your subnet, right?

00:05:55.000 --> 00:05:56.000
So you could do that if you wanted to.

00:05:57.000 --> 00:06:00.000
But there's also another type of access control that's not part of this course.

00:06:01.000 --> 00:06:10.000
And that is a port-based ACL, or a port ACL, which we call a PACL, which goes on layer two interfaces.

00:06:11.000 --> 00:06:13.000
So you can actually use a PACL to accomplish that instead.

00:06:13.000 --> 00:06:17.000
So you've got PACLs, you've got VACLs, you've got RACLs.

00:06:18.000 --> 00:06:26.000
So port-based ACL on layer two, VACL for VLAN-based ACL, RACL for router layer three interface access control lists, all those different types.

00:06:27.000 --> 00:06:32.000
All right, but let's talk about it this way for the certification exam and for real world stuff.

00:06:33.000 --> 00:06:34.000
So what do we have to do?

00:06:35.000 --> 00:06:41.000
Well, let me give you some guidelines first, because we're going to be creating a construct here like our route maps.

00:06:41.000 --> 00:06:42.000
That's right.

00:06:43.000 --> 00:06:45.000
We're going to be creating a construct like our route maps.

00:06:46.000 --> 00:06:52.000
So if you follow these guidelines, it becomes very simple for you to create VACLs.

00:06:53.000 --> 00:06:59.000
If you don't follow these guidelines, then you can end up with a double negative type of scenario, which messes everything up on you.

00:07:00.000 --> 00:07:02.000
If you don't understand what has just happened with that double negative scenario.

00:07:03.000 --> 00:07:13.000
So remember when we were using our route maps, I said just every time you create an access control list or any time you create a prefix list, just go ahead and do permits.

00:07:14.000 --> 00:07:15.000
Permits, permits, permits for the ACLs.

00:07:16.000 --> 00:07:17.000
Permits, permits, permits for the what?

00:07:18.000 --> 00:07:19.000
Prefix list.

00:07:20.000 --> 00:07:21.000
Why?

00:07:21.000 --> 00:07:24.000
Because we are going to control what happens using the route map.

00:07:25.000 --> 00:07:27.000
Okay, that's the same principle here.

00:07:27.000 --> 00:07:32.000
If you go with permit ACLs to identify the traffic you want to match.

00:07:33.000 --> 00:07:34.000
Permit this, that means match it.

00:07:35.000 --> 00:07:36.000
Permit that, that means match it.

00:07:37.000 --> 00:07:38.000
Permit this, that means match it.

00:07:39.000 --> 00:07:41.000
If you do a deny, a deny simply means don't match it.

00:07:42.000 --> 00:07:50.000
So why spend the time doing denies when you can just do permit, permit, permit, permit, permit, permit, and let the implicit deny do the denying for you?

00:07:51.000 --> 00:07:52.000
Because all permit means is match.

00:07:53.000 --> 00:07:54.000
Deny means don't match.

00:07:54.000 --> 00:07:56.000
Doesn't mean drop, doesn't mean block, doesn't mean anything, right?

00:07:57.000 --> 00:07:58.000
It means don't match.

00:07:59.000 --> 00:08:00.000
Don't use it, don't look at it, ignore it.

00:08:01.000 --> 00:08:02.000
That's what it means.

00:08:03.000 --> 00:08:05.000
So permit means I want to match this, I want you to do something to this.

00:08:06.000 --> 00:08:15.000
And then you use your access map, your VLAN access map to actually define what happens to that traffic you match.

00:08:18.000 --> 00:08:19.000
That's how you do it.

00:08:20.000 --> 00:08:21.000
Just like our route maps.

00:08:21.000 --> 00:08:22.000
Just like our route maps.

00:08:23.000 --> 00:08:24.000
So that's the simplest way to do it.

00:08:25.000 --> 00:08:29.000
If you follow that advice and you follow what you see here, you'll have success in the real world on the exam.

00:08:30.000 --> 00:08:34.000
So in this case, look, I'm creating an IP access list.

00:08:35.000 --> 00:08:36.000
So yes, I still need an access list.

00:08:37.000 --> 00:08:39.000
It could be a numbered access list or an extended access list.

00:08:40.000 --> 00:08:41.000
But this is to do what?

00:08:42.000 --> 00:08:43.000
This is to match traffic.

00:08:44.000 --> 00:08:45.000
Match traffic, that's it.

00:08:46.000 --> 00:08:47.000
So permit, I want to match this traffic.

00:08:48.000 --> 00:08:49.000
I want to match this traffic.

00:08:49.000 --> 00:08:55.000
So I want to match all traffic from this range going to this range.

00:08:56.000 --> 00:08:57.000
Notice how it's the exact same.

00:08:58.000 --> 00:09:07.000
Everything in 10.0.0.0 to 10.0.0.255 going to 10.0.0.0 to 10.0.0.255.

00:09:08.000 --> 00:09:10.000
So everybody within that IP addressing space.

00:09:11.000 --> 00:09:12.000
That's everybody in what?

00:09:13.000 --> 00:09:15.000
My subnet, 10.0.0.0 size 24.

00:09:16.000 --> 00:09:18.000
That's everybody that's part of VLAN 10 in our example.

00:09:19.000 --> 00:09:24.000
And so I want to match that traffic as long as it equals what?

00:09:25.000 --> 00:09:26.000
In this case, telnet.

00:09:27.000 --> 00:09:29.000
I want to match that traffic as long as it equals what?

00:09:30.000 --> 00:09:31.000
In this case, RDP.

00:09:37.000 --> 00:09:39.000
So you can apply your permits.

00:09:40.000 --> 00:09:45.000
And you can have multiple ACLs if you want to for different actions that you want to apply.

00:09:46.000 --> 00:09:47.000
But you're not specifying the action here.

00:09:47.000 --> 00:09:49.000
You're just trying to identify what you're going to match.

00:09:51.000 --> 00:09:58.000
So now you'll see here that I'm creating another access control list.

00:09:59.000 --> 00:10:02.000
And this one says permit IP any any.

00:10:04.000 --> 00:10:05.000
Meaning what?

00:10:06.000 --> 00:10:07.000
Match all traffic.

00:10:08.000 --> 00:10:09.000
Match all traffic.

00:10:10.000 --> 00:10:12.000
And you'll see why that is here momentarily.

00:10:12.000 --> 00:10:15.000
Because now as we start our VLAN access map configuration.

00:10:16.000 --> 00:10:18.000
I say VLAN access map and I give it a name.

00:10:19.000 --> 00:10:21.000
And then I give it a sequence number.

00:10:23.000 --> 00:10:24.000
That's all that is.

00:10:25.000 --> 00:10:26.000
Because like a route maps.

00:10:27.000 --> 00:10:28.000
Sequence.

00:10:28.000 --> 00:10:29.000
The lower sequence numbers process first.

00:10:30.000 --> 00:10:31.000
And the next one.

00:10:31.000 --> 00:10:32.000
And the next one.

00:10:32.000 --> 00:10:33.000
And the next one.

00:10:33.000 --> 00:10:34.000
And the next one.

00:10:34.000 --> 00:10:35.000
And so on and so forth.

00:10:36.000 --> 00:10:37.000
In this case, we only have two sequences.

00:10:37.000 --> 00:10:38.000
One and two.

00:10:39.000 --> 00:10:40.000
I could have numbered them anything I want.

00:10:40.000 --> 00:10:41.000
I could have said 10 and 20.

00:10:41.000 --> 00:10:42.000
Five and 11.

00:10:42.000 --> 00:10:43.000
Whatever.

00:10:44.000 --> 00:10:45.000
Lower numbers process before the next one.

00:10:46.000 --> 00:10:47.000
Now you'll see in the first sequence.

00:10:48.000 --> 00:10:49.000
Sequence number one.

00:10:49.000 --> 00:10:50.000
Match IP address.

00:10:51.000 --> 00:10:52.000
Deny Telnet RPDP.

00:10:52.000 --> 00:10:54.000
That just means match this ACL here.

00:10:56.000 --> 00:11:00.000
So match all traffic coming from here going to here.

00:11:01.000 --> 00:11:03.000
So any traffic within VLAN 10 essentially.

00:11:06.000 --> 00:11:07.000
That's Telnet traffic.

00:11:07.000 --> 00:11:08.000
Match any traffic in VLAN 10 essentially.

00:11:09.000 --> 00:11:10.000
That's RDP traffic.

00:11:11.000 --> 00:11:12.000
And then do what?

00:11:13.000 --> 00:11:14.000
There's your action.

00:11:14.000 --> 00:11:15.000
Drop it.

00:11:16.000 --> 00:11:17.000
Right there.

00:11:17.000 --> 00:11:18.000
Drop it.

00:11:18.000 --> 00:11:19.000
Discard it.

00:11:19.000 --> 00:11:20.000
Get rid of it.

00:11:20.000 --> 00:11:21.000
That's what I want.

00:11:22.000 --> 00:11:23.000
So notice how I'm not denying it here.

00:11:24.000 --> 00:11:25.000
I'm permitting it here.

00:11:26.000 --> 00:11:27.000
Because if I denied here.

00:11:28.000 --> 00:11:29.000
Deny here means do not match.

00:11:30.000 --> 00:11:31.000
So down here.

00:11:32.000 --> 00:11:33.000
Match IP address.

00:11:34.000 --> 00:11:35.000
Would mean don't match those.

00:11:35.000 --> 00:11:36.000
If they were denies.

00:11:37.000 --> 00:11:38.000
And then the implicit deny all means.

00:11:39.000 --> 00:11:40.000
Don't match anything else.

00:11:41.000 --> 00:11:42.000
Which means we're not dropping anything.

00:11:43.000 --> 00:11:44.000
So for the exam.

00:11:44.000 --> 00:11:45.000
If you saw something like this.

00:11:48.000 --> 00:11:49.000
Deny.

00:11:49.000 --> 00:11:50.000
Deny.

00:11:50.000 --> 00:11:51.000
And the action was a drop.

00:11:51.000 --> 00:11:52.000
Well that doesn't make sense.

00:11:53.000 --> 00:11:54.000
Because you're not actually dropping anything.

00:11:55.000 --> 00:11:56.000
And if the scenario was.

00:11:57.000 --> 00:11:58.000
You want to drop all Telnet traffic.

00:11:59.000 --> 00:12:00.000
And RDP traffic.

00:12:00.000 --> 00:12:01.000
For that subnet.

00:12:02.000 --> 00:12:03.000
10.0.0.0 size 24.

00:12:03.000 --> 00:12:04.000
Well then you're not even dropping it then.

00:12:05.000 --> 00:12:06.000
Because you are saying what?

00:12:07.000 --> 00:12:08.000
You are saying do not match.

00:12:09.000 --> 00:12:10.000
And so therefore you're not matching it.

00:12:11.000 --> 00:12:12.000
So that's why when I tell you.

00:12:13.000 --> 00:12:14.000
Go with permits.

00:12:15.000 --> 00:12:16.000
Now that means match that traffic.

00:12:17.000 --> 00:12:18.000
And therefore drop.

00:12:19.000 --> 00:12:20.000
Anything that matches Telnet and RDP.

00:12:21.000 --> 00:12:22.000
In that subnet.

00:12:27.000 --> 00:12:28.000
And then look at the next sequence.

00:12:29.000 --> 00:12:30.000
Sequence number two.

00:12:30.000 --> 00:12:31.000
Match this one.

00:12:36.000 --> 00:12:37.000
And forward everything else.

00:12:38.000 --> 00:12:39.000
Why is that?

00:12:40.000 --> 00:12:41.000
Why do I have to put that in there?

00:12:42.000 --> 00:12:43.000
Because at the end of a VLAN axis map.

00:12:44.000 --> 00:12:45.000
Is an implicit drop all.

00:12:47.000 --> 00:12:48.000
Implicit drop all.

00:12:49.000 --> 00:12:50.000
Meaning.

00:12:50.000 --> 00:12:51.000
If you don't match anything else.

00:12:52.000 --> 00:12:53.000
You are dropped.

00:12:54.000 --> 00:12:55.000
And so therefore.

00:12:56.000 --> 00:12:57.000
You're not matching anything else.

00:12:57.000 --> 00:12:58.000
You are dropped.

00:13:02.000 --> 00:13:03.000
So I need to make sure.

00:13:04.000 --> 00:13:05.000
That I'm forwarding all the other traffic now.

00:13:08.000 --> 00:13:09.000
So that's why I've done it that way.

00:13:11.000 --> 00:13:13.000
Now we still need to apply it to VLAN 10 though.

00:13:14.000 --> 00:13:15.000
So VLAN axis controllers.

00:13:16.000 --> 00:13:17.000
Are applied to the entire.

00:13:18.000 --> 00:13:19.000
VLAN on the device.

00:13:20.000 --> 00:13:21.000
So we're on ASW1 right now.

00:13:23.000 --> 00:13:24.000
Notice the very bottom command.

00:13:25.000 --> 00:13:26.000
VLAN filter.

00:13:28.000 --> 00:13:29.000
My name of my axis map.

00:13:30.000 --> 00:13:31.000
For VLAN 10.

00:13:33.000 --> 00:13:34.000
And then which VLAN.

00:13:35.000 --> 00:13:36.000
Am I applying this to?

00:13:37.000 --> 00:13:38.000
I'm applying it to VLAN 10.

00:13:58.000 --> 00:13:59.000
And there you go.

00:14:00.000 --> 00:14:01.000
So now what happens?

00:14:02.000 --> 00:14:03.000
Match.

00:14:04.000 --> 00:14:05.000
Drop it.

00:14:06.000 --> 00:14:07.000
Match.

00:14:08.000 --> 00:14:09.000
Forward it.

00:14:10.000 --> 00:14:11.000
For all traffic.

00:14:12.000 --> 00:14:13.000
Within VLAN 10.

00:14:14.000 --> 00:14:15.000
So now as traffic's flowing through this switch.

00:14:16.000 --> 00:14:17.000
As it's flowing through the switch.

00:14:18.000 --> 00:14:19.000
It doesn't matter what interface.

00:14:20.000 --> 00:14:21.000
It can come in this one.

00:14:22.000 --> 00:14:23.000
Or this one.

00:14:24.000 --> 00:14:25.000
Or this one.

00:14:25.000 --> 00:14:26.000
Or this one.

00:14:26.000 --> 00:14:27.000
We will run this.

00:14:28.000 --> 00:14:29.000
We will run this.

00:14:30.000 --> 00:14:31.000
Every time.

00:14:31.000 --> 00:14:32.000
And say do you match or not?

00:14:33.000 --> 00:14:34.000
You match.

00:14:34.000 --> 00:14:35.000
You're dropped.

00:14:35.000 --> 00:14:36.000
You match this.

00:14:36.000 --> 00:14:37.000
You're forwarded.

00:14:37.000 --> 00:14:38.000
That's what that means.

00:14:38.000 --> 00:14:39.000
Any interface.

00:14:39.000 --> 00:14:40.000
That is part of VLAN 10.

00:14:41.000 --> 00:14:42.000
This applies to.

00:14:44.000 --> 00:14:45.000
Trunk port.

00:14:45.000 --> 00:14:46.000
Or axis port.

00:14:48.000 --> 00:14:49.000
That.

00:14:49.000 --> 00:14:50.000
My friends.

00:14:50.000 --> 00:14:51.000
Is the VACL.

00:14:53.000 --> 00:14:54.000
I suggest you know that basic config.

00:14:54.000 --> 00:14:55.000
For the certification exam.

00:15:00.000 --> 00:15:02.000
And that brings us to the end of today's session folks.

00:15:03.000 --> 00:15:04.000
Where we covered what?

00:15:05.000 --> 00:15:06.000
We covered device.

00:15:06.000 --> 00:15:07.000
And access authentication.

00:15:08.000 --> 00:15:09.000
We covered ACLs.

00:15:10.000 --> 00:15:11.000
Time-based.

00:15:11.000 --> 00:15:12.000
Standard.

00:15:12.000 --> 00:15:13.000
Extended.

00:15:13.000 --> 00:15:14.000
And VACLs today.

00:15:15.000 --> 00:15:16.000
All important concepts for the certification exam.

00:15:17.000 --> 00:15:18.000
Expect to be tested on.

00:15:19.000 --> 00:15:20.000
Everything that we covered.

00:15:21.000 --> 00:15:22.000
In this session.

00:15:24.000 --> 00:15:25.000
In some way, shape or form. www.technet24.ir