CCNA Study Notes on Access Lists

G. Access-Lists

1. Access lists are primarily used for two purposes:

• Controlling traffic through a router, and

• Controlling VTY access to a router’s VTY ports

2. IP access lists are a sequential list of permit and deny conditions that apply to IP addresses or upper-layer protocols. Access Control Lists are used in routers to identify and control traffic.

There are two types of IP access lists:

A. Standard IP Access Lists: These have the format, access-list [number] [permit or deny] [source_address]

Keep in mind that:

• Place standard access lists as near the destination as possible and extended access lists as close to the source as possible.

• Access lists have an implicit deny at the end of them automatically. Because of this, an access list should have at least one permit statement in it; otherwise the access list will block all remaining traffic.

• Access lists applied to interfaces default to outbound if no direction is specified.

B. Extended IP Access Lists: IP Extended Access lists have the format, access-list {number}{permit or deny} {protocol} {source} {destination} {port}

With extended IP access lists, we can act on any of the following:

• Source address

• Destination address

• IP protocol (TCP, ICMP, UDP, etc.)

• Port information (WWW, DNS, FTP, etc.)

The permitted numbers for some important access-lists are:

• 1-99: IP standard access list

• 100-199: IP extended access list

• 800-899: IPX standard access list

• 900-999: IPX extended access list

• 1000-1099: IPX SAP access list

• 1100-1199: Extended 48-bit MAC address access list

3. Wild card masking: Wild card masking is used to permit or deny a group of addresses. For example, if we have a source address 185.54.13.2 and want all the hosts on the last octet to be considered, we use a wild card mask, 185.54.13.255.

Special cases:

Host 185.54.13.2 is same as 185.54.13.2 with a wild card mask of 0.0.0.0, considers only specified IP.

Any is equivalent to saying 0.0.0.0 with a wild card mask of 255.255.255.255. This means none of the bits really matter. All IP addresses need to be considered for meeting the criteria.

Previous  Up  Next