CCNA全版PPT 3-08-ACL.pptVIP

Objectives Upon completing this lesson, you will be able to: Use Cisco IOS commands to configure IP standard and extended access lists, given a functioning router Use show commands to identify anomalies in IP standard and extended access lists, given an operational router Access List Configuration Guidelines Access list numbers indicate which protocol is filtered. One access list per interface, per protocol, per direction is allowed. The order of access list statements controls testing. Place the most restrictive statements at the top of list. There is an implicit deny any statement as the last access list test. Every list needs at least one permit statement. Create access lists before applying them to interfaces. Access lists filter traffic going through the router; they do not apply to traffic originating from the router. Access List Command Overview Standard IP Access List Configuration Standard IP Access List Example 1 Standard IP Access List Example 2 Standard IP Access List Example 3 Extended IP Access List Configuration Extended Access List Example 1 Extended Access List Example 2 Using Named IP Access Lists Filtering vty Access to a Router Five virtual terminal lines (0 through 4). Filter addresses that can access into the router’s vty ports. Filter vty access out from the router. How to Control vty Access vty Commands vty Access Example Access List Configuration Principles The order of access list statements is crucial. Recommended: Use a text editor on a PC to create the access-list statements, then cut and paste them into the router. Top-down processing is important. Place the more specific test statements first. No reordering or removal of statements. Use the no access-list number command to remove the entire access list. Exception: Named access lists permit removal of individual statements. Implicit deny all will be applied to any packets that do not match any access-list statement. Unless the access list ends with an explicit permit any statemen