20.学习ACL.pptVIP

Access Control Lists Introducing ACL Operation Why Use ACLs? ACL Applications: Filtering ACL Applications: Classification Outbound ACL Operation A List of Tests: Deny or Permit Types of ACLs Standard ACL Checks source address Generally permits or denies entire protocol suite Extended ACL Checks source and destination address Generally permits or denies specific protocols and applications Two methods used to identify standard and  extended ACLs: Numbered ACLs use a number for identification Named ACLs use a descriptive name or number for identification How to Identify ACLs IP Access List Entry Sequence Numbering Requires Cisco IOS Release 12.3 Allows you to edit the order of ACL statements using sequence numbers In software earlier than Cisco IOS Release 12.3, a text editor is used to create ACL statements, then the statements are copied into the router in the correct order. Allows you to remove a single ACL statement from the list using a sequence number With named ACLs in software earlier than Cisco IOS Release 12.3, you must use no {deny | permit} protocol source source-wildcard destination destination-wildcard to remove an individual statement. With numbered ACLs in software earlier than Cisco IOS Release 12.3, you must remove the entire ACL to remove a single ACL statement. ACL Configuration Guidelines Standard or extended indicates what can be filtered. Only one ACL per interface, per protocol, and per direction is allowed. The order of ACL statements controls testing, therefore, the most specific statements go at the top of the list. The last ACL test is always an implicit deny everything else statement, so every list needs at least one permit statement. ACLs are created globally and then applied to interfaces for inbound or outbound traffic. An ACL can filter traffic going through the router, or traffic to and from the router, depending on how it is applied. When placing ACLs in the network: Place extended ACLs close to the source Place standard ACLs