Configuring named and Extended ACLs

Configuring named Standard ACLs

Let’s configure the same ACL as in the previous chapter, but this time as a named ACL. We’ll name it BLOCK_192.

Named ACLs let you enter a sub-configuration mode where you can add and edit ACL entries more easily.

Here is the structure for configuring a named ACL:

Command	Type of ACL	Name

In order to create a Standard ACL named “BLOCK_192”, it would look like this:

Command	Type of ACL	Name
ip access-list	standard	BLOCK_192

That is:

ip access-list standard BLOCK_192

Typing this command puts you into Standard ACL sub-configuration mode. The prompt you should see is:

R2(config-std-nacl)#

Within this mode, you enter the actual ACL statements:

Sequence # (OPTIONAL)	Action	Source IP Address	Wildcard Mask
10	deny	192.168.1.0	0.0.0.255
20	permit	any	(N/A)

As you can see, you just enter the commands:

deny 192.168.1.0 0.0.0.255
permit any

Adding the sequence number to the ACL statement is optional.

This creates the ACL. You then apply it to the router interface the same way you would a numbered ACL. The difference is that you reference the ACL name instead of an ACL number:

interface gigabitethernet0/0
ip access-group BLOCK_192 out

Editing a named ACL

Suppose you later discover that only the 192.168.1.100 host should be allowed to communicate with the 172.16.1.0/24 network.

Right now, the ACL denies the entire 192.168.1.0/24 range with this entry:

• deny 192.168.1.0 0.0.0.255

Because ACLs are processed top down, adding a permit statement after that deny would not help. Traffic from 192.168.1.100 would already match the deny rule first.

To fix this, you add a more specific permit statement above the deny rule:

• First: permit 192.168.1.100
• Then: deny the rest of 192.168.1.0/24

You should always put the more specific and granular ACL rules at the top of the ACL, and the more general (“catch-all”) rules toward the bottom.

The first entry in the named ACL uses sequence number 10. To insert a new entry above it, you give the new entry a lower sequence number so it’s processed first. In this situation, the sequence number is optional in general, but required for inserting the rule where you want it.

Let’s use sequence number 5:

R2#configure terminal
R2(config)#ip access-list standard BLOCK_192
R2(config-std-nacl)#5 permit 192.168.1.100 0.0.0.0

There is a shortcut you can use for host addresses. Instead of typing {`5 permit 192.168.1.100 0.0.0.0`}, you can type:

“5 permit host 192.168.1.100”.

5 permit host 192.168.1.100

The {`host`} keyword implies a wildcard mask of {`0.0.0.0`}, so you don’t have to type it. This only works when you’re specifying a single host address.

There’s no need to re-apply the ACL to the interface since it’s already applied. You can edit an ACL live at any time.

Image 208

Image Title - Configuring a named Standard ACL, applying it to the GigabitEthernet0/0 router interface on R1 and then verifying it.

You’ll also notice a hit count (in parentheses). This shows how many times packets have matched each ACL statement.

(Image) ACL hit count

Configuring numbered Extended ACLs

To configure a numbered Extended ACL, most of the same concepts from numbered Standard ACLs apply. The key difference is that Extended ACLs can match on more fields.

What are the fields in an IP packet that an Extended ACL can specify?

Let’s use the same scenario from Chapter 4.1.1 Access Control Lists (ACLs) for this Extended ACL.

Image 203

Image Title - R1 allowing PC B to communicate with Server A on its TCP port 25

We want to allow the 192.168.1.2 to communicate with the email server (172.16.1.100), but only when it’s using the email application. That means the traffic must be destined to the server’s TCP port 25 (SMTP).

The structure of configuring a numbered Extended ACL is the following:

ACL Number	Action	Protocol/Application Type	Source IP Address	Wildcard Mask	TCP/UDP Source Port # (Optional)	Destination IP Address	Wildcard Mask	TCP/UDP Destination Port # (Optional)

According to the requirements for this task, the configuration we need is:

ACL Number	Action	Protocol/Application Type	Source IP Address	Wildcard Mask	TCP/UDP Source Port # (Optional)	Destination IP Address	Wildcard Mask	TCP/UDP Destination Port # (Optional)
access-list 100	permit	tcp	192.168.1.2	0.0.0.0		172.16.1.100	0.0.0.0	eq 25

Notice that the ACL number is in the Extended ACL range (100-199). That range allows you to specify additional match fields beyond just the source IP address.

Here’s what each part of the statement is doing:

• Action: {`permit`} tells the router what to do when a packet matches.
• Protocol/Application Type: {`tcp`} is required because SMTP uses TCP.
• Source: the source IP address and wildcard mask must match.
• Destination: the destination IP address and wildcard mask must match.
• Destination TCP port: the destination port must match the server application’s listening port (SMTP is TCP 25).

The keyword {`eq`} before the port number is required. It’s an operator meaning the destination port number must equal the value that follows (here, 25).

If a port number is left blank (not specified), then any port number can match. Because TCP clients typically use random ephemeral source ports, it’s common to leave the TCP source port field unspecified.

All fields in the statement must match for the action ({`permit`}, in this case) to be applied.

If you type that into a router, the command looks like this:

access-list 100 permit tcp 192.168.1.2 0.0.0.0 172.16.1.100 0.0.0.0 eq 25

Alternatively, the same statement can be written more concisely using the {`host`} keyword:

access-list 100 permit tcp host 192.168.1.2 host 172.16.1.100 eq 25

Just like with any ACL, there is a hidden implicit deny at the bottom. If you want to allow all other IP traffic (in addition to the specific permit above), you would add:

permit ip any any

Applying the numbered Extended ACL to a router interface is done the same way you would with a numbered Standard ACL.

On R1:

interface gigabitethernet0/0
ip access-group 100 in

For this example, apply the ACL to R1’s GigabitEthernet0/0 interface in the inbound direction. Extended ACLs are typically placed closer to the source of the traffic. Packets entering this interface are sourced from 192.168.1.2 and destined to 172.16.1.100.

Image 209

Image Title - Configuring a numbered Extended ACL, applying it to the GigabitEthernet0/0 router interface on R1 and then verifying it.

Notice in the screenshot above that the running-configuration on the router displays port 25 as simply “smtp”. This is because the router is smart enough to know that TCP port 25 is reserved for SMTP.

Configuring named Extended ACLs

Let’s use the same setup to configure a named Extended ACL. This time, instead of SMTP, we’ll allow web traffic.

The email server will be repurposed as a web server, and only HTTP traffic from 192.168.1.2 should be allowed to reach it. HTTP uses TCP port 80.

As with a named Standard ACL, you define the name first. That puts you into the ACL sub-configuration mode where you enter the statements. The prompt you should see is:

R1(config-ext-nacl)#

Let’s name this ACL PERMIT_WEB:

ip access-list extended PERMIT_WEB

Now enter the desired ACL statements:

permit tcp 192.168.1.2 0.0.0.0 172.16.1.100 0.0.0.0 eq 80
permit ip any any

Apply this named Extended ACL to R1’s GigabitEthernet0/0 interface the same way you did with the named Standard ACL:

interface gigabitethernet0/0
ip access-group PERMIT_WEB in

It’s important to understand that you can apply only one ACL to a router interface per direction: one inbound and one outbound.

If you apply a different ACL to the same interface in the same direction, it replaces the previous ACL. If you need multiple rules in one direction, define them all within a single ACL.

Sidenote

Protocol and application aliases

You can also use the alias {`www`} in an ACL statement to reference TCP port 80 (HTTP).

For example:

permit tcp 192.168.1.2 0.0.0.0 172.16.1.100 0.0.0.0 eq www

This also works for other applications. For Telnet (TCP port 23), you can type {`telnet`} instead of the port number.

Using an alias is optional. You can always use the actual port number if you don’t know which alias Cisco IOS uses.

One final thing to note with Extended ACLs is that you can specify different protocols or application types. If you want to match generally on any IP traffic, use the keyword {`ip`}.

For example:

permit ip 192.168.1.2 0.0.0.0 172.16.1.100 0.0.0.0

Notice that when you use {`ip`} as the protocol type, you don’t specify any port numbers.

Here is a list of the typical application/protocol types that can be matched in an Extended ACL that you need to know for the CCNA v1.1 exam:

• IP - matches all IP protocols/applications
• ICMP - matches only pings
• TCP - matches only IP packets carrying TCP application data
• UDP - matches only IP packets carrying UDP application data

And here is a table with a list of applications along with their respective Transport Layer protocol (TCP or UDP), port number, and function. It is important as a CCNA to memorize these:

Application	Transport Protocol	Port Number	Function
HTTP	TCP	80	(unsecure) Web traffic
HTTPS	TCP	443	(secure) Web traffic
Telnet	TCP	23	(unsecure) remote access to network devices
Secure Shell (SSH)	TCP	22	(secure) remote access to network devices
SMTP	TCP	25	Email
FTP	TCP	20,21	(unsecure) file transfer between network devices using TCP
DNS	UDP	53	Maps hostnames to IP addresses
DHCP	UDP	67,68	Leases out IP addresses to hosts on a network
NTP	UDP	123	Synchronizes time across networking devices
TFTP	UDP	69	(unsecure) file transfer between network devices using UDP
SNMP	UDP	161,162	Network management