In this video and lab, we're going
to take a look at troubleshooting standard access
control lists.
I mean, what could go wrong!
Well, let's create a scenario, we'll use the topology,
we'll implement some access control lists together,
and then we'll see first hand what's wrong,
and then also how to troubleshoot it.
And here's the lay of the land for this set of labs.
Over on this side of the network,
right here, it's going to start with 10.1,
and over here is going to be 10.2,
and that PS is going to be 10.0, then I've
got RR representing the router numbers.
Like between R1 and R2 it's going to you the 12 network, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Like between R1 and R2 it's going to you the 12 network,
R3 and R4, our 34 network.
That way it's a lot easier when you see a route to realise, oh,
where's does that belong in the topology.
And then also for IPv6, which we're going to be covering
as well, IPv6 is using 2001:DB8:6783,
and then those same numbers again,
the router number's between R2 and R4, 24 and so forth.
Also, every router is going to end with its router number,
whether it's IPv4 or IPv6.
So let's do this for our game plan.
Let's go down here to R8, and I've currently got a client
up here in the lab. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
up here in the lab.
It's our client PCA Windows machine on the 10.0.1 network.
Currently, it can access a web server down here
at 192.168.1.00.
What we'd like to do is set up some access control lists,
a standard ACL, here on R8, and we'll
apply it to fa 4/1, that is going to go ahead and block
that traffic.
[LAUGHS] And in the process of doing this, you and I,
in this hands on lab, we're not going to block that traffic,
but we're going to have some interesting observations
and insights regarding how would we
troubleshoot when an access list, a standard access list, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
troubleshoot when an access list, a standard access list,
isn't quite working as we expected.
So without further ado, let's go ahead and go to the lab
environment, click on the link for the virtual lab,
and let's do this together.
So here we have some representing routers,
and over on the right we have tabs for the management
computer, that's DC Nug, where we're sitting, also
for the client PC, which is right here.
So from the client PC, if we go to a command prompt,
and there's several ways of getting there,
any way you want to get to a command prompt is great.
And at a command prompt, let's do
a couple things, IP config, just verify where we're at, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
a couple things, IP config, just verify where we're at,
got some IPv4 and IPv6 addresses, great,
and we're on the 10.0.1 network.
And if we do a trace, T-R-A-C-E, space dash d,
or don't bother doing memory resolution,
and go to 192.168.1.100, that is the IP address of our web
server on the bottom right hand side of our topology.
And I just want to verify the path.
So this is going from R1, to R2, to R4, to R6, to R8,
then to the web server, just want
to get a clear picture of the path to the network. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to get a clear picture of the path to the network.
If we look at our topology, it looks something like this.
So from R1, to R2, to R4, to R6, to R8, and then
to the web server at 100, great.
All right, so let's set up some access control lists
to filter the 10.0.1 network and a few others,
and then we'll actually apply it to the inbound interface here,
fa 4/1 on R8.
All right, let's head over to R8,
and that's back on our management computer
and we'll go to R8, and here on our right,
let's create an access controls. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
let's create an access controls.
Now the first thing in troubleshooting
is, before we start adding an access list,
make sure we know what we have first.
So it'd be wise to do a show access list,
just to make sure we know what we're dealing with.
OK, no access list yet, or any purposes, whether it's--
I definitely traffic for quality of service,
or for filtering, or for policy maps, or anything else,
there's no access this.
Let's create one.
So we have a couple options.
As you know, we can you use a standard access
list with a number or we can use standard access
list with a name.
And either way, you create the access control list, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And either way, you create the access control list,
you can always go back in later, as
if it is a named access list, for editing,
which is very, very helpful.
Let's do an IP, let's do named, access list.
And we'll go standard, and let's call this list name List 1,
in upper case.
All right, just the list part is an upper case,
that 1 is just a number.
All right, and let's do a deny, and let's go
take a look at our topology.
Let's deny anybody coming from 10.0.1, that network
up here on the left.
And we'll go back to our interface, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we'll go back to our interface,
and we'll do a deny, 10.0.1 And then, to specify,
we don't care about the last octet,
we'll use a wildcard bits of 0.0.0,
which meaning matched on the first three octets and 255.
We don't have to match in the last octet.
Also, with wildcard bits and ACLs,
they do not have to be contiguous.
So if you get creative with certain bits within an octet,
they have to match or not match, you can do that as well.
Here we're going to deny the whole 10.0.1 subnet.
And we could also add the keyword log,
get more detail when that's hit. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
get more detail when that's hit.
Now, in some applications of an access control list,
like for example, as part of a policy
map with control, plate, and policing,
and so forth, it won't like the log.
And so if that happens, if you try to use an ACL
and it has the log key word, it'll say, oh, can't do that.
So otherwise, you feel free as the log option.
And next, let's deny another subnet.
Let's go ahead and do a deny 10.0.12.
So anybody sourcing traffic from the 10.0.12.
Now as you know, standard ACLs only
match on source IP information.
That's their whole game. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
That's their whole game.
They don't have any option of matching
on layer 4 protocols, or destination, or anything,
it's just layer 3 source.
We could also deny a specific host.
We'll do a deny, the keyword host, 10.0.13.1,
and we can add log or not, and that's matching on the 32 bits.
We could also do this.
If we want to deny a specific IP address,
we can leave off the host.
You can actually do deny and then the IP address, 10.0.34.4,
for example.
And it means the same thing, that exact 32-bit address. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And it means the same thing, that exact 32-bit address.
So whether we use the keyword host,
or wildcard bits of all zeros, or we just
put in the IP address, it means the same thing
to this access control list.
And their processed from top to bottom,
and there's the implicit deny any at the end.
So if we were to apply this access control
list on a router, there's no permits.
So unfortunately, it would deny all traffic
that was inbound on that interface,
if we apply it inbound.
Now, as an example, let's go back to our topology.
Right here, on R8, if we apply this outbound on R8, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Right here, on R8, if we apply this outbound on R8,
access control lists for filtering
don't block router generated traffic.
So if we applied this outbound on fa 4/1
or outbound on serial 3/2, the router
would say, hey, if I'm generating traffic,
if I'm responding back to an administrator,
or I'm sending an SNMP trap, or some other message,
or I'm sending a routing update, it
doesn't apply to the router generated traffic.
But if we apply it inbound, any traffic
trying to come into the router, or if it's routed traffic,
so the router's routing for somebody else, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
so the router's routing for somebody else,
then it's going to apply.
So let's apply that access control list inbound
on fa 4/1, which should deny traffic from this client
up here.
Before we apply the access control list,
let's go back to our client.
Let's open up a browser.
So I know we pinged the server a moment ago,
but let's go to a web page, 192.168.1.100,
press Enter, it'll use HTTP by default.
And sure enough, we have web services that are reachable.
I'll go out and close that browser on the client,
we'll go back to our management computer, which is DC Nug,
and let's apply that access control list. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and let's apply that access control list.
We'll go to interface, let's do it, do show IP interface brief,
so we can apply it to the right interface.
We want to apply this to fa 4/1, that's the interface that
goes from R8 up to R6.
And it's also, based on the trace we did earlier,
it's the interface in the path.
So we'll go to interface fa 4/1, and IP access group,
which, you know, that's how we apply a IPB4 access list, IP
access group, and then the name of the access list, which is WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
access group, and then the name of the access list, which is
List 1, we'll copy paste that.
Also, if we apply an access control
list that doesn't exist, it's not going to do any filtering.
So even though the interface will
show there's an access list applied,
if that access list isn't really created, isn't real,
it's not going to block any traffic.
However, this one will in a moment, and we'll say inbound.
And we are good.
Then what we can do is, we can go back
to our client, who just a moment ago was
able to do a trace route and also the web access
to the server.
Now, if we do this, traceroute-d, it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now, if we do this, traceroute-d, it
made it to router 1, router 2, router 4, router 5,
and then router 8 says, I'm killing you.
All right.
But something interesting happened on the way
to this access list, is that if we wait just for a few moments,
and do that trace again, and let me just give us a few more
additional moments for the network to converge.
Because what we did is we don't have a permit statement
inbound on that ACL, that's applied inbound WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
inbound on that ACL, that's applied inbound
on that interface, so we're also going to kill OSPF.
And when we kill OSFPF between R6 and R8,
let's take a look at our topology,
we kill all OSPF here, that's going
to stop R8 from advertising the reachability to the 192.168.1
network, where the server lives.
And effectively, in a few moments,
the entire network, besides R8 himself, they'll
all forget how to reach that network altogether.
So trace routes are going to stop immediately,
because that route is going to be removed.
And in troubleshooting, you want to say, well, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And in troubleshooting, you want to say, well,
why are we losing our routing?
It's because you're killing inbound traffic on the fa 4/1
interface, including OSPF from R6.
So that should have bought us enough time, let's go back.
And let's do that trace again.
So our first opp is the router 1, 10.0.1.1.
And then router 1 says, I have no route anymore,
because that route is missing.
So to troubleshoot, we'd just go back to our router, router 8.
And sure enough, there is our--
we've lost our neighborship. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we've lost our neighborship.
And also, right here, it's showing
list 1, denied a packet.
Also it's interesting that it's not
going to show us console messages
for each and every deny, which is good.
Because if there is thousands of packets
and we had thousands of console messages,
that wouldn't be very good.
So what it does is, it gives us a message
on the first time it happens, and then, I think, by default,
there's a five minute interval.
And then five minutes later, it's
going to count up the total, since that first hit,
and give us a summary.
OK, in the last five minutes, here's
how many times that's been hit. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
how many times that's been hit.
So for troubleshooting we can do a, do show access list.
What that will do, that will go ahead
and give us more information.
So we're denying 10.0.1.
But that's the only explicit match that we have here.
And you might be thinking, well, how
come OSPF died, where's that?
That's the implied deny.
So what we might want to do is, we might want
to add an additional line at the end or an explicit deny,
that way we can get hit counts of what's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that way we can get hit counts of what's
going on with that deny, instead of just saying,
where did it go?
Also, I want to point this out to you, this is super fun,
this has been around as long as I remember.
I've been doing Cisco for 20 plus years.
Look at this order of this standard ACL.
We put them in this order, 10.0.1.0, 10.0.12.0,
and then 10.0.13.1, 10.0.34.4.
So when you do a show run or you show access list
and it shows you them in an incorrect order,
logically, the processing, as far as the logic of what WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
logically, the processing, as far as the logic of what
will happen as a result of a combination of those access
lists, as if they were processed from 10, 20, 30, 40.
The results are the same.
Has anything to do with the hashing and optimization.
It's wacky, but when you see it, and it doesn't always happen,
but depending on the types of ACLs
you have, if it shows up in weird
order like that, it's not a bug, it's simply how it orders them,
based on the hashing.
But the end result, the end result of the logic,
is the same as if they were processed in sequence
from 10, 20, 30, 40.
So let's add a permit statement. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's add a permit statement.
And to do that, we'll do a do show history, hit 3,
there's an s in there, history.
All right, to show history, I'm going to go back and--
oh, my history buffer isn't quite big enough.
That's OK, I'll type it in again,
IP access, and the name is List 1.
And what it's going to do is it's automatically
going to sequence the next number, which
I think we're up to 50 now.
So anything I put here will go at the end.
So we could do a deny any log. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we could do a deny any log.
And at least we get information about the denies
that are happening, if we do a do show access list.
So there we are at 50, and we have our match,
and it shows us that we denied a packet from 10.2.68.2.
Which is our 6 saying, hey, we used to be OSPF friends!
[LAUGHS] (SINGING) Won't you please, won't you
be my neighbor.
Nope, because we're denying that traffic.
All right, so to solve this, here's what we can do. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
All right, so to solve this, here's what we can do.
Let's do a no 50, so we're in access list configuration mode,
and do a do show access list, and then we'll do a permit.
You can also explicitly specify what line you want
or what sequence number you want.
Permit any source address, and now we'll
do a do show access list.
And now, our OSPF neighborships should come back,
the traffic from all the denied IP addresses or ranges
should be dropped, but at the same time,
we're not losing all the routing.
So if we go back to R1, it was just a little WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if we go back to R1, it was just a little
while ago, we go show IP route for 192.168.1.--
[SCREAMS] 192.168.1.0.
OK, so it's got its route back now, which is great.
Earlier, when OSPF was broken, it
didn't have a route for 192.168.1.
Now we can do a trace right from here or from the client's.
And it would go all the way down to the destination,
except for the PC, which we blocked at 8R.
So let's do a trace route to 192.168.1.100, which WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's do a trace route to 192.168.1.100, which
is our server, our web server.
And the last octet, conveniently, is, yeah--
oh!
Why is it blocking us?
Time to troubleshoot!
All right, so on R8, let's do a show access list.
Oh, 10.0.12, that's our bad boy right there!
So when R1 sourced this ping, it sources it
from the closest interface, from the routing table perspective.
So it would have sourced it from 10.0.12,
and that's why it killed it at R8. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and that's why it killed it at R8.
So if we source that trace from somewhere else,
it would not fail.
So let's go-- or from a permitted address.
So let's do a trace route.
And let's see if we can do this on one line, trace route,
[LAUGHS] press Enter, I'm just going
to walk through it, IP yes, and 192.168.1.100,
and source address, there we go.
We'll do it from 1.1.1.1, which is the loop back here on our 1.
Let's make sure-- oh, I'm on R8. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's make sure-- oh, I'm on R8.
Dang it!
Hold on a second!
Let me make sure on R8 we have a route back to R1,
show IP route.
And sure enough, we have a route back to R1,
it was there, right there.
So on R1, let's do a trace route.
Oh, my gosh, all right, trace route, IP, yes,
thank you, as opposed to IBP6 or something else.
And we want to go to 192.168.1.100,
source address is going to be 1.1.1.1,
and we'll take all the defaults for the rest. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and we'll take all the defaults for the rest.
And this should go all the way through,
including going through R8, because we are now
passing the access control list that's inbound on fa 4/1
on that router.
All right, let me take a look at my notes
and make sure I covered everything
that I intended to in this discussion about access control
lists.
Standard ACLs, source only, there's
the implicit deny at the end, routed generated traffic
for itself, if you have an outbound ACL,
doesn't apply for router generated traffic, only
for transit traffic. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
for transit traffic.
The log keyword can be helpful in identifying
what's being dropped.
You can explicitly put a deny in , which is helpful as well.
And then the order for standard ACLs is wacky sometimes,
but the logic will be the same, as if they were processed
sequentially in order, it won't ruin
your logic from your structured access control list.
And also, if we wanted to, we could apply an access list
for filtering purposes inbound on a VTY line
with the access class command.
And that can control who can come in, via SSH or telnet,
if you're still using that, inbound on those VTY lines. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
if you're still using that, inbound on those VTY lines.
All right, so thanks for joining me
in this discussion and lab regarding standard access
control lists and troubleshooting them.
And in the next video, we'll take a look at extended ACLs
and troubleshooting those.
So I'll see you in that next video and lab in just a moment.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.