In the previous video lab, we looked
at implementing and troubleshooting
standard access control lists when they're
used for filtering purposes.
Well, in this video and lab, we're
going to do a similar approach, but this time
for extended access control lists.
Let's take a look at the topology,
and we'll work up a scenario, we'll implement it,
and we'll troubleshoot it together.
Now, one of the benefits regarding access controls
lists when they're used for filtering,
in general, is that a lot of the same rules apply.
They're processed from top to bottom,
if we apply them to an interface.
And let's use R8 again, and if we apply it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's use R8 again, and if we apply it
to an interface inbound, that means traffic that's
coming into that interface, it's going
to go through the access control list, look for a match.
Once it finds a match, it's going to execute the permit
or deny, and if there's no matches at all,
there's an implicit deny at the very end, which
is going to drop that traffic.
And that includes traffic that is being routed
by R6 to go through the network, or if it's
traffic destined to R8, if it's inbound,
the ACL is inbound on R8, and it says deny, it's over.
Now, just like a standard access list though,
if we have an access control list that's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
if we have an access control list that's
applied outbound on an interface, like serial 3/2,
no matter what is permitted or denied in that access control
list.
If there's router generated traffic
like the router is sending in an SNMP trap
or it's sending a message-- or it's communicating back
with an administrator, if it's router generated traffic
going out of that interface, the access list,
applied outbound on that interface,
has no negative impact on that traffic
that the router generates.
However, traffic that's being routed through the router.
Wow, look at that, a little squiggly line. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Wow, look at that, a little squiggly line.
Through the router, that traffic is
going to be subject to the conditions of the outbound ACL.
So another big difference, of course,
between a standard access control list and an extended
is that the extended access control
list can filter based on source IP information, just
like the standard.
However, it can also filter based on destination.
Also, the extended access control list
can filter based on virtually anything at Layer 4.
So the Layer 4 protocol, whether it's SSP, TCP, or UDP, or ICB, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So the Layer 4 protocol, whether it's SSP, TCP, or UDP, or ICB,
or whatever it is, it can match and filter
on that for both source and/or destination.
So it's very, very flexible.
So as far as the plan goes, let's do a similar treatment
as we did previously.
And let's block 10.0.1, that subnet,
from being able to access the web server down here,
if they're using HTTP, which is TCP Port 80.
And then let's allow everything else through,
and we can apply that inbound here on fa 4/1. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and we can apply that inbound here on fa 4/1.
And if it doesn't go well or if we have a problem,
we can take a look at doing the show access list,
we can set up troubleshooting, and walk our way through it
logically.
And this troubleshooting of standard or extended ACLs
is important, not just for filtering ACLs,
but also for access control lists
that are used for any purpose.
Are they being matched, are they being
implemented the way we want?
And so working with the access control list for filtering
will help reinforce those other skills as well.
So in the lab, let's go to our client PC.
And let's just verify that we can reach all the way down WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's just verify that we can reach all the way down
through the network.
And we'll bring up a command prompt,
any way you want to bring up a command prompt is great.
Computer management wouldn't be the best option,
I meant to go for a command prompt here.
All right, so there's a command prompt and let's do a trace,
trace rt in the windows, dash d for don't bother
doing the name resolution.
And we'll go to 192.168.1.100, just
to verify we have reachability.
Now, when a Windows computer does a trace,
it is actually using ICMP.
When a Linux box or a Cisco router does a trace, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
When a Linux box or a Cisco router does a trace,
it's actually using UDP at Layer 4.
That's a difference as well you'd
want to be aware of if we're setting up access control
lists to filter and permit certain types of traffic.
Also, we open up a browser, we could
go to that IP address of the server, and get a web page.
In fact, let's verify that real quick.
[LAUGHS] Easy for you to say, Keith, is it true?
Well, let's verify it here in the lab, 192.168.1.100.
And survey says, boom!
There's our web page, great, great, great, all right.
Let me close that browser window,
we'll leave the command prompt open for a moment. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we'll leave the command prompt open for a moment.
Let's go to DC Nug, the management computer,
let's go to R8, and let's, now that we've
verified that we have connectivity to the network,
let's create an extended ACL, so IP access list.
And if we wanted to do numbered, we could, or named.
If you create a numbered ACL with standard or extended,
you can also go back and edit those as if they were named.
Which is very, very convenient, if you want to remove a line,
or modify a line, or insert a line, very, very helpful.
All right, IP access list extended, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
All right, IP access list extended,
and we'll call this List 2.
All right, and let's go ahead and do some denies.
Let's do a deny, and we have a lot of options here.
So it's saying the entire IP protocol stack,
that's what the IP keyword is.
If we want to do an IPv6 access control
list, coming up in another video,
we'd use the IPv6 command.
So we'll take a look at that a little bit later.
But wow, look at this, authentication header, EIGRP,
ESP, GRE, ICMP, IGMP, lots of options here, OSPF. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
ESP, GRE, ICMP, IGMP, lots of options here, OSPF.
So if we want to block IP traffic,
we can say IP, and then a question mark,
and then we can specify--
well, so if you go back here.
If we said, like for example, TCP, let's do that.
Let's block just HTTP traffic from the client
on the 10.0.1 subnet.
So we go to TCP, and now it's asking us for the source.
So for the source network, let's do the network 10.0.1.0.
And the wildcard mask is going to be 0.0.0,
saying we care about matching on the first three octets,
but the 255 means we don't care about the last octet. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
but the 255 means we don't care about the last octet.
And that's regarding the source.
And then we can do a question mark.
And right here, if we wanted to specify a source port,
this is where we would put it.
Like when the users on 10.0.1 are initiating HTTP requests,
they're just going to generate a random source
port that's higher than 1,024.
So we don't know what that part's going to be.
So we can leave it off, and then we
can go right towards the destination address.
Though, if we're not going to match on the source port
number, we just go on to the destination IP.
Which is going to be-- WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Which is going to be--
let's go specifically to the server.
The host at 192.168.1.100, we also
could say, 192.168.1.100 and then 4 octets
of zeros for the wildcard bits, that would work as well.
And then we're going to specify the destination port,
and we're going to use the keyword of EQ for equal.
And then, we can either use the actual port number,
like HTTP, which is on this list.
Why is it-- oh, you know why, they call it WWW, right here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Why is it-- oh, you know why, they call it WWW, right here.
So we could use the keyword WWW, or if you just
want to be sure it's port 80, boom, you put in 80,
and it'll automatically put that keyword
in when you look at your ACL.
All right, so deny TCP traffic from 10.01 anything
going to host 182.168.1.100, if the destination port
equals 80, boom.
And we'll do a do show access list.
And there we go.
And it put the little key word in for us, WWW.
So that's our deny.
And if we just apply this access list to inbound on fa 4/1 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And if we just apply this access list to inbound on fa 4/1
on R8, we would have problems, because?
Because?
Why?
You remember?
Yeah, there's an implicit deny at the end.
If we applied this, it would deny that traffic, yes, match,
and the implicit deny would deny everything else.
So if we wanted to specifically allow OSPF or Unicast
traffic from our neighbor, we'd want
to add all those in as well.
So I'm going to put in sequence 20
as permit IP, which means it could be-- that's the Layer 3. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
as permit IP, which means it could be-- that's the Layer 3.
So it could be any layer, we're not matching on Layer 4 stuff
anymore.
Just saying IP, any source, any destination,
and we can log that as well.
If you want to log it, maybe you don't
want to log it, so either way.
Now we have this access control list.
If we do a do show IP interface brief,
let's verify we're going to apply this
to the right interface.
So this is the interface, based on that 68,
that's the interface that's going between R8 and R6,
so we can apply it to that interface.
Interface fa-- what is it, 4/1. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Interface fa-- what is it, 4/1.
And in the lab, I'd encourage you to practice along with me.
And let's do a do show IP interface for fa 4/1,
this is important too, to verify whether or not
it has an access list applied.
So right here, it says, no inbound access control list
applied.
So we'll fix that by doing an IP access group, and the name
of our list, which--
was it List 2?
We'll find out.
List 2, and that's inbound, inbound traffic. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
List 2, and that's inbound, inbound traffic.
Let's do a show access list, just
to verify that it is List 2.
It is List 2, yay!
And we have one match here, fantastic.
All right, and it was 225005, which
is our OSPF hello messages coming in from R6,
great, great, great.
And again, that won't happen, even though the hellos
happen very frequently, I think it's every 10 seconds for OSPF,
it won't show us that message every 10 seconds.
It'll queue them up, and then at the end of a five minute
interval, I believe that's the default on the version of iOS, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
interval, I believe that's the default on the version of iOS,
it'll then show us another message.
This happens so many times in the last five minutes.
And that way we don't have just console message
after console message of all those logs.
All right, so let's verify that our client can't get past
there.
And we'll go up to our client, we'll do a trace route.
Now, trace route on a Windows computer is using ICMP,
ICMP is not being denied by the ACL.
So that should work, yay!
And the crowd goes mild. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And the crowd goes mild.
But if we bring up a browser by double clicking
on the desktop icon of Chrome, and then we
go to 192.168.1.100, which by default will use HTTP,
which is going to use TCP Port 80 as the destination port--
oh, is that cached?
I think that's cached.
So what happened-- it's like, boom, it's there!
So I just click on refresh, see how it's
spinning there on the top left?
And if we go to the command prompt and we do a net stat-- WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And if we go to the command prompt and we do a net stat--
oh, I need to do a Control C.
Net stat space, then you do a def question mark.
I don't want name res-- there we go.
Let's do a a net stat dash n, there we go.
And that would be a little bit faster.
So here it's showing us that the local address, these
are two source ports that we're trying to go into Port 80.
We've sent the send request [GROAN]..
The three way handshake is not completing,
because we're sending those to Port 80, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
because we're sending those to Port 80,
and the access control list on R8 is killing them D-E-A-D,
it's crushing it.
So in troubleshooting or working with an access control list,
some of my favorite commands would
include, let's go back to DC Nug, our management computer,
go to PC8, and go to the router, and show access control lists.
Because that's going to give us counters, which are important.
If we don't have an explicit deny,
we might want to add one, just to see
what we're denying at the end.
And that's always helpful too to tell troubleshoot and verify. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that's always helpful too to tell troubleshoot and verify.
Wow, why isn't this working?
That's because you're killing tons and tons of traffic
and you're not letting it through.
So I've had a great time in his lab and video,
I'm glad that you joined me for it.
So in our next video, we're going
to take a look at time based access control
list and some gotchas that can make them not work as expected.
That's all coming up in the next video.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.