So now that we've wrapped up Standard Access Control Lists, let's dive into
Extended Access Control Lists. So the thing about Extended Access Control Lists
is that you will have to be really, really great at reading them and
understanding what each and every single entry does. So when you look at what we
have here now is we have an entry that has permits and denies just like our
standard, but now we have protocols specified like IP, TCP, UDP, EIGRP, OSPF.
We have then the source of the packet, so source IP address, which would match. So
we're gonna specify either the exact IP address with host or we'll specify a
range with a network ID and a wildcard mask and so on and so forth. And then we
even have operators and port numbers that go into there, followed by the
destination information, followed by operators and port numbers for the
destination. Whoo, that's a lot. A lot. So let's go out to our router, our number
one, and let's go ahead and take a peek at all the different options that we have
available to us that are relevant for the certification exam. So Access List
101 is an example for an Extended Access Control List, and you'll see here that we
have permit, deny, and we have remarked. There's also dynamic as an option, but we
will not get into dynamic here. That's a Dynamic Access Control List, and Dynamic
Access Control Lists are added based on some other condition. For example, like
if somebody successfully authenticates, then we could have a Dynamic Entry added
to the Access Control List based on their successful authentication to allow
them to do what they need to do, but then once that authentication period expires,
then they will no longer be, that entry will be removed. So it's a Dynamic Entry
that gets added and removed based on some other condition that happens. But
for this exam, those will not show up. So let's just use permit in this example,
and then you'll see here, this is where we're going to specify our protocol. So IP
is listed there. As you can see, IP means all protocols. So if you type IP, it
really means any, but if you wanted to do TCP specific, or UDP specific, or PIM
specific, or OSPS specific, or IGMP, or ICMP, or ESP, or AAH, you can see a lot
of them are listed there that we've talked about in this course. But then
also, if you know of one that's not listed, but you know its protocol number
by looking it up on IANA's website, then you can just specify the protocol number
here instead of the actual name. So the name is only listed because those are
the most common ones that might be used on your Cisco iOS router, but if there's
an uncommon one, and you know its protocol number from IANA's list, then
you can go ahead and just put the protocol number in there instead. For
example, like TCP's protocol number 6, so you could type in 6 here, or you could
type in TCP. UDP is 117, so you can type in 17 or UDP. OSPF is 89, so you can type
in OSPF or 89. It would be the same thing. Then after you type in something like IP,
so we'll do an IP example here, then we can specify the source address. We can
specify, and when we specify source address, that would mean the first part
of your address slash wildcard mask pairing, so like 10.0.0.0 or 10.0.0.10,
whatever the address that you would put in for the source. If you wanted to do
all source addresses, you put any. If you wanted to do just a specific source
address, a single source address, you could type in host. Now you don't have to
type in host because you could type in, for example, 10.0.0.10 and then type
in 0.0.0.0, and you get the same result because 0.0.0.0 means
match, match, match, match, match, match, match, match, match, match, match, match, match, match, match every
single IP address bit, which means this exact address. So you can either do 0.0.0.0.0
or you could type it in this way if you wanted to. They mean the
exact same thing. And then what else do we have? We have object group, which is
beyond the scope of this course, and certification exam. So let's type in
something like 10.0.0.0. Then we've got what? Our source wildcard bits, so
let's match every address from 10.0.0.0 to 10.0.0.255. Let's do that. So this is
what our wildcard mask would be. And then once we do that, it asks us for the
destination information. So let's say something like 10.0.254.0, and
then the wildcard mask would be 0.0.0.255 for fun. All right, so that
would be any traffic coming from 10.0.0.0 through 10.0.0.255 going to
10.0.254.0 to 10.0.254.255. We want to permit that traffic, right? So being able
to do that on the certification exam is really important for you to be
successful. Now you can see there's some other values we can match here. So you're
not gonna have to worry about matching like the time to live of the packet or
the type of service value for quality of service for the packet or the DSCP
value for quality services packet or even fragments. Log might come up and log
would just be about you creating a log entry, a syslog entry for every
match that you have on that particular entry. So not something you want to do
unless it makes sense for you to log. Like if I want to log
everybody who's trying to access my VTY line as an example, then maybe I want to
log those ones so that way there I have a log of access, permitted access and
maybe even and more importantly denied access. So maybe I'll create an entry in
that one that says deny any log and that way there when people try to access my
VTY lines if they are not coming from the appropriate IP address and they've
been denied, then I'll have a log entry for that. Log input would also log the
input interface in that particular case. So if the exam talks about just logging
your match entries and log, if they talk about logging your entries plus
including the input interface, then you would put log input in that case. Time
range we'll talk about later. So time range will come up possibly on the exam
so we'll definitely come back and talk about that one when we get to our time
based access control. Alright so there's just a simple example. So do show access
hyphen list 101. That's what we have for an IP example. So now let's talk about a
TCP example. So I'm just going to type in access list 101 and then we will type in
permit and we'll type in now TCP as an example. Because once you type in TCP as
your protocol, so TCP, now things are going to change slightly for us. We still
get asked what our source is. So let's type in something like 10.0, source
doesn't really matter right now, or 1.0. 0.0.0.255. Now it's
going to ask me for what? It's going to ask me for an operator and then followed
by the operator it's going to ask me for a port number associated with TCP. This
is where you are going to have to be very, very, very, very extra careful on
the certification exam. So why do I say that? Why do I say extra, extra,
extra, extra careful in the certification exam? Because you, if not paying
attention, may miss out on the operator and port number as potentially part of
the problem. So let's diagram something up here on the screen. So let's go ahead
and put a PC here in this example. Let's put a router here. Let's put a server
here as an example. And traffic folks is flowing this way. Do we know the exact
port number of the source in this case? Yes or no? Let's say this is a web server.
Do we know the exact source port number that that client is using? No we don't,
right? Because it is dynamically chosen by the client when establishing that TCP
session. Now would we know a range potentially? Sure, right? We know it's the
ephemeral port range. So we could actually put in, as you can see, the range
in this particular case if we wanted to. Or you can leave a blank. If you leave a
blank, then that means all source port numbers from 0 to 65,535. So if it's
blank, it means all source. If there's something in there, then it means that.
Think about this. What if we accidentally typed in equal to 443 here? Would that make sense in
this scenario? If this is 10.0.1.0 network? No, it doesn't, right? That does not make sense because
this is source port when it comes after the source address, right? That is what?
That is the destination port, not the source. So be mindful of that. Be very
careful. So let's put in something like this instead. Range. And our range is
going to be a 1024 to 65,535. Just for fun, just for demonstration purposes.
Now, when I put in question mark, now I can put in my destination. So let's say this is a server
in our server farm. And let's say the subnet or the network for that is 10.0.50.0. And it's 0.0.0.255
for our wildcard mask, right? Now, again, you'll see it's going to ask us for a lot of different
options. So all of the options that we saw for the IP example we did. So if I go back here,
this were all the options for the IP example. So they're all there as well. But now what else do
we have? We have TCP specific values like matching established TCP sessions, or packets only with
a fin bit set, or packets only with the push bit set, or the reset bit, or the sin bit set. So you
get pretty granular here. Those are not exam relevant. The established one might be. For
example, if you have to match only established TCP session, then you would have to type in what? You
would have to type in established. And then that way there, it's only established TCP sessions
don't match. If it's not established, then you won't match it. So pay attention to the details
on the certification exam. And then that way there, you'll be able to pick the right option
or even craft an access control list to meet that. So it is possible that, you know, they
might ask you about ACK, right? Match the ones with ACK. Well, remember that there's an ACK
option for TCP. Match the ones with push, right? So the odds of that coming up are slim, but,
but, right, just remember, when you specify TCP as your protocol, those becomes options at the end,
and therefore you can match it. You can match it. But here, let's make sure we understand our port
numbering. So this is the destination. What's the destination port number? The destination port
number is going to be 443. So in this case, we could type in equal to 443. Would be beautiful.
So you have to make sure that you understand the scenario, the situation, the traffic flow,
and that the ACL matches that perfectly. If not, that's your problem. If it is, if it does match
perfectly, then that's not your problem. Move on to the next entry, and the next entry. Now,
by a question mark here, again, you'll see whatever is left are things like what,
ACK and everything else. So again, you could still match the time range if you want to,
or steps. Yes, they get lengthy, but we'll leave it at that for right now. So do show
access-list 101. All right, so there you go. Now, just to show you what those port numbers,
let's go back to that. I'm going to back up. I'll hit question mark. You'll see here how
there are common names for common port numbers according to Cisco iOS. You might be looking at
some of these and going, that's not common for me. I know. But you'll see, I could type in www
if I wanted to, and that would be for port 80. If I wanted to type in something like
Telnet, I could actually type in Telnet versus port, for example, 23.
So you have the opportunity to either do name or port number in these particular cases.
And what you see in this list, though, are only TCP-related services. You would not see
UDP-related services in here. Why? Because we specified TCP. And if we look now at my
access control list, it doesn't know that I created the same one twice, does it? Yeah,
it does. So notice when I typed in 23, because I already had Telnet for that,
it didn't even create it for me. It doesn't matter. It knows. It's a little smart,
the Cisco iOS, to figure that stuff out, which is good.
All right, let's look at a UDP example then. So access-list 101, permit. It could be denied,
doesn't matter, but I'm not going to give you the permit versus deny examples here,
because it doesn't really matter in the end. It's just about reading it on the exam. If it
says permit, it means permit. If it says deny, it means deny. All right, so now we've got UDP. So
again, we're going to do sources. So 10.0.2.0 for fun, 000255. Again, the wildcard mask in that
number can be a variation of a multitude of things, as we've talked about. And then we've got
our source operator and port number that we're going to have to specify. So I'm just going to
leave a blank this time, instead of specifying a specific port number. And then from there,
we're going to have what? We're going to have destination. So destination address instead. So
let's say any. So any destination. And then now it's showing us various options that would be
related to UDP, which are not very many, but typically we've got our IP options here, like
we saw before, plus also the operators. So for example, equal to a certain type of port,
could be greater than, less than a certain port, range of port numbers if we wanted to specify.
So again, what's the destination? What service are we trying to reach? So in this case,
maybe a syslog server. Maybe a TFTP server. Maybe it's an NTP server. Maybe it's RIP we want to
permit here in this case. So let's, let's pretend it's NTP. So one, two, three, as an example,
right? So the key here is to make sure that you have the ability to look at your access control
list and double check and verify. Is this really, is this really UDP? Because what if Cisco on the
exam has this as TCP? Well, then that's your problem, right? What if they had this as UDP,
or this is UDP, or this is UDP? Well, that's your problem. Because 443 is TCP. Port 80,
it's TCP. Port 23, Telnet, TCP. Port 22, SSH, is TCP. So knowing the difference between UDP
port numbers and TCP port numbers for this exam is valuable.
So that way there, you have the ability to pick them out of a lineup when you need to.
And also pay attention on the exam to what they're asking you to match versus not match. Because
although I've shown you equal to, and I've shown you range, don't forget there's greater than.
So if you are told, hey, make sure that you match every port number greater than 80.
Greater than 80. Well, then you type in greater than 80. That would be port number
81 and higher. That's not port 80 and higher, that's port 81 and higher, greater than 80.
What about LT? Less than whatever number you specify. So if they say you want to match port
80 and higher, then it'd be greater than 79, right? Pay attention to the words.
Port 80 and higher would be greater than 79.
Because we don't have a greater than or equal to or less than or equal to here. We don't have that.
They tell you a range. You want to match this value to this value, then range.
So even this, if they said greater than or less than 70, or sorry, greater than 79,
greater than 79, less than 91. Greater than 79, less than 91.
Greater than 79, less than 71. Less than 91. You see that?
So even though they say greater than or less than,
doesn't mean that's what you got to use. Things to keep in mind.
So it's nice here that, oh no, wait, I typed in something wrong.
So here's an example of something that would be bad that you'd want to pick out on the exam.
See, it doesn't know. It doesn't know, right, that 22 is supposed to be TCP,
but you need to know that.
And then if you see examples with EIG or P or OSPF in them,
so for example, like access list, we'll just do one-on-one again.
And then let's just say permit and you type in OSPF.
Then you have the opportunity to put the source address, whatever you need. So let's say it's
coming from 10.40.12.1. No, it's 23.1 on that interface, 0.0.0.0. And then notice there's
no source port that they ask for. So destination 224.0.0.5 wildcard mask would have to be 0.0.0.0
because that's the hello packet, right? That's the hello packet.
And then you've got options for all of these, which don't really matter
when it's all said and done. But there's just another example of how
being able to read that, oh, that's for OSPF. Does that make sense for the destination? Sure,
why? Because that is the destination multicast address 224.0.0.5. That's an IP address of the
interface that hello packet's going out of. But here's the thing I also want you to realize
that outbound ACLs do not affect your dynamic routing protocols, but inbound ACLs do.
If I apply any ACL on an interface outbound, it's not going to affect my OSPF or EIGRP traffic at
all. It's not going to affect it at all. Any locally generated traffic by the router, so like
a ping, a telnet, a traceroute, anything generated locally by the router, OSPF packet, EIGRP packet,
BGP packet, doesn't matter. Anything locally generated is not affected by outbound ACLs,
only inbound ACLs, meaning that I don't have to put in the permit statements for all the
locally generated traffic by the router if it's an outbound ACL. But if it's an inbound ACL, I would
not be affected because that's traffic coming to me. It's not locally generated by me. So, any locally
generated traffic is not going to be affected by your ACLs.
All right, let's take a peek at our slides here. IP access list, extended test. So, in this case,
this is about creating an extended access control list using named access control list configuration
mode. So, just like we saw with our standard example, I can go ahead and I can type an IP
access list extended, give it a name, and then put all my entries in, just like we did here with our
numbered ACL. Just put them in. They'll be created in that order. And again, like we talked about,
editing those ACLs. So, you can go ahead and you can go back into the ACL configuration mode at
any time and delete things based on their sequence number. So, this means delete sequence
number 20. Now, sequence number 20 is gone. So, regardless whether it's a named or numbered ACL,
as I said, put the name here if it's a named ACL. But if it's a numbered ACL,
go ahead and put the number in there and it'll let you edit your numbered ACL as well.
And then if you ever want to add an entry, move an entry, do anything like that, well,
in this case is what it looks like now. And if I want to add in this sequence, sequence number five,
I put the sequence number in and I can go ahead and do that. So, sequence numbers are not something
that's available with your actual numbered ACLs unless you are using named ACL configuration
mode. So, named ACL, it lets you put in sequence numbers and control the order and reorder as you
need to. And then, so if you want to do that with your numbered ACLs, go ahead and use named ACL
configuration mode for your numbers by just typing in the number here as an example and
that'll put you in the named ACL configuration mode for that numbered ACL. Let's go back to
this right now and remind ourselves that order matters this way as well. So, not only does order
matter this way in our ACLs, but order also matters this way. And why do I say that? I say that because
of this, right? When you look at this ACL, it makes sense for all traffic that is flowing from
the end users to some server, some service, or let's say the internet. That's what it makes
sense because it's coming from the end user networks. What does that mean? It means that
this is an ACL that I would apply either inbound here
or outbound here. That's how I would apply this ACL because my destinations are always those
servers, always those services in this ACL, whereas my sources are my users.
What if all of this was flipped, folks? What if the sources were all the servers and services
and what if the destinations were the end users? Well, that would mean that the traffic is flowing
this way. And so, therefore, that ACL would be applied inbound here or outbound here.
So, just another thing to keep in mind that when you're looking at the ACL,
where is that network? If that network's over here and where are those networks that's over here,
does that make sense? The users, is that the right ports? Is that the right services and ports for
there? Yes, it is. So, it's got to be applied either traffic inbound here or outbound there.
But if we had an access control list where the server addresses were first and the server port
numbers were first and the destination were the clients, then it's for traffic flowing this way,
which means it would have to be applied here or applied here. That's really critical because
on the exam, you're at the professional level now. They're going to test you on your ability
to recognize stuff like that. So, what does that mean? It means that we can apply the ACL either,
this is our entire router, that's our entire router, either on our interface in the inbound
direction. So, I can take that ACL and I can apply it inbound as long as it makes sense based on the
entries that we have. So, entries matter up and down, but also right to left or left to right
when you're looking at them. So, that way there, you are creating the ACLs that make sense for
traffic flow. So, if I apply it on my interface in the inbound direction, that means when packets
arrive, that ACL is now going to be checked before anything else happens. So, if there is an ACL,
yes, there is. We test the statements. If not, then we just do our routing.
So, let's say there is an ACL. Now, we test each statement against that traffic,
top-down processing, immediate execution upon a match, plus denial at the end.
So, the question is, is there a statement that matches? And if so, is it a permit?
If there's no statement that matches or a statement that matches the denied, then you
discard it. But if the statement that matches is a permit, now we get to do our routing.
So, now that we route, is there a routing table entry? Yes or no. If there's not and there's no
default route, then we discard it. But if there is an entry, regardless of whether it's a default
route or some specific entry, then it's going to tell us what the outbound interface is.
So, then we send it to the outbound interface. Now, at the outbound interface, we have an access
controller. It's yes or no. If no, then we just simply send it out to the interface.
But if there is an ACL, then we got to test the ACL statements. So, the question now is,
the question now is, is based on these ACL statements, top-down processing, immediate
execution upon a match and plus denial at the end, are you permitted or are you denied? So,
if there's no entry, then you're automatically denied. If there's an entry that's denied,
then you are denied. If there's an entry that's permit, then you're going to be allowed out that
particular interface. So, how do we apply it to our interfaces? We apply it to our interfaces
with the IP access group command. So, remember the VTY lines that we saw earlier today, we did
the access class command. That's what we did, access class for the VTY lines. But for the
interfaces, we do IP access group. And then you specify the name or the number and then the
direction, in or out. So, in or out is in relation to our router. Inbound on the interface or
outbound on the interface. And so, being able to orient yourself on the exam appropriately,
so you can ensure that it's being applied correctly based on the entries that are in there
is a critical skill to have. Also, only one ACL is allowed per protocol, per direction,
per interface. What in the world does that even mean? Well, here's my router. Here's my interface.
I'm allowed one ACL per protocol. So, there's IPv4 that exists. There's IPv6 that exists.
Those are each protocols. So, I'm allowed one IPv4 ACL. I'm allowed one IPv6 ACL per interface.
However, we got to add to that, it's per direction. So, one IPv4 ACL inbound,
one IPv4 ACL outbound, one IPv6 ACL inbound, one IPv6 ACL outbound is an example
on my interfaces. So, I'm actually allowed two IPv4 ACLs on each interface,
one inbound, one outbound. I'm allowed two IPv6 ACLs on an interface, one inbound,
one outbound. Why is that important for you to know? That is important for you to know
because if on the exam there is already an existing access control list on the interface,
let's say in the inbound direction, and your requirements are to make sure that you deny
traffic from here to there. If you create a new access control list and apply it to the interface,
that will remove the original access control list off that interface.
So, even though you accomplished the objective, you destroyed the rest of the environment,
which means you're wrong. So, on the exam, if there's already an access control list on the
interface, you need to modify that access control list to accomplish your objective.
That's why this is important to know. So, how do you check there's already an ACL on the interface?
Type in show IP interface, the name, the number, and then if you go down, you'll see that they're
listed right here. So, inbound access list is sales. So, there you go. We already have one called sales.
So, because of that, I need to modify sales in order to meet the objections of the exam,
not create a new one and apply it to the interface because if I did, that would be
wrong because that would no longer be applied, which breaks something else. So, even though I
accomplished the objective, I broke something else, which means I did not accomplish the objective.
So, double check. And if you can't check, then that simply means that that is not a requirement
you have to worry about. So, always keep that in mind too. If it's something you can't check
because they're not giving you that information, then you have to assume there's no ACL on the
interface. So, being able to read output like this or read output in the running config about
your access control list and verify what interface they're on, what direction they're on,
all important skills to have. If you ever need to remove an access control list off an interface,
no IP access group. If you need to remove it off the VTY line, no access class. And then the name
or number of the access control list and then the direction in or out. So, basically negate the
command that you used to put it on the interface. And then if you want to delete an entire access
control list, you can do that. If you want to delete an entire access control list,
and then if you want to delete an entire access control list,
then you can just type in no access list the number. That'll destroy your entire access
control list. Or just delete a single entry and that'll destroy your entire
numbered access control list as we saw earlier today. And if you want to delete a named ACL,
then it's no IP access list standard or extended plus the name of the ACL.
So, just some things to keep in mind while you're troubleshooting. Is the ACL logic correct? So,
remember top-down processing, media execution upon a match, implicit deny all at the very end.
Keep that in mind. That's going to pay dividends on the certification exam. Always remember that
you got to just double check for any type of scenario. Is it applied properly? So,
was it applied properly for PBR? Was it applied properly for network address translation?
Is it applied properly for the directionality of the traffic flow for
the ACLs for security purposes? So, if the traffic's flowing this way,
do all of the entries make sense for the traffic flowing this way? The traffic's flowing this way,
do all the ACL entries make sense for traffic flowing that way?
And then, once you verify that, is it applied to the proper interface in the right direction?
Because if it's applied to an interface outbound when it needs to be inbound, well,
you got to fix that. All little things you got to keep in mind. All right. So, let's just do a
simple troubleshooting scenario here, folks. This is overly simplified. Could be simple like this
on the exam. It could be more complicated. But we'll see here that it simply says host 10.10.1.1
has no connectivity with 10.1.1.2. So, first thing you have to do is find 10.10.1.1, find 10.1.1.2.
And let's kind of get a general idea of how traffic would flow in this case.
So, traffic would be flowing this way. So, that means we could be affected by an ACL inbound here,
an ACL outbound here, even an ACL inbound here, or an ACL outbound there. There are four possible
ACLs that could actually affect us on that router or even on this router. It tells us that there's
an ACL applied here inbound. So, that's good. It narrows us down. Doesn't mean it's correct,
though. Always keep that in mind. And now we can verify. That would show access list 10.
And these are the three entries that we have. So, the question now is, based on what we see here,
folks, why does 10.10.1.1 have no connectivity with 10.1.1.2? What's your answer?
Because I see sequence number 20 actually says permit 10.10.1.1. So, we are, like, legitimately
permitting 10.10.1.1. We are explicitly permitting them right here. So, I'm lost right now. I need
help. Please save me, folks, from this trap I am in. Good. Yeah. So, I'm going to go ahead and
from this trap I am in. Good. Yeah. So, all of you are saying we have a sequencing problem here.
That's what we have. We are denying up here the entire range of IP addresses from 10.10.1.0
to 10.10.1.255. As a result of that, when this traffic reaches here,
our top-down processing hits sequence 10 first, and therefore that traffic is denied.
So, the traffic is being denied because of sequence 10. Why? Well, it's an order of
operations issue here. So, if we had to, if this was a multiple choice question, we could say
sequence 10 is denying our traffic. Let's say that was the answer. But what if we had to fix
the problem? Either pick the solution in the multiple choice or drag and drop the solution,
or maybe this is a simulation. We actually have to type in the solution. Well, in this case,
we'd have to move sequence 20 above sequence 10, right? So, this would be a good time for us to use
named access control as configuration mode. So, IP access list standard 10,
and then type in no 20, and then type in 5 permit 10.10.1.1. That's one solution.
Or the other solution is type in no 10, and then type in 21, and type in deny 10.10.1.0,
et cetera, et cetera. So, you know, different ways to solve the problem, obviously. But the idea here
is to recognize that as you are preparing for the exam, as you are reviewing, remind yourself
about how to look at these, how to walk through these, how would you likely fix this yourself.
So, that way, you have the opportunity to do so on the certification exam.
All right, what about this example here?
Give me your answer in this case.
Anybody see the problem yet? If you don't see the problem, put in question marks.
Andrew says, hold on, hold on.
So, in this case, we got 10.10.1.1, no HTTP connectivity. What does that mean? It means
Cisco is actually narrowing our troubleshooting right down, right down. Like, this is great. I
love it when they actually tell me which protocol, port, or service is having problems, because it
allows me to narrow my focus. When I start going through a list, especially if it's a large list
of IP addresses, it allows me to pick off the things that don't match really quickly. Because
if we saw that it was equal to 23, or equal to 22, or equal to Telnet, or equal to different
things like that, then we can immediately knock those off the list, because they don't matter.
What matters is HTTP in this case. So, that's number one. I'm looking for anything that has
HTTP in it, when it's all said and done. Port 80, port 443, stuff like that. So, again, our traffic
is flowing this way. So, we could be inbound or outbound here, inbound or outbound here, because
of bidirectional traffic flow. But in this case, 101's inbound, so we now get to narrow our attention
down to 101. And when we look at sequence number 10, it says, permit TCP 10.10.1.0. Okay, that's
10.10.1.0. Network, all the way to 0.0.0.0. So, 10.10.1.0 to 10.10.1.255. Okay, that matches that
address. It's applied inbound here, inbound here. So, that would be the source. I like that. Okay.
And then host 10.1.1.2 is the destination. So, that would be the destination. So, I like that,
because that is source, that is destination. So far, so good. But then I look at that.
Then I look at that. That is out of place in this case, because if this is the source,
they would not be using port 80. They would be using one of those ephemeral ports.
So, this needs to be changed, so it's here. That needs to be moved, so it's there. So,
how do we solve this problem? Redo sequence number 10, so equal to www is at the very end.
All right. You see that? So, great job. Now, pay attention, because I'm going to add on to this
in my next troubleshooting scenario. What I want you to realize is, if you look right now,
at this scenario, this situation, let me put that at the very end,
but this entire situation has changed now, and I want you to be careful with that on
the certification exam, because is it possible you could get the same image multiple times
with just slightly different output and even the same answer options,
but now the correct answer is different? Yes, that can totally happen.
So, for example, same image, slight modifications, like what? This is where it's applied now.
Notice it's inbound here. So, don't just assume that, oh, it's the same image. It must be the
same question. Oh, same answer options. I must have gotten the same question twice. I'm just
going to answer it the same way. No, no, no, no, no, no, no, no, no, no, no, no, no, no, no. Slow
down, because now there's some slightly tiny differences that if we're not paying attention,
we can miss. So, ACL's in a different direction now, but if we look at this, it says permit TCP
host 10.1.1.2, right? So, that is the source now, and inbound, that makes sense. Source,
source inbound, that makes sense. Destination is 10.10.1.0. Okay, that makes sense. That's
my destination. So, that's good, but look, WWW's at the end this time, so don't just fall into the
trap of thinking, oh, WWW's at the end. It's right. In this case, it's wrong, because the source
is the server, the web server, and the web server, when responding to me, would be using what? A
source port of WWW. So, that needs to be there, equal to WWW, or 80, or 443, however you have
specified. HTTPS would be 443. So, that's what I want to point out to you. Just be extra careful
with this stuff, folks, for the certification exam. So, if it's traffic going from you to the
server, right, how does it have to look? If it's traffic, return traffic from the server back to
you, how does it have to look in order to get the job done? And our BTY lines again. So, earlier
today, you saw me create an access control list on my BTY lines, and I applied it using the access
class command inbound, but I want to show you here the power of this log keyword if you've never seen
it, but you've got to be careful with it, because the log keyword requires the CPU to get involved
with processing the access control list, and so you don't want to use this for every single access
control entry. It doesn't make sense to log everything, but it does make sense to log, for
example, any denies on your BTY lines. Why is that? Because if this user is trying to log into my
BTY line for management purposes, their address is going to be denied, because they are not part of
my management subnet. My management subnet is permitted, everybody else is denied, but I'm also
logging those denies. Why is that a good thing in this case? Because I will then have log messages
generated, and it'll tell me the IP address of whoever tried to access that device.
And if I also wanted to know the input interface, we could go ahead and log that as well,
which is the BTY line, so it's not that big of a deal in this scenario.
But that's just to give you an idea of the power of the log option, so any scenario on the exam
that talks about you wanting to keep track, or be notified, or have syslog messages generated
for certain ACL entries, then the log keyword is the one that is going to be the correct answer for
you. All right, so I have you covered now, folks, for access control lists when it comes to extended
and standard.