Alright, and lastly here, VLAN Access Control Lists.
I struggle with VLAN Access Control Lists because of the way that I see other documents, people, trainers describing them.
I want to make sure that you leave here fully understanding and comprehending what in the world a VACL is really about.
The primary reason why VACLs exist, VLAN Access Control Lists, is to control traffic flowing within a subnet, within a VLAN, within a broadcast domain.
Let's think about right now the Access Control Lists we've been talking about.
Every Access Control List we've talked about up to this point in time has really focused, today anyways, on what?
Traffic going from one subnet to another subnet.
So traffic going through, let's say, a router.
Coming from one subnet over here, going to one subnet over here.
So these are Access Control Lists we apply to router interfaces.
We apply them to what? Our SVIs on our default gateway.
So if I want to deny my users in the VLAN 10 subnet, 10.0.0.0, from going to a particular resource, I could go to my SVI, set up an Access Control List that says,
Deny traffic from 10.0.0.0, using this port, this protocol, this service, going to this destination, with these ports and protocols, etc., and apply it to the SVIs.
And that would be doing what? Denying traffic or permitting traffic going in and out of the subnet.
But what about traffic between users in the same subnet?
That's right, let me repeat that. What about traffic between users in the same subnet?
How do I make sure, for example, these two devices can't talk to each other?
Well, if I apply my Access Control List to the SVI folks, is that going to stop them from talking to each other?
No, because I'm not routing, right?
Same thing here, if we created an SVI here, just for fun, and then applied the Access Control List on the SVI, would that stop them from talking?
No, because again, we're not routing, we're not routing.
So what we want to recognize here is that with VLAN Access Control Lists, I can actually control the flow of traffic within that subnet VLAN or broadcast to me.
So I can create an Access Control List and then prevent somebody like 10.0.0.10 from talking to 10.0.0.20.
I can totally do that in the same subnet VLAN or broadcast to me.
That is what they were really intended for.
Now, notice it also says here, entering or leaving a subnet VLAN or broadcast to me, entering or leaving a subnet VLAN or broadcast to me.
So I can create a VLAN Access Control List and say, if traffic is coming from 10.0.0.0, size 24, going to 10.0.254.0, I want to drop it, deny it.
Sure, of course you could.
But that's not really what it's intended purpose for.
Can you accomplish that?
Sure, go ahead.
But that's not what it's real intended purpose is for.
The intended purpose is really for within your subnet, your VLAN, your broadcast to me.
If you want to control traffic, enter or leaving a subnet, just do a Router Access Control List or RACL.
So what we talked about in our previous three discussions were RACLs, Router Access Control Lists, RACLs on Layer 3 interfaces.
This is a VACL, a VLAN Access Control List for controlling what?
Layer 2 traffic, traffic within the same subnet VLAN broadcast to me, even though you can't do it this way.
Now, back in the day, and I think I'm allowed to say this now, because I mean, the exam doesn't exist and the simulations don't exist anymore.
I've taken a lot of Cisco exams over the years.
And at one time, there was an exam called Switch.
Did anybody ever take the Switch exam?
Anybody here ever take the old CCNP Switch exam when you had like the Route Switch and T-Shoot?
Okay, Jeffrey, Jeffrey, you might remember this.
There was a VLAN Access Control List simulation on that exam, right?
There was.
It was wrong, okay?
It was wrong.
Most people didn't realize that, right?
You essentially set it up for this purpose.
The requirements were to control traffic entering or leaving your subnet.
And I'm like, why are we testing people on this?
Like, you have somebody who created this simulation and spent all that time, and it's not even how you're supposed to use it.
It was awful, awful.
Anyways, thank goodness that is gone.
And it's quite possible on this exam, whether it's multiple choice, drag and drops, or simulations,
they may actually have it right this time, which is nice.
But again, you can do both, right?
And the thing is, but this is what I want you to realize.
If you're going to control traffic within your subnet, do a VLAN VACL.
If you're going to control it between subnets, don't use a VACL.
You don't have to.
It's not worth it.
Set it up on your default gateway instead.
But maybe in the real world, your requirement is you must stop your traffic right here.
Then I guess you could use a VACL on this device to stop the traffic from going any further to leave your subnet, right?
So you could do that if you wanted to.
But there's also another type of access control that's not part of this course.
And that is a port-based ACL, or a port ACL, which we call a PACL, which goes on layer two interfaces.
So you can actually use a PACL to accomplish that instead.
So you've got PACLs, you've got VACLs, you've got RACLs.
So port-based ACL on layer two, VACL for VLAN-based ACL, RACL for router layer three interface access control lists, all those different types.
All right, but let's talk about it this way for the certification exam and for real world stuff.
So what do we have to do?
Well, let me give you some guidelines first, because we're going to be creating a construct here like our route maps.
That's right.
We're going to be creating a construct like our route maps.
So if you follow these guidelines, it becomes very simple for you to create VACLs.
If you don't follow these guidelines, then you can end up with a double negative type of scenario, which messes everything up on you.
If you don't understand what has just happened with that double negative scenario.
So remember when we were using our route maps, I said just every time you create an access control list or any time you create a prefix list, just go ahead and do permits.
Permits, permits, permits for the ACLs.
Permits, permits, permits for the what?
Prefix list.
Why?
Because we are going to control what happens using the route map.
Okay, that's the same principle here.
If you go with permit ACLs to identify the traffic you want to match.
Permit this, that means match it.
Permit that, that means match it.
Permit this, that means match it.
If you do a deny, a deny simply means don't match it.
So why spend the time doing denies when you can just do permit, permit, permit, permit, permit, permit, and let the implicit deny do the denying for you?
Because all permit means is match.
Deny means don't match.
Doesn't mean drop, doesn't mean block, doesn't mean anything, right?
It means don't match.
Don't use it, don't look at it, ignore it.
That's what it means.
So permit means I want to match this, I want you to do something to this.
And then you use your access map, your VLAN access map to actually define what happens to that traffic you match.
That's how you do it.
Just like our route maps.
So that's the simplest way to do it.
If you follow that advice and you follow what you see here, you'll have success in the real world on the exam.
So in this case, look, I'm creating an IP access list.
So yes, I still need an access list.
It could be a numbered access list or an extended access list.
But this is to do what?
This is to match traffic.
Match traffic, that's it.
So permit, I want to match this traffic.
I want to match this traffic.
So I want to match all traffic from this range going to this range.
Notice how it's the exact same.
Everything in 10.0.0.0 to 10.0.0.255 going to 10.0.0.0 to 10.0.0.255.
So everybody within that IP addressing space.
That's everybody in what?
My subnet, 10.0.0.0 size 24.
That's everybody that's part of VLAN 10 in our example.
And so I want to match that traffic as long as it equals what?
In this case, telnet.
I want to match that traffic as long as it equals what?
In this case, RDP.
So you can apply your permits.
And you can have multiple ACLs if you want to for different actions that you want to apply.
But you're not specifying the action here.
You're just trying to identify what you're going to match.
So now you'll see here that I'm creating another access control list.
And this one says permit IP any any.
Meaning what?
Match all traffic.
And you'll see why that is here momentarily.
Because now as we start our VLAN access map configuration.
I say VLAN access map and I give it a name.
And then I give it a sequence number.
That's all that is.
Because like a route maps.
Sequence.
The lower sequence numbers process first.
And the next one.
And so on and so forth.
In this case, we only have two sequences.
One and two.
I could have numbered them anything I want.
I could have said 10 and 20.
Five and 11.
Whatever.
Lower numbers process before the next one.
Now you'll see in the first sequence.
Sequence number one.
Match IP address.
Deny Telnet RPDP.
That just means match this ACL here.
So match all traffic coming from here going to here.
So any traffic within VLAN 10 essentially.
That's Telnet traffic.
Match any traffic in VLAN 10 essentially.
That's RDP traffic.
And then do what?
There's your action.
Drop it.
Right there.
Drop it.
Discard it.
Get rid of it.
That's what I want.
So notice how I'm not denying it here.
I'm permitting it here.
Because if I denied here.
Deny here means do not match.
So down here.
Match IP address.
Would mean don't match those.
If they were denies.
And then the implicit deny all means.
Don't match anything else.
Which means we're not dropping anything.
So for the exam.
If you saw something like this.
Deny.
And the action was a drop.
Well that doesn't make sense.
Because you're not actually dropping anything.
And if the scenario was.
You want to drop all Telnet traffic.
And RDP traffic.
For that subnet.
10.0.0.0 size 24.
Well then you're not even dropping it then.
Because you are saying what?
You are saying do not match.
And so therefore you're not matching it.
So that's why when I tell you.
Go with permits.
Now that means match that traffic.
And therefore drop.
Anything that matches Telnet and RDP.
In that subnet.
And then look at the next sequence.
Sequence number two.
Match this one.
And forward everything else.
Why is that?
Why do I have to put that in there?
Because at the end of a VLAN axis map.
Is an implicit drop all.
Implicit drop all.
Meaning.
If you don't match anything else.
You are dropped.
And so therefore.
You're not matching anything else.
You are dropped.
So I need to make sure.
That I'm forwarding all the other traffic now.
So that's why I've done it that way.
Now we still need to apply it to VLAN 10 though.
So VLAN axis controllers.
Are applied to the entire.
VLAN on the device.
So we're on ASW1 right now.
Notice the very bottom command.
VLAN filter.
My name of my axis map.
For VLAN 10.
And then which VLAN.
Am I applying this to?
I'm applying it to VLAN 10.
And there you go.
So now what happens?
Match.
Drop it.
Match.
Forward it.
For all traffic.
Within VLAN 10.
So now as traffic's flowing through this switch.
As it's flowing through the switch.
It doesn't matter what interface.
It can come in this one.
Or this one.
We will run this.
Every time.
And say do you match or not?
You match.
You're dropped.
You match this.
You're forwarded.
That's what that means.
Any interface.
That is part of VLAN 10.
This applies to.
Trunk port.
Or axis port.
That.
My friends.
Is the VACL.
I suggest you know that basic config.
For the certification exam.
And that brings us to the end of today's session folks.
Where we covered what?
We covered device.
And access authentication.
We covered ACLs.
Time-based.
Standard.
Extended.
And VACLs today.
All important concepts for the certification exam.
Expect to be tested on.
Everything that we covered.
In this session.
In some way, shape or form. www.technet24.ir