Please enable JavaScript.

Coggle requires JavaScript to display documents.

Module 5: ACLs for IPv4 Configuration - Coggle Diagram

- - - - Naming an ACL makes it easier to understand its function.
        
        Router(config)# ip access-list standard access-list-name
        
        After a standard IPv4 ACL is configured, it must be linked to an interface or feature.
        
        Router(config-if) # ip access-group {access-list-number | access-list-name} {in | out}
  - - - This second example shows a named standard IPv4 ACL implementation. The topology is repeated in the figure for your convenience.
- - - - This section will discuss two methods to use when modifying an ACL:
      - Use a Text Editor
        
        ACLs with multiple ACEs should be created in a text editor. This allows you to plan the required ACEs, create the ACL, and then paste it into the router interface. It also simplifies the tasks to edit and fix an ACL.
        
        In the example, the first ACE should have been to deny the host at 192.168.10.10. However, the ACE was incorrectly entered.
        
        R1# show run | section access-list
        
        access-list 1 deny 19.168.10.10
        
        access-list 1 permit 192.168.10.0 0.0.0.255
        
        R1#
      - Use Sequence Numbers
        
        An ACL ACE can also be deleted or added using the ACL sequence numbers. Sequence numbers are automatically assigned when an ACE is entered. These numbers are listed in the show access-lists command. The show running-config command does not display sequence numbers.
        
        Use the ip access-list standard command to edit an ACL. Statements cannot be overwritten using the same sequence number as an existing statement. Therefore, the current statement must be deleted first with the no 10 command. Then the correct ACE can be added using sequence number 10 is configured. Verify the changes using the show access-lists command, as shown in the example.
        
        R1# show access-lists
        
        Standard IP access list 1
        
        10 deny 19.168.10.10
        
        20 permit 192.168.10.0, wildcard bits 0.0.0.255
        
        R1#
    - - Named ACLs can also use sequence numbers to delete and add ACEs. Refer to the example for ACL NO-ACCESS.
      - Assume that host 192.168.10.5 from the 192.168.10.0/24 network should also have been denied. If you entered a new ACE, it would be appended to the end of the ACL. Therefore, the host would never be denied because ACE 20 permits all hosts from that network.
        The solution is to add an ACE denying host 192.168.10.5 in between ACE 10 and ACE 20, such as ACE 15, as shown in the example. Also notice that the new ACE was entered without using the host keyword. The keyword is optional when specifying a destination host.
    - - Notice that the show access-lists command in the example shows statistics for each statement that has been matched. The deny ACE in the NO-ACCESS ACL has been matched 20 times and the permit ACE has been matched 64 times.
        
        Note that the implied deny any the last statement does not display any statistics. To track how many implicit denied packets have been matched, you must manually configure the deny any command at the end of the ACL.
        
        Use the clear access-list counters command to clear the ACL statistics. This command can be used alone or with the number or name of a specific ACL.
- - - - The extended ACL is first configured, and then it is activated on an interface.
      - Protocol
      - Port
    - - Named extended ACLs are created in essentially the same way that named standard ACLs are created.
      - Example
    - - Like standard ACLs, an extended ACL can be edited using a text editor when many changes are required. Otherwise, if the edit applies to one or two ACEs, then sequence numbers can be used.