Original subtitles

>> While, we're building on the foundation that was laid in the last Nugget

on standard access list, enhancing it now with more capabilities in the extended world.

Same story, multiple scenarios back to back to back that we're going to walk

through to show examples of using extended access-lists

and by doing that, solidify the concept.

Same topology as before so we can focus on the access-list concept,

not re-learning what the network looks like.

We've got five scenarios, three of which are on the screen right now.

Number one, use an extended access-list to block 192.168.1.0/24 so these guys

from reaching 192.168.2.128/25, it's these guys.

Now is it possible to do that using a standard access list?

Yes, the answer is absolutely yes.

However, we can be a lot more efficient and it's just the norm

to be using extended access-list for these kind of things.

Anytime you have a source and a destination or port number or anything like that,

extended access-list is the way to go.

So, as a refresher, extended access-list, they can filter based on source and destination IP,

they can filter based on protocol so things such as TCP, UDP,

ICMP, et cetera, et cetera, et cetera.

Those are the ones we care about in CCNA, and then port number.

So, for instance TCP port 80, TCP port 25, all that kind of stuff.

Now before-- I'm going to hold off.

So let me do this, I'll show you the kind of the base example and then I want to start talking

about what are some common port numbers that you're going to run into.

So, what we're going to do is start off with the big question, where do we start off?

Remember, there're two things, you configure the access list, which you can do all day

without affecting anything and then you apply the access list.

That's where it goes into action.

But before you can configure, you have to know where you're at.

Now here's the concept.

With extended access-list, we can filter based on source and destination.

So, based on this question, we need to create a statement that says deny 192.168.1.0/24

from reaching 192.168.2.128/25, right?

So, put that statement in there and then we can say permit anything else.

I'm just kind of pre-planning our steps with this.

Now, think this through with me.

If I can say deny this source from reaching that destination, where can I apply it?

Well, there're actually a lot of places.

I could apply it like what we're doing with this standard access list, outbound right here to say

as they're going out that interface, check this, is it this source?

Are they trying to access this?

Then they will be denied.

And it will work, absolutely.

But follow this, I could apply it inbound right here, right?

And I could-- you know, as packets are coming in, they're chugging along their way,

as they get in, it's going to say, "Okay, are you this?"

And they'll say, "Yes, we are because we're coming from here."

And it's going to say, "Well, are you trying to access this?"

And they'll say, "Yes, we are.

That's where we're going."

They'll say, "Okay, well then, right here, I'm going to deny you."

So just following that same logic, do you see the point here?

I could apply outbound right here, I could apply inbound right here.

I could apply outbound right here and I could even apply inbound right here,

because even before the packets get into the router, it can, you know--

before they go any further it can say, "Are you this?

Are you trying to access this?

Oh, okay, then you're going to be denied."

So I can even deny them right here.

So then the big question is I could apply this, how many?

One, two, three, four, five, six different places, they all work,

they all accomplish the result, what's the best place to do it?

Cisco would tell you, right here.

Why? Because the further down the chain you apply the extended access-list,

the further the traffic has to go just to find out that it's blocked.

So, if I apply it right here, that means this router had to process it, waste bandwidth.

This router had to process, waste bandwidth.

And it had to get here and be processed before it found out it was going to be denied.

Like I said in the last Nugget, it's like that bad trip to Disney Land,

we're driving all that way just to find out Disney Land is closed.

So we'd rather know before we leave the house, essentially right here, that it's closed

or that we're going to be denied and that's Cisco's best practice.

With extended access-list, the rule is to apply them as close to the source as possible.

Even though it would work further away, we want to be able to--

to be as efficient in our configuration as possible, too.

So, with that in mind, that's where I'm going to begin my configuration.

Let's go over to router 1.

So I've all the-- I was getting rid of all of the old config from the previous ones,

so let's clear all that off gone.

So, router 1, now I'm going to go-- let's start--

and I know last Nugget, we wrapped up with the named access list and we'll go there,

but I'm going to start off with the traditional way which is numbered.

First off, let's do a show ip interface brief that's just constant orientation.

Okay, it's-- I, I know where I am, that's 192.168.1.1, that's right here,

FastEthernet zero, serial 0 is right here.

So, I'm going to create an access list.

I'll do access list, question mark.

Now we're going to move into the extended range.

So I'm going to say extended, now you remember the syntax from the last Nugget, right?

So, for instance, if I said, you know, five and I would say permit

and it's like okay, what's your source?

You got used to that, right?

So now, when I do access list, let's go 100, I'm now in the extended range,

I hit the question mark, immediately I see, there's a little difference there.

There's this new word dynamic, we're actually not going

to use those, but there's a new word in there.

So, I already can tell that I'm moving on a little different track, so what am I doing?

Denying somebody.

I'm denying 192.168.1.0 from reaching the other one.

So, okay, so I'm going to say deny, question mark, and now it's like, whoa,

syntax went a totally different direction.

First question it's going to ask you is what protocol?

What protocol?

Remember, that's one of the things we can filter on.

What protocol would you like to allow or deny key ones that we care about, ICMP,

that's things ling pings, echo, echo reply, unreachables, all those kind of things.

TCP and UDP and IP.

So, ICMP, protocol-wise, TCP, UDP, and IP.

These three we know.

Those' are the protocols that applications use so what's this mysterious IP?

IP is everything, like for instance, you see a whole bunch of protocols there and if I allow,

you know, maybe I block TCP traffic from these, well,

problem is that allows UDP to still get through.

That allows, you know, ICMP or IGMP and ESP, all these other stuff can still get

through 'cause there's other protocols in TCP, but if I really want to catch all of them,

IP is essentially everyone of these in one.

It's all protocols is what it is.

And that's what we want here.

We said, "Block this from getting there."

It didn't specify anything more so we're left to assume block, that's what it means,

like deny everything, not just TCP or UDP.

So we're actually going to go in here and say, "Deny the IP protocol."

Now, I'd ask the question, what source address would you like to deny from?

And I'll say, "Okay, well, I'm not actually looking

for everybody nor am I looking for a specific host.

I've been told to block this network and that's what I'm going to do."

I'm going to go in and say, "The source that I'm blocking is 192.168.1.0."

And of course, it's going to say "Okay, well, give me something more.

Are you looking for just a host on there or the whole subnet."

So that's where our good old wildcard mask comes in.

Remember, this is from before, this is a class C subnet mask.

Flip that, completely backwards rebel land and the wild world, we flip that around 000

which says, "Look at 192, look at 168, look at 1, I don't care about that last action."

So, that can be anything.

If it starts with this, they match this.

They're going to be denied.

So I'll say 0.0.0.255.

Now, we get new options, things that we didn't see at all in the standard access list,

it's saying "Okay, now what destination would you like to refer to?"

So I'm going to say, "I am blocking this source from," now I typed in the destination.

Well, I'm not blocking it from everything nor a specific host.

I'm blocking it from this network, right?

192.168.2.128 right here, so we'll type that in.

That's, that's the network ID, 192.168.2.128, hit the question mark.

Now, it says, "What's the wildcard bit?"

Well, you remember, we use the custom subnet here, so wildcard bits are going

to be 000 dot and how do we figure that out?

Well, slash 25 in decimal is 255.255.255.128, one of those funky subnet masks.

So I could either convert all these to binary and then make all the one zeros

and all the zeros one to figure it out or we can use that handy-dandy formula which is

to take 255.255.255 and subtract this and that gives us 0.0.0.127 is the wildcard mask

that we need to use to match that whole network.

So, come in there and do 0.0.0.127.

Hit the question mark, you know, things like do you want to log this enter-- entry?

Are there certain types of service that you want to match?

I mean, all of these goes way beyond.

Types of service, DSCP, all those kinds of things, deal with quality of service.

Same thing here, different quality of service tags that we can use.

Don't even worry about it for now.

I hit enter.

We have entered our first extended access-list statement.

Let's do a do show IP access list.

Right there, we've got deny this source to this destination.

Now, extended access-list can get pretty hairy.

The biggest thing that you can do is remember the three key pieces.

You're going to say-- well, I'll say you know, permit or deny right?

I guess that-- that doesn't count.

Permit or deny, so you have the protocol, that's one key piece,

you pick your protocol you then have your source and you have your destination.

No matter how complex, how big this thing starts getting like we're going to start seeing

over here, no matter how big this is, you're always going to break into those three pieces,

you pick what protocol it is, what your source is and what your destination is

and that makes sense when we look at this.

Deny IP that's a protocol, this is our source, this is our destination, cool?

Now, extended access-list have the same rules as a standard if I have a deny in there,

there's the implicit deny below that so it's going to deny everything.

So what I need to do is get in here and type in, IP or-- wait, hang on, where was it?

Access list 100 and I need to add a permit, so I'm going to say, you know,

they're denied from that, but I'm going to permit everything else.

Now, in an extended world, we have to type in permit so when I say,

"I want to permit everything else," what protocol is that?

IP, right?

That's everything, all protocols.

What's the source?

Well, we can actually be very broad here.

I can say any source to, well, what do you think?

Any destination.

That is your way of doing a permit all at the bottom

of an extended access-list to overrule that deny everybody.

So, now it's saying, "Okay, if you're this and you're trying

to go to this, you will be denied."

However, if you're anything else, you will be permitted even if you're this trying

to access something other than this, does that make sense?

So now, I can go in to applying it to Cisco's best practice as close to the source

as possible, so I'm going to go into FastEthernet0/0, same exact command

as we saw previously, IP access group and we say "Okay, well,

what's the access list number or name?"

And we'll say, "Access list 100," that's the one we just created so I'm saying,

"Apply this access list in the inbound direction."

Again, be the router-- I'll stop drawing my long arms in a minute but fast FastEthernet0/0 is

over here so I'm saying as things are coming in,

in that interface 'cause that's the interface mode I'm under right here,

it's going to start going through that access list and saying,

"Are you trying to get over here?

Because I'm going to deny you otherwise, you're permitted to go through

and pass out the Serial0/0 interface."

So that will accomplish the goal.

Let's test it.

I'm going to go to PC1, that's over there on the left.

No, it's right here, and let's just do a show ip interface brief,

yes that's just a little lone guy over there on the network 192.168.1.50 that's him,

so I'm going to try and ping, let's try and ping 10.1.1.1 make sure we can still get there, yup,

and that-- so 10.1.1.1 you might remember is this guy, so it's going all the way

across the network to here to reach it but now let's add in, let's go a little further.

Let's go to ping 192.168.2.150 which should be a forbidden IP address and sure enough it is.

So, the good news is our device is literally getting right here and being blocked.

He doesn't have to travel much further like we did with the standard access list,

we can't apply the standard access list any closer

than out here 'cause you can't say what you're denied from so we would always have to have all

of our traffic crossing the whole network to get there.

Now I'm able to go back in to my router 1 to a show IP access list

and I can see all the matches, the things that have been denied as well

as the things that are being permitted.

Okay, number two.

Block 192.168.1.50, so this guy, from reaching 192.168.2.50 so this guy using HTTP or HTTPS.

So what can we assume?

Well, we'll just pretend that this guy is actually a web server that would be using those.

So now is what I was holding myself back from, now is a good time

to talk about common port numbers.

TCP, UDP all of the different protocols out there have specific port numbers that they use.

I'm going to do TCP, UDP and I'll just put ICMP up here.

The three protocols we've been talking about so far, I guess we can throw IP,

but it doesn't really have any port numbers 'cause that's everything, right?

Those are the protocols that we've been talking about in the config,

there are ones that you will want to know off the top of your head.

TCP port 21 FTP, port 22 is SSH, TCP port 23 is Telnet, port--

you want to know port 25 which is SMTP that's email services.

You want to know, maybe 53, which is actually a DNS server, so for instance,

DNS servers that have all those records like google.com really points to these IP addresses,

they replicate to each other or they can and they use TCP port 53 to do that.

Port 80, the most well-known port in the world, HTTP, port 110 POP3, that's client email.

So if you're downloading email from an email server, you use POP3.

On the same token port, what is it?

143, IMAP4 which that same thing, a client email but instead of downloading it from the server,

it leaves it on the server so that way, the client doesn't hold the email at all,

it stays on the server, so IMAP4.

And then the only other one that I could foresee popping

up at you is port 443 and that is HTTPS or SSL.

So, encrypted or secured HTTP uses that port number.

Now I know, you're like "Ooh, that's a lot of port numbers to know off the top of my head."

Yes, the vast majority of them are in TCP because that's what all

of our data applications use, correct?

Now UDP, there are some but very few, UDP, you really only want

to know port 53 which is DNS client.

So when, for instance, your computer at home goes to google.com or cbtnuggets.com and tries

to resolve that name to an IP address, it sends out a UDP request.

It's just a-- that's the normal DNS lookup.

And then port 69 which is TFTP.

Our Cisco devices use that for a lot

of configuration backups or upgrading the IOS software.

So, those are really the only two on UDP.

ICMP doesn't really use port numbers, it uses protocol numbers or protocol name

so the only two you'll want to know there is echo and echo-reply.

And if you combine both of those together, what do you get?

A ping. That's when you ping something, it sends an echo and the other side sends back

and an echo reply so that's how we do that.

So, I would suggest and now this is-- well, you know, I was going to say, if you're studying

for the exam, but I would say real world.

Yeah, I mean, you use those all the time 'cause those are the major services that you end

up supporting as a Cisco firewall administrator or you know, whatever you're doing with those,

you constantly run across those service, so it's for good reason that Cisco allows those.

So, okay, now back to the objective, block 192.168.1.50 from reaching this guy,

who's probably a web server, on port 80 and 443.

This is going to be awesome, I just-- I paused and I was like, "I've got an idea."

I want to take this opportunity to show you how to edit an access list,

because see here's the deal we already have, in scenario one,

blocked this guy from reaching out over here on everything.

So now we're saying, "Okay, in addition to that, I want to block this guy, that one IP address

on the network, from reaching to this guy on port 80 and 443."

I know that because I, you know, just did the quick correlation,

HTTP and HTTPS are there in that list.

So, we've already got an access list applied inbound right here that we can edit

to add those restrictions to, so let's do it.

So, where am I?

Router 1, come right there, so there's our existing access list.

Now you notice that we've got these sequence numbers right there.

So that's going to leave us in a little bit of a pickle

because if we-- yes, I did just say pickle.

So if we use our normal access list command, if I say access list--

access list, you know 100 and I keep going down and I say, you know, permit IP--

or TCP and I start squeezing in all the stuff,

it's going to keep adding on to the bottom of the list.

No, no, no I can't do that.

I want to squeeze stuff in.

Now, do any of you remember where we saw that little--

in the last Nugget, I had the question mark and we say the option to type in a sequence number?

So I can say, "Well, squeeze in sequence 15 in between these two," or something like that.

Remember where that was?

It was in the named access list, so let's back up a little bit.

If I type in-- how to get to the named access list?

IP access list, right?

And I'll say this is going to be instead of using number 100

and all that to specify it's extended, I'm going to say, "This is an extended access list,

but now, it lets me type in, oh, which one are you editing or which one are you creating?"

You can do both with this command.

So we'll say extended and we'll say number 100.

Now, you noticed it says, "Okay, go ahead and press Enter."

Thanks, I'm now in the configuration mode, editing that access list.

So now, what I can do is specify a sequence number to squeeze in the commands I'm

about to do before we get to that permit IP any any.

So, what do we do?

Okay, so we're, first off, needing to block HTTP and then we'll block HTTPS

which we'll be really easy once we get the first command.

First off, I'm going to say, "Okay, previously, we had sequences 10 and 20,

so I need to squeeze it in," so I was saying 15, but why go right in the middle?

Why not just use 11?

How is that?

So, sequence number 11 will add the line between 10 and 20.

It's like-- any of you-- my roots go back to the Commodore Amiga Computer.

That's were I really got my first taste of computing

and I remember [laughs] trying to learn programming.

Now this is many, many moons ago.

I was much, much, much younger.

And I got into basic programming thinking, I'm going to--

you know, what's every kid dream of when they're getting into computers,

I want to be a video game programmer, right?

And so I got in the basic and, you know, got the book and out and says, "Okay,

type in line 10, echo, hello world."

And then you-- so you typed that into the basic compiler 10 Echo, you know, hello world.

And then you do a line 20, go to 10, and you run the program and you just get a screen full

of hello world and that's about as far as I got and I'm like, "Well, that was lame.

I'm a long way away from creating, you know, Defender of the Crown kind of games,"

[laughs] you know, like which was of course the game of the year back then.

So, what was I talking-- so that-- so yeah, this is very similar to that.

We just got these sequence numbers to keep everything straight.

So, I'm going to say sequence 11 to squeeze it in there,

now we can put it in our permit and deny statements.

So I'm going to say, "Deny.

We're blocking them from-- " So saying, "Deny what?"

Well, HTTP is a TCP-based protocol, right?

So I'm going to say "Deny TCP."

It's the-- TCP is the protocol that I'm blocking.

Now it's saying, "Who are you denying?"

Well, it's nice and easy here so I can say-- well, there's two ways, I can either say host

and type in the IP address or I can type in the IP address, let's do 192.168.1.50, right?

The two we're-- let's this squeeze this a little bit.

The two we're blocking 192.168.1.50 from-- and then so I'll hit the question mark says, "Okay,

what's your wildcard bits, 0.0.0.0."

So if I would have used the host keyword, I could have skipped doing

that 'cause it would assume that.

So, now it's going to say, okay, what is your--

okay what is your-- so I've got this mouse, right?

And the scroll-- it doesn't have a scroll wheel, it's invisible, like if you just kind of move

over the mouse, it scrolls for you so that's why I'm doing all that time.

So, it's saying, "Okay, this is your source now into your destination," but wait, but wait.

This is actually a point where a lot of confusion comes in,

because somebody hits the question which we all do.

This is-- hitting the question mark is something you always do in Cisco.

And we see-- oh wait, wait, match packets on a port number or greater than a port number

or less than a port number or not equal to a port number.

That's NEQ, not equal to or range of port.

So we're like, "Oh okay, so this is where I type in my port number, right?"

Major area where access list get kind of messed up and this goes back

to what I was just showing you on the last example.

Remember, the access list is always comprised of three main pieces.

You say, I want to allow or deny the protocol, which we chose as TCP, the source,

you put in your source information, then the destination.

Now you might be saying, "Well yeah, that's what we're doing, right?"

And we said, port 80.

Well, if we type in the port number right here--

not there, right here, if we type in the port number and we say, "Okay, equal to port 80,"

then we're actually choosing the source port and that's not what we want.

I mentioned this way early on in the series so I want to talk about it again.

When a computer creates a connection to, well, let's just say this web server,

it'll always creates what's known as a socket

and what a socket is-- this guy is 192.168.2.50, right?

And this guy is 192.168.1.50.

So a socket is when he says, "I want to talk you web server."

And the web server is like, "Well, I actually do a lot of stuff.

I'm a web server.

I'm an email server.

I'm a [laughs]-- like what else-- oh, I'm an online gaming server.

I'm a database server," I mean, he's like, "So what service on me do you want to talk to?

You can't just say you want to talk me, you got to tell me what on me you want to talk to,"

so that's why this guy creates a socket.

He says, "Well actually, I want to talk to you, 192.168.2.50.

I want to talk to you on a socket of 192.168.2.50:80,"

which now when he gets that he goes, "Oh, okay.

You're trying to access my web server," because that's assigned to port 80 on here.

But at the same token, this guy also creates a source socket, to where he says, "Oh,

coming from 192.168, you know, when you talk back to me, I'm coming from 192.168.1.50 colon."

What is it?

How's 5196?

[laughs] We don't know because Windows makes that up.

When I open-- you remember this?

When I open a web browser, I open, you know, Google and go cbtnuggets.com,

the operating system-- we did this early on, we do netstat.

It comes in and says, okay, well, I'm creating all these little source ports, you know,

this is my source IP address and I'm going--

you know, coming from this source port which identifies, you know, Google Chrome

or whatever app and now I've got other stuff right here like wow, that's a lot of stuff.

Well, I've got a lot of stuff running on here.

But you know, these, I can tell you, are all related to CBT Nuggets

because CBT Nuggets stores their data in Amazon AWS which uses EC2 services

which is-- that's another great series.

If you're ever interested in that, CBT Nuggets has a series on AWS, it's amazing.

[laughs] Amazing.

So, moving on.

So, this, you know, is going to be made up by the operating system.

So if-- going back to where we're at, let's see, we were on router 1.

If we type in equal next to the source, we're going to be saying, "I want to deny based

on the source port number," which we don't know what that's going to be.

We rarely if ever are going to know what the source port are going to be--

is going to be, so rather, I'm just going to go right into the destination.

I'm going to say, "Okay, I've specified this.

I've specified my source and I'm not going to specify a source port number

because I don't know what it's going to be.

I'm just going to move on to the destination."

So watch this, come back here-- oh, I just pasted that in.

And now I'm going to say, "Okay destination."

Well, the destination host is 192.168.2.50, hit the questions mark, wildcard bits 0.0.0.0.

There we go.

So we've got-- I'm denying a TCP from this source, no port number, to this destination,

and now, now, we specify the port number.

Now notice, equal to a port number.

Now, we get a ton of other options like, you know, match flags, log, [inaudible],

I mean, it just goes on and on and on.

But really, the main one that we use is equal to.

So I'm going to say, "I want to deny TCP on ports equal to and I'll hit the question mark."

I know I'm reaching the edge of my screen there-- equal to--

and now look at this CISCO says, "You can just type in the port number which I prefer."

You can just type it in right there and we'll take whatever port number you specify

or Cisco's like, "I know sometimes you forget a lot of the common port number

so we created a list of-- and I'm putting in quotes, "common" port numbers

that we haven't updated since 1985.

I mean, it's like seriously, this-- I mean, look at this list.

I mean, gopher.

Does anyone remember Windows 3.1, where you had the original like a little gopher--

it had little teeth that-- it was like-- it was FTP before there was FDS.

So, I mean, if you want to remember this archaic list, then go for it, but I'm telling you,

just stick to the port number, you know.

So let's go on, so you can see the list.

Now, notice this.

It's not even HTTP that they chose as the name.

They said www which again, it's been that way since long, long ago.

So, we'll just put equal to 80, how about that?

Whoa, you see what just happened there?

It just kind of scooted over and put a dollar sign.

Remember way early on in the series, I said, if you ever type a line that's really long,

the iOS is like, "Okay, I'm going to put a dollar sign representing

that you've reached the end of that line."

So-- or I should say, there's more to the left here

so you can scroll back to see the entire thing.

So, I'll hit the enter key and now I've got in there.

Now watch this.

I'm going to a show ip access list so we can verify that command.

So notice, first off, sequence 11 so it squeezed it in between 10 and 20, that was successful.

Notice as well that the Cisco IOS recognize, it goes, "Oh,

you're using a wildcard mask of all zeros.

Tell you what, how about we make that a host?"

So, remember, I said you can type it one or two ways.

Well, you can, but the Cisco IOS is like, "I prefer this way.

It's a little prettier that way."

So let's do that.

So it converts back it to you.

And also notice, it recognized port 80, he goes, "Oh, well, you really mean www."

Does that mean that we have to know that?

No, it just means that, you know, there's a--

you know, the IOS does a lot of stuff behind the scenes and that's fine.

We'll let it do that.

So, that now allows or I should say denies TCP from this source, on any source port number,

to this host using the destinate-- remember, when we're talking about socket.

This is a destination port number, destination port of 80.

Now, what about HTTPS?

That is just an up arrow away.

I hit the up arrow and say, okay, well-- actually, I'll go back to the beginning and say,

"This will be line 12, sequence 12."

Otherwise, it will-- but you may go, "Well, what happens if you put 11?"

Some IOS versions, it all squeeze it in and bump the other one down.

A lot of other ones will say, it will either overwrite it or it will--

it's IOS dependent or it will just say, "Sorry, there's something else at sequence 11.

You can't create it there."

So it's usually best just, you know, don't try and figure out which you got.

Just go in and specify a unique sequence number.

So I'll put 443.

That's HTTPS.

Hit the up arrow.

With that, we've now got two lines in there that's denying or saying, "Deny this source host

to this destination host on this destination port for both of them."

Okay. Great.

Now this-- so we edited the existing access list.

The beauty is it still applied to the interface.

So I still have the ability to go in there and test it.

I don't have to reapply it or anything like that.

Now, you've got to be careful.

It's a little dangerous 'cause these commands are going into action right away.

So if you mess up, it's not like, "Oh, whoops," you know, like this is, while it's--

well, the router is working, so these are immediately active when you press the enter key.

So let's test it.

How do I test this?

Okay. One way that we can test access list, now obviously this is a router that's simulating

as if I was a PC and does a very good job at that, but there's no web browser on here.

So I can't open a website and test it there and nor is this device really a web server.

But one of the things I can do is use the Telnet command to test.

I might say, well, Telnet-- wait a sec, that uses port 23.

It does, but watch this.

I'm going to type in Telnet 192.168.2.50 and I'm going to follow up here

and see that it gives me the option to type a port number.

So, I can say, well Telnet-- if I just hit the enter key, it will Telnet and I can say, "Oh,

hey, I can Telnet to that device.

That's great."

Okay. So I'm going to get pass that.

So that verifies to me that port 23 is working, but when I go back and I'll say, "Well,

I want to specify Telnet to port 80."

It immediately comes back.

It's like, deny.

Now, okay.

Did that happen because this guy isn't running a web server or did it happen

because the access list really did block that?

Well, how do you think we can see?

Go to router 1.

Hit the up arrow and see did we have any hits?

And we did.

Essentially, PC1 sent three attempts to try and open that www port, it tried to get there

and the router was like, "You're denied.

You're denied.

You're denied."

So, okay let's try this, let's hit the up arrow and try 443.

Hit the up arrow.

Look at that.

Now we have three matches on that.

So that will-- I mean, without actually having a computer with a web server to--

or a web server setup and a web client to test, what a great--

and by the way, everybody does this.

This is a very common thing in the real realm of Cisco that you're constantly using Telnet

to really test if your port restrictions are working or not.

In this case, we can see they are working like a gem.

Now, I'd like you to pause the Nugget and see if you can do number 3 on your own.

Even if you don't have a Cisco IOS in front of you, whether it's GNS3 or a real router,

still just write it down on paper.

That's where you really get used to the syntax.

Write it down and see if you can figure out the commands that you would use.

Now, I will tell you, it's a little challenging.

It goes a little different mindset than what we've done so far.

Okay. So pause and let's do it.

Okay, so permit 192.168.2.0 to access 10.1.1.1.

Let's identify the player.

So I'm saying, permit this whole subnet, 192.168.2.0 that's the network ID slash 25.

So that whole subnet and we figure that out in the last Nugget,

that's really 192.168.2.0 through 127.

This being the broadcast, that being the network.

So, you know, that first one is usable when all the-- we figured out the range for that.

So we're saying that whole range can access this guy only using Telnet and SSH.

Now, again, this IP address right here, okay?

So, where are we at?

Most efficient close to the source as possible is going to be router 2.

Okay? So, I'm going to go in router 2 and let's just clear the screen from the previous Nuggets.

So let's clear the screen off that.

Router 2, and I'm going to shrink this down just so we can keep things in front of us.

All right.

So, I've got permit 192.168.2-- there we go.

How about right here?

Permit 192.168.2.0 to access it.

So I'm going to go in and let's use this opportunity, use a named access list.

Again, you can use number.

That's fine if you did this beforehand, but I'm going to use a named one 'cause it kind

of gets you experience with that side as well.

Anytime you want to use a named access list, it is ip access-list

and then we hit the question mark.

We say, "Okay.

Extend it."

We're in the extended world now.

And what name do you want to do?

We'll just say, let's just say, R3 Telnet SSH, how is that?

Just a unique name.

Okay, so I'm going to come in here and do a permit.

Now again, we could specify sequence numbers and all that, but I'm--

this is a new access-list so I'm just going to let it kind of generate those for me.

So I'll do permit and we're going to say the protocol, so we'll say, TCP as the protocol.

Permit TCP 'cause Telnet and SSH are both TCP based.

That's port 22 and port 23.

So permit TCP from the source of 192.168.2.0 with a wildcard mask and you know,

we've figured this out a couple of times.

It's actually 0.0.0.127 is that custom wildcard mask for the slash 25, right?

So that is what-- that's how the router knows its-- all of these IP addresses, 0 through 127.

So, I'll hit the question mark.

It says, "Okay.

You can either type in a destination address or put in port numbers."

Now, again, we're not going to make that mistake.

If we type in a port number here, it's the source port number and we're not doing that.

We don't-- we're caring if it's going to the Telnet and SSH protocol.

It's going to this device on port 22 or 23 not coming from port 22 or 23.

So I'm going to say, it's going to the host 10.1.1.1 'cause we're only permitting access

to this one using those port numbers.

So, let me-- now, okay.

So we've got the source so this is the source information, this is the destination

and now we can put in the port number.

So I'll say equal to.

Oh, there's another way I could do this, but I'm not going to do that yet.

So, we're going to say equal to 22, enter.

And then I'm just-- I mean, now it's easy.

I hit the up arrow and say equal to 23.

That is SSH, that's port 22, and Telnet is port 23.

Now, what I was brainstorming is I was saying you could also come in here.

I mean, the options are endless.

I could type in-- not reflect.

I could type in reflect, but I'm going to say range and I could say 22 to 23.

That would do it in one line if you want doing an access-list.

So, it's saying both of those port numbers from-- or I could 22 through 1024.

I mean, you can put in whatever is the end port.

So that would be another option, but we're not doing that.

So, delete list.

Okay. So let's do a show ip access list on the source.

So we've got-- okay, the core of this is done.

We're permitting this and this.

And so initially, like, okay.

I think we're good.

We can apply it, right?

No. Because what that will do is that says, "Okay.

You're permitted to access this on port 22 and 23,

but everything else hits the implicit deny, right?"

And that would say, "Okay.

I can't access anything over here.

I can't get to this guy."

I mean, so you might-- you know, this was said, only block access to that,

not all of the other pieces that are in here.

So, we've got to be a little more-- do a little more than that.

So I'm going to come back here and we're going to say, okay, so,

I need to say these two are permitted.

Everything else to this guy has to be denied to that IP address 'cause it says only

as it tells us, but then I need to permit everything else, right?

Everything else should be allowed and that's exactly what we'll do.

So come back in here.

I'm still in the named access list so I'm going to say, deny, with caps lock, with authority.

Deny and I'll say-- and this is a very common mistake, it's easy to say, TCP.

You know, just kind of copy and paste this whole thing again.

But remember, TCP is just TCP.

There're all kinds of other stuff so I'm going to say, deny IP.

So everything else from-- now we can copy-paste actually this whole thing,

everything else from this source to this destination is now denied, right?

So, hang on, let's look at the access list now.

It says, "Okay, this is allowed so I can SSH, I can Telnet," then everything else

from this source to this destination is now denied, which is achieving our goal, but then--

but I want to say, but beyond that, everything else is allowed, how do I do that?

Permit IP.

[laughs] I was thinking I was like, "I think I forgot."

Permit IP any any.

So now, that allows everything else.

So, here's what I want to-- here's a couple of things.

So, okay-- so, let me finish the config and then we'll expound on it.

So now I want to go in to interface Serial0/1, right?

Now, this is going to be where we apply it as things are going out of that interface.

Ooh, is that the most efficient?

Actually, no.

Man, I almost busted myself.

The most efficient would be inbound right here.

This is really efficient, you could say as it's coming out this interface

but you could be even-- you could-- but the router would then have to accept it, process it,

and get it to here just to find it was denied.

So, we can even save a couple more processor nanocycles by saying, you know,

as it comes in right here, I want to say, "Are you going right here, using anything other

than Telnet and SSH 'cause you're going to be denied."

So, this will be our good application point.

So, I'm going to go into not serial-- FastEthernet0/0 and I'll do IP access--

write that down, IP access group R3 Telnet SSH in.

Ooh, we've now applied that in the inbound direction.

Okay, so here's something-- I want to show you something that I find a lot

of folks get stuck on, I got stuck on it when I first learned access list.

So, I know a lot of people run into this as well 'cause as I see it.

So, we just said, deny everything to 10.1.1.1, right?

Except for-- yeah, I know-- I know except for port 22 and 23,

that's permitted, that's Telnet and SSH.

So the question is, if everything is denied right here, can this host still make it

through here and access that guy?

You know, option A, yes, option B-- you know, here's your exam, no,

option C none of the above, whatever, you know,

this would be a good exam question, will it make it through?

The answer is actually absolutely yes, no problem, because remember,

this guy is 192.168.2.50 and he-- let's say he's trying to access 192.168.2.150, right?

So, let's just say he pings from here to here.

Well, all IP is denied to 10.1.1.1, so the packet will actually fly along--

well actually, we put the filer right here, but let's just pretend we put it right there.

The packet would fly along and as it comes in here, it would say, "Okay,

are you 192.168.2.0, are you part of this subnet?"

And he would say, "Yes, I am."

And he would say, okay, are you trying to access, you know--

let's look at the access list, it would say, are you trying to acces-- where am I?

Oh, right here, "Are you trying to access this IP address using port 22?"

And he would say, "No, actually I'm not."

He's going to say, "Okay, okay, are you trying to access this IP address using Telnet?"

And the packet would say, "No, actually I'm not."

And then he would say, "Okay, then you're not permitted on either one of those."

He goes, "Okay, now wait a sec, are you this person trying

to access this IP address in any way whatsoever?"

And the answer is, "No, I'm not.

I'm not interested in you at all, I don't even know you exist," from this guy's perspective.

I created a packet which was a ping and I said, "It's coming from the source IP address

of 192.168.250 going to the destination IP address of 192.168.2.150."

So, when this packet gets here, he goes, "Okay well, you know what,

as long as your destination IP address is not 10.1.1.1 'cause if it were,

man, you're busted, you're dropped.

But since your destination IP address is not 10.1.1.1, then I'm going to say,

this is not a match because you're not trying to access--

even though you're going through that IP address, you don't know you're going through it,

you're not trying to access that IP address.

So, that line doesn't match and you hit the permit IP any any at the bottom."

Are you feeling it yet?

Are you looking at these access lists and starting to feel little warm and cozy with them?

Let's do two more, I want to solidify this down.

Number one, block 192.168.1.0/24, that's these guys from accessing any WAN IP address,

so that's this and this, those are our Wide Area Networks links.

Okay, so there's two ways we could approach this, first off it says, from reaching any--

from reaching, that's a keyword there, because that means block everything,

don't-- TCP, UDP, everything, right?

So, from reaching, okay, second thing is there's two approaches we could take,

there's I'm sure plenty more of that but two main ones, one we could say deny

to that IP address, deny to this IP address, deny to this--

you know, do the individual host route and deny to each one of those,

we could do that in four ACL statements.

We could also go in there and say, deny to this network, deny to this network

and we could do the same thing into ACL statements, rule of thumb, less is more.

The shorter your access list the better it is because it takes less to process

that kind of access list on your router.

It's more efficient and it's just the best practice.

Fewer lines is better access list.

So, that's the way we want to go with it.

So, what I'm going to do just so we don't get any old access list in the way from our test,

let's first off go to router 1, and I'm just going

to remove any access list that we have in action.

Let me do a show-- let's just do a show run and I'll do section interface, show me the config

for all the interfaces, oop there is one, we got one on the FastEthernet0/0.

So, that's-- looks like that is the only one, I'm going to do interface, fe0/0,

no IP access group 100 in, that section command is pretty nice, huh?

So, you can see just those sections of the configuration.

You can do that with just about anything in the running config.

So that's out, okay now let's look at this, block 192.168, so let me just scoot this

over here, from any WAN IP address.

So, first thing we want to do is go in and set up the access list.

So, let's use the named one, now that we know the named access list,

that's all I use nowadays.

So, I'll say IP access list extended and I'll say the name of it is NO WAN, NO WAN FOR YOU.

[laughs] So, the NO WAN FOR YOU access list is going to say, rule number one,

deny or sequence-- you know, first sequence, deny, who are we denying?

What's the source?

Oop, what protocol are we denying?

It's going to be IP because it's everything, right?

TCP, UDP, et cetera.

What source?

It's going to be 192.168.1.0, what wildcard mask?

0.0.0.255, right?

Good so far?

Identified the first three octets.

Next one, it says, "Okay, what is your destination address?"

Okay, let's look at-- scrunch this down a little bit,

destination-- I want to deny these networks.

Okay, we need a little pen work here, 10.1.1.1/0 or dot zero slash 30 and dot 4 slash 30.

We want to find out what those mean and again, I just want to emphasize, you know,

slash 30 equals, if we were to convert that to decimal, you know, would be eight ones,

eight ones, eight ones and then so that'd be 24, 25, 26, 27, 28, 29, 30, so we got--

I count that right, six ones, yup and the last [inaudible].

So, that's 255.255.255.252, kind of get back to that decimal form 'cause we can see it,

it makes sense to us and that 252 is represented right there, it is six ones and two zeros.

So, I'm going to say, what is my increment?

It is a four, that's 1, 2, 4.

So, the increment when we-- they came up with these subnets was a four,

so the ranges is actually 10.1.1.0.4.8., this is our typical WAN link range.

I know, I know, some of you are like, "I got that," but some people don't.

So, I want to show the reverse engineering of this along the way.

So, now we want to say, "Okay, well I'm going to say this destination and this destination

on the block, but I have to use a custom wildcard mask for that."

So again, just like we saw previously, for a custom wildcard mask,

we can either reverse all the ones and make them all zeros, zero, zero, zero, and then, you know,

one, two, three, four, five, six, one, one, and do it that way or you can take this

and subtract it from all 255s, you know, 255.255.255.255

and our ending wildcard mask would be 0.0.0.3 and get the same thing, you know,

it's either a 1 plus 2, that's 3, or just subtracting 252 from 255 gives you a 3.

So our wildcard mask and it is wild looking for those WAN links will be 0.0.0.3.

So, first off destination address, so WAN link number one, there, wildcard mask, 0.0.0.3, good.

WAN link number two, now this we can just hit the up arrow 4 and say 10.1.1.4, okay good.

Let's look at our progress so far, I'm going to do a show IP access list.

We've got two of them, this one we've removed

from the interface, so it's not interfering anymore.

We've got the NO WAN FOR YOU access.

You can't even say it, "Yeah, no WAN for you," we have to say it

like the Soup Nazi from Seinfeld.

So, we've got the source subnet going to this and going to that,

so now we've got all denies, that's great.

So, we need a permit.

So I'm going to hit the up arrow and let's-- well I'll just do a--

wait a second, I'm still in the named acces list mode.

So I'll do permit ip any any.

Looks good to me, yeah, all right.

So, now where do I apply this?

I'm going to-- I would say-- well, if it applies to 192.168.1.0, the best possible way,

the most efficient possible way would be inbound right here, okay?

We could do it outbound right here, however, we would have to process it more

to actually send it out and deny it.

So this is the most efficient way.

So in FastEthernet0/0.

So get back there.

[ Pause ]

Done. IP access group, NO WAN FOR YOU in.

So to test, let's go over to the PC number 1 to make sure this thing is working here.

PC number 1, let's do a ping, let's just make sure we can ping anything 10 dot--

192.168.1.1, that's my default gateway.

And now, even though-- and another great example of what I was just telling you

from the previous slide, even though they're denied-- my pen is doing something very odd.

There we go.

Even though they're denied from accessing these WAN links,

they can't ping the WAN links themselves,

that doesn't mean they can't go through those WAN links, right?

Because again, it's coming from this source going to this destination,

that doesn't violate any access list at all.

So I should be able to have no problem on router PC1 I should say,

pinging 192.168, let's just go 2 dot 129.

Let's go in all the way over there to the right hand side and that's pinging just fine.

So let's now ping the WAN links.

Let's go 10.1.1.1.

Unreachable, that's what we want to see.

The use indicate access list are stepping in to intervene.

Let's go back into our show ip access and I'm seeing-- I'm seeing some--

a lot-- matches on that first one.

That's the first subnet.

So let's just ping the second subnet so let's go to-- let's go to-- I scribbled it all, 10.1.1.5,

that's going to be router 2, 10.1.1.5.

And again, unreachables being seen-- oop, I don't know what I've done there.

So let me just hit the up arrow here and I can see

that now both statements have 11 matches whereas before it was just one.

So we are looking good on that.

Okay, so good, check everybody onboard?

Great. Last one, permit 192.168.2.50-- permit--

okay, okay permit access to 192.168.2.50 using only SMTP, POP3 and IMAP4 from anywhere.

So clear off all the chicken scratch and this is the computer in question.

So we're saying, permit anybody to access that using SMTP-- only SMTP, POP3 and IMAP4.

You see, while knowing those port numbers is so critical, these are all TCP-based protocol,

SMTP 25, POP3 110, IMAP4 143, so you immediately can fill in the gaps on your firewall.

So only those ports are allowed in.

I want to show you another use of access list while we're here.

It is the last example so I figure, why not.

Have you ever heard of a debug IP packet?

If somebody tells you to type it, don't.

But what it is, is it's the ability to--

you know, the ability to see just about every single thing passing through.

So for example, let me just-- now I'm in a lab environment.

By the way, this will likely take down a production router if I type in debug IP packet.

What it's going to do is show me the output of every single packet that is going

through my router at this time to the screen.

Now, not that you know, like, well, that was exciting.

Because this router is literally sitting idle, that's very rare.

But for instance, [inaudible] say ping, let's just ping 192.168.2.1.

I can see that-- I see five exclamation points and then it shows to my screen.

Okay, it looks like here is packet one, this source went to this destination, I sent it out

and then this destination responded to this source, you know, I received it in.

So you're actually able to see every single packet

that is being sent to and from this device.

You can imagine why in a production network-- I mean, that was what you see,

it filled the screen was five pings.

So in production, when you have thousands of packets every single second,

if you were to turn this on, a lot of times the routers just literally lock.

So what's done often is access list are applied to filter it down.

Let me show you what we can do.

So I want to create a filter for PC2 so I can do a debug, let's do undebug all

that turns off all the debugs and-- 'cause we don't want to get flooded by any means.

But I want to do a debug where I can see if any of these protocols are coming in to my router

or going through my router or whatever.

So I can go in there and I can do access list, a lot of times I use numbered ones

for these 'cause they're always temporary, I'll just do 170.

Permit, now I'm looking for three TCP protocol, so I'll say, permit TCP from any source

to any destination equal to port 25, see that?

Equal to port 110, equal to port 143, I'm creating this custom filter that says,

if any source sends anything, me being anything, traffic on this port or this port or this port,

which is those three protocols, then I want to know about it.

Now again creating access list all day they don't do anything until I do an application,

so here's another-- we don't always have to apply an access list

to an interface, that's only for security.

So here's another use, I can do a debug IP packet but Cisco knows you'll crash your router

if you put that with too much traffic so they always allow you

to filter it down using an access list.

Now also notice, they don't let you us a named access list to do this.

Some things-- there are some things still to this day in Cisco

that you must use a numbered access list for it, that's why they're still around.

So debug IP packet, filter it using 170, okay.

So now, if I do a ping, you know, I do that same ping, I can see the ping and notice,

no messages were displayed because it's like, well, a ping doesn't use port 25,

110 or 143, so let's go a little further.

Let's-- here's what I'm going to do, I'm going to go to router 2 and attempt

to access this host on one of those port numbers, right?

So let's bring up PC2 and then let's go to router 2 and the way that I'm going

to access them on one of those port numbers, is by using Telnet just

like we did previously to test this.

So, do Telnet to-- what is the IP address?

Let's find out, show ip interface brief, I think it's dot 50.

I know it's dot 50, but I've typed the command.

So Telnet to 192.168.2.50 and then I'm going to put port 25.

Look at that.

Connection was refused by host, that's fine.

It's not an email server, it's a router.

But I'm able to verify, look at that, I just received a packet from that person

and I'm able to see what's going on.

You can say well, show me port 110.

See that right there?

Show me port 23, not part of my access list, right?

I'm able to get in there and you know, no messages are displayed, whereas,

if I wouldn't have had that access list, let's check this out.

Hang on, let me just bail out here.

So let's just do-- here, I'll do a u all, that's a shortcut for undebug all and then I'm going

to do a debug ip packet and now watch what happens when I do that same Telnet.

It's like, that's just for that Telnet session.

So you can see how valuable it is to be able to filter it down to just--

again, just another perfect use of an access list.

Now let's accomplish our goal.

We need to permit access to this guy using only SMTP, POP3 and IMAP4 from anywhere.

So already, again we're thinking ahead, right?

We have to create the access list, we have to configure it,

but we don't know where to configure it yet because we first have to determine

where it's going to be applied, where am I going to apply this?

Now this kind of reverse it.

Remember I said, "It's best to apply extended access-list as close to the source as possible."

Well, the problem is we don't know the source, it could--

you know, it's saying, "Permit access using only these ports from anywhere,"

so the source could be over here, it could be over here, there could be some cloud here

with you know raining dogs-- anywhere is a big name so it could come from anywhere.

So there's no way I can say, "Okay, I'm going to put it there to catch them as soon as possible."

Now I have to put it as close to the destination as possible

because I'm filtering it from anywhere.

See what I mean?

With that anywhere argument, it kind of changes the story a little bit.

So, what I'm going to do is I'm going to hang out on router 2,

that's where the filtering is going to happen, I'm going to go in and-- oh, I was Telneting.

So back on router 2, there we go, go in to global, let's do ip access-list, I don't know,

what do you want to call it, extended, we'll call it port filter and then we will say, well,

actually you know what, better name EMAIL FILTER.

Those are all email protocols so maybe that is an email server.

So we will do permit, so what are we permitting?

We're permitting TCP-based traffic, right?

Not IP, that's everything, TCP 'cause all those are TCP-based protocols, from where?

Well, it's in a box, below the screen.

Anywhere, to where?

Well, this is where we can get a little more specific.

We could say, "Okay, this is going to the host 192.168.2.50 and you know

that we could have also left host off and done 192.168.2.50 with a wildcard of 0.0.0.0.0,

that's fine so we've got permit, protocol, source, destination

and now the destination port number.

Destination port will be equal to so I put eq to 25 and now it's as easy and up arrow 110, 143.

And so now, we look back here and so-- okay, well where am I going to apply this?

Again from anywhere means it could be coming in here, it could be coming in here,

it could be coming from some mysterious interface

that hasn't been added yet, but will be someday.

So, I think it would be best since it's always from anywhere to catch it as it's going out.

So as things are coming in here, they're not filtered, but once they go out to try

and get to that server that's where I'm going to smack them down.

I'm going to say, "No, you've got to use these ports, otherwise you will be denied access."

So, let's go to router 2 right there and to interface FastEthernet0/0

and we will do IP access group and it is-- oh, it's the email server?

Email server, right?

Email filter, I'm glad I looked, email filter outbound.

Good. Now we've got an action, let's test it, let's go-- let's camp of it at router 1.

So we'll attempt to access that host from router 1, so-- good I just-- good grief.

I just caused an outage.

[laughs] Some-- I just took down the network,

see how and I did so on purpose because I wanted to demonstrate.

I just-- you see how easy it is to where I said, you know,

allow access to that host using those port numbers.

Let's do a show access list okay, I didn't do it on purpose

but man that would-- that would've been devastating.

So what this did is it says, "Okay, permit any host to access this guy using this,

this and this," and you know, there's an implicit deny for that.

Now, we might say, "Well, isn't that what we want?"

Well maybe, but isn't there more people on that network than just dot 50?

I know we can only see in this little picture of dot 50.

But if I've got a subnet here, I'm assuming the reason I have a subnet,

and not just like a crossover cable going to a computer,

is because there's other hosts on here.

You know what, they just lost their access completely because even if they're trying

to come out, nothing can come back

in because the only thing allowed back in is these three port numbers.

So, any of you catch that.

ip access list extended email filter and let's do-- now we need to add a statement,

we will say, "Deny ip from any source to the host 192.168.2.50."

Now you're going, "Well, that wasn't what I expected to do.

I mean, do a show access-- do show IP access."

So right here, wait a second, why are you denying,

I thought you said we've been too restrictive.

Well, we have because nothing-- everything else is denied because the same--

and I'm going to follow this up with is permit IP any any, right?

So now, we've got these three ports allowed, everything else is denied to that host

but then everything beyond that because we weren't told

to put any restrictions beyond that, everything beyond that is allowed.

Okay well, it's already applied so the damage had been done,

but now connectivity has been restored but, oh man, I'm kind of--

I didn't do it on purpose but yes I'm kind of glad I did because do you see how easy it is?

You're like, oh I see my objective let me just do this, apply it and I mean, right there,

that would have been a complete network outage for everybody else on that network except

that one server but even that one server would only be able to get those three ports coming in.

So, good. Do you see now why I said that extended access-lists are almost always used

for filtering like we've been doing all along.

There's just so much more flexibility than a standard access list.

So at this point, you might say, well, I mean after seeing that,

it seems like all I would ever use is an extended access-list.

Where would I use the standard?

Standards are still used in particular places but usually,

they're applied for a specific purpose.

I want to do one more demonstration to show you a typical use of a standard access list.

It is for restricting access to Telnet in VTY.

Did I just say Telnet VTY?

Telnet and SSH which both come in the VTY ports of your device.

So here's the problem.

A lot of times, we have our routers connected directly to the internet that's one

of their key goals is to take the internet connection

and route it in to our internal network.

Well, once we connect it to the internet, it's going to have an IP address,

we'll just say 150.1.1.1 that anybody out in the world can access.

And you know what?

Cisco, by default, does not have any kind of password locking mechanisms or things

like that enabled so somebody out here in the world could just run a little script

that runs all day everyday that tries the Telnet or SSH into your device

and attempt different user names and different passwords, it's called the brute force attack.

They're very inefficient because that's what they have to do, they have to sit there

and just try and try and try until it happens to come across some combination that works,

but the problem is in their persistence, this guy can start a brute force attack and walk away

and allow it to run a year later, it's still running.

I mean-- and by then, it's tried thousands and millions of possible combinations

of passwords likely could stumble on yours depending on the strength of your password

and so on, that's why we need good strong password, but why run that risk?

Let's set it up to where only particular IP addresses from the outside

or maybe no IP addresses from the outside can get in.

Now, we don't want to apply an access list here

because that will now filter all traffic that's going in to that device.

I just want to apply an access list that filters access to VTY.

Well, there's a special command that allows you

to apply an access control list to your VTY ports.

It is known as access class.

So what I can do is create a standard access list, for instance,

let's just say my internal network is 10.1.1.0/24 and I only want my internal network

to be able to Telnet and SSH in here,

and I don't want anybody else, nothing from the outside world.

So what I can do is let me just grab a router, any router will do, how's router 3?

I'm going to go in and create a standard access list, IP access list standard

and we will do, let's just say VTY ACL.

Now, once in here, I'm going to do a permit 10.1.1.0 wildcard mask 0.0.0.255 and hit enter.

After seeing extended access-list

so much doesn't simple-- or standard just seem so simple?

It's just like-- it's like, wow, was it really that easy?

So that's it.

So just permit those source IP addresses.

Now, instead of going in to an interface, I go into--

line VTY zero space 4 and do access-class followed

by what access list I'd like to use, VTY ACL inbound.

So, essentially now, as people are Telneting, you know,

in Telnet and SSH both uses the VTY lines, as they're trying to Telnet into my device,

the VTY is going to say, "Are you from 10.1.1.0?

If you are, you're allowed, otherwise,

you are completely restricted from Telneting to this device."

So standard access lists are great when you can apply them in such a way

that it doesn't impact a bunch-- if you just need to identify a whole bunch

of source addresses for quality of service or for Telnet access or for again the millions

of other uses that you will learn in your journey through Cisco, then absolutely,

standard access list is the way to go, so much simpler.

I hope this has been informative for you and I'd like to thank you for viewing.