DEMO: Standard Numbered ACLs

We're going to cover the commands used to configure a standard access control list. I'm on this demo laptop right here, and we're going to be pinging this switch over here. We're going to put a standard access list on router 3, specifically on this interface right here on router 3, that is s000. And what we're going to do is see how we're going to block certain traffic and allow certain traffic.

One reason why I chose to put this on router 3 is because it's a standard access list, and so a standard access control list has to be placed closer to the destination. That's because what we're going to do is block certain traffic and accept certain traffic from this demo laptop. If I put it on router 1 right here, then I would block me from getting to any of these devices over here, versus if I put it on router 3, it's only this network on the far end.

The setup

What I've done on the demo laptop is I've configured three different IP addresses. If you want to see what that looks like, what I can do is bring up a command prompt and do an ipconfig, hit enter, and you can see I've got 10.1.10.34 and 10.1.10.244. So those are the three IP addresses I have configured on this machine.

From those three different IP addresses that I have right there, I am pinging that switch on the other side. So here I'm pinging 10.2.0.5 from 10.1.10.34. I'm pinging the same IP address here but from dot 35, and on this one right here it's the same IP address but from dot 244. You can see everything's functioning right now and making it over to that switch, and the traffic is coming back.

Building the access list

As I mentioned, I'm going to be putting this on router 3, so I'll pull up router three. The first thing that I need to do is go into the global configuration mode, and my first command is going to be a remark. The remark is just a way for me to be able to flag what this particular one is doing. So in this case right here, this one is allowing access from demo laptop. I want to make sure the demo laptop has the ability to make it over to the other side.

The next one I'm going to do is put in the command that's going to actually allow that. So it starts out with access-list, the access list number, which is 42 - it's going to all be 42 - then I'm going to permit this, and I'm going to permit it from the host 10.1.10.34. So we'll get that in there.

The next thing I'll do is another remark statement, and this remark is just saying that I'm going to be denying traffic anywhere from the dot 32 through the dot 47. So I'll do that, and since it's a range here I'm actually going to use a wildcard mask. So access-list 42 deny the network range here that I'm specifying, which is going to be 10.1.10.32, and the wildcard mask for that range is going to be dot 15. So I'm specifying that range is going to get blocked, and I'll hit enter here.

Now notice that nothing has changed down here so far, and the reason why nothing has changed so far down here is because I have not applied this to any interface, so I wouldn't see anything change.

Next, what I'm going to do is one more remark statement, and what I want to do is allow all other traffic, and so the 10.1.10.244 would fall into this. And so I am going to do the permit any statement here at this point, and I'll enter that in. And now all my statements are within this router.

Applying it to the interface

So I'm going to get into the interface s000, we'll hit enter, and then I'm going to apply that, so ip access-group 42 - so the access list number 42 - and I want it coming in. So if I were to take a look at that, that's going to be right on this interface right here, and the traffic coming into it.

I'll hit enter, and once I hit enter you can see immediately I start getting a destination net unreachable for this traffic that's coming from the source 10.1.10.35, which is exactly what we said. We said permit the demo laptop, and notice the demo laptop is within this range right here, but because that statement comes first it's going to still permit that traffic. Then we've got a deny, so I'm denying all other traffic from that 32 through 47 range, all the IP addresses in that range except for dot 34. And then the next thing is I am permit any, so all other devices now can get to this network. So now I've implemented this access control list, and you can see the repercussions from that.

Checking what is on the device

Of course, what we want to do is also be able to see what access lists are on this device, so let's go over a few commands that will do that. First of all, what I'm going to do is I'll end out of here, and so we can take a look at some of these. I'm going to do the show run and we're going to include, so pipe and then include - or actually we'll do section, so section access-list - and we'll see what comes up here. So it actually lists out the running configuration and how it's set up there, but just that part of the access list, where it's showing the different access lists.

Next I'm going to do a show ip interface, and it's s000, so we're going to take a look at this interface. There's going to be quite a bit here, so I'm just going to take a look at the access list part. I'm going to hit enter, and we can see that the outgoing access list is not set and the inbound access list is 42, which makes sense because that's the one that we set it on there.

All right, next I'll do a show access-list and we'll hit enter, if I can spell that correctly. So there we have it, we have 10 permit. And this is without the remark - what's actually in the running config, it has the remarks. This is showing the list that puts a 10, 20 and 30 at the beginning of these. Those are the line numberings that are in there, that will come into play later. It's showing us the permits, and then it's also showing us how many matches. So we've matched off of this 696 times, we've matched off of this 330 times, and we've matched off of this one 182 times.

So what I can do now, if I wanted to clear that list out, is I can do a clear access-list counters, and we can hit enter there. And let me take a look there, and we can see that the numbering has reset, so we've got new numbers in for that at this point in time. So that's how you clear out those numbers.

Removing the access list

Next I'm going to go ahead and take these access lists off. So what I can do is get into the interface - I'm going to go conf t and then interface s000 - and then we'll do a no ip access-group, and then this is 42 in. And we'll hit enter here, and as soon as we do we can see we are now pinging from all of these IP addresses. So we took that off, and now all traffic is able to get to there.

Now one thing that I will note is I have this permit any at the end here. Remember, if I were to remove this, this last IP address would not be able to get there, because it would block all of the traffic - there is that implicit deny any. So we just have to be conscious of that.

If I want to remove the access list, I'm going to exit out of here, I'm going to do a no access-list, and it's 42, we hit enter, and then that will remove that access list from the running configuration. So there you have it, we've set this up, and that is a standard access control list.