Explanation and Implementation of ACLs

 ACLs Categorized

1) Standard ACLs

2)Extended ACLs

There are two methods that you can use to identify Standard and Extended ACLs:

• Numbered ACLs
• Name ACLs

Typed                                Number Range     Identifier

Numbered Standard               1 - 99                   1300-1999

Numbered Extended            100 - 199                2000 - 2699  

Name                                                  NAME

Additional Types of ACLs

• Dynamic ACLs
• Reflexive ACLs
• Time Based ACLs

1) Dynamic ACLs

Using Extended ACLs, It block the router until user complete their Telnet sesseion and after that it allow the traffic.

2) Reflexive ACLs

Used to allow outbound traffic and limit inbound traffic in respond to session that originate inside the router.

3) Time Based ACLs

Allow for access control based on the time of day and week.

Subnetmask: 

When you implement Wildcard mask in IP it written like 0.0.0.255. 

Wildcard mask bit 0 means it match the corresponding bit value in the address.

Wildcard mask bit 1 means its do not check or you can say it ignore the corresponding bit value in the address.

Here We will implement Standard ACLs after configure the Routing protocol, we will configure Access list.

In this Network we will configure Standard Access List, lets take 192.168.1.2 & 192.168.1.3 and we dont want them to connect 192.168.3.0.


In Standard ACL we always implement to closet to the destination. Here closet destination is R2.
Here we go...........


R2
R2(config)#ip access-list st

R2(config)#ip access-list standard ?

  <1-99>  Standard IP access-list number

  WORD    Access-list name

R2(config)#ip access-list standard 1

R2(config-std-nacl)#deny 192.168.1.2 0.0.0.255

R2(config-std-nacl)#deny 192.168.1.3 0.0.0.255

R2(config-std-nacl)#per

R2(config-std-nacl)#permit an

R2(config-std-nacl)#permit any an

R2(config-std-nacl)#permit any ?

  <cr>

R2(config-std-nacl)#permit any

R2(config-std-nacl)#?

  default  Set a command to its defaults

  deny     Specify packets to reject

  exit     Exit from access-list configuration mode

  no       Negate a command or set its defaults

  permit   Specify packets to forward

  remark   Access list entry comment

R2(config-std-nacl)#^Z

Now you can see below that pc 192.168.1.3 can not ping to 192.168.3.2.