ACL flow Control tool-- Wang Bei's Learning Notes

Flow control tool

ACL: access control list, access control list.

-effect

Based on certain rules, the data flow is matched.

It is only used for traffic matching.

Subsequent processing of these rules is determined by the tool that invokes ACL.

-Classification

Standard ACL: when matching traffic, only the source IP address of the traffic can be matched

Extended ACL: when matching traffic, you can match the source IP address of the traffic,

Destination IP address, TCP/UDP+ port number

-represents

ID: use numbers to represent different ACL

Name: different ACL is represented by name

-principle

An ACL is a set of rules.

In an ACL, there are several different subdivision entries

Different items are distinguished by number

When matching traffic through ACL, it is checked sequentially according to the number from the smallest to the largest.

For each "breakdown entry":

If it can match, then perform the previous action (deny/permit)

If not, continue to check the next "subdivision entry"

If there is no match in the end, the last ACL is executed.

The default "subdivision entry"-reject all (deny any)!

Note:

Any type of ACL ends up with a "reject all" entry.

-configuration steps:

# define ACL

R4:

Ip acces-list standard deny-ping

10 deny 192.168.12.0 0.0.0.255

20 permit any

# call ACL

R4:

Interface fas0/1

Ip access-group deny-ping in

# verify ACL

R4

Show ip access-list

# Traffic testing

On all devices: ping 10.10.4.4

R1 cannot get through, everything else can be reached.

Note: standard ACL is not accurate enough to match traffic, so we strongly recommend that standard ACL calls be made very close to the "target".

R1:

Ip route 10.10.4.0 255.255.255.0 192.168.12.2

Ip route 192.168.23.0 255.255.255.0 192.168.12.2

Ip route 192.168.34.0 255.255.255.0 192.168.12.2

R2:

Ip route 10.10.1.0 255.255.255.0 192.168.12.1

Ip route 10.10.4.0 255.255.255.0 192.168.23.2

Ip route 192.168.34.0 255.255.255.0 192.168.23.2

R3:

Ip route 10.10.1.0 255.255.255.0 192.168.23.2

Ip route 10.10.4.0 255.255.255.0 192.168.34.4

Ip route 192.168.12.0 255.255.255.0 192.168.23.2

R4:

Ip route 0.0.0.0 0.0.0.0 192.168.34.3

/ / this route represents a "default route" and represents all network segments.