Access-list tutorial: CCENT

How to create and use an access-list for filtering on a Cisco IOS router.

Category:

Education

Tags:

• ccent
• access-list
• cisco
• ios

[vicky9323480065]

Keith:- as we know that by default their is explicit deny at the end of the access-list .if have created an access-list with just one statement and that is remark.so technically it should deny all the packet.but it doesn't what would be the problem plz help me

[Keith6783]

@vicky9323480065

An access-list, that has no permit or deny statements, as well as any access-list that doesn't exist, when applied to an interface takes absolutely no filtering action, whatsoever, including any implicit deny.

A show run will show that your access-list with only a single remark statement is in the running config, and show ip interface, will show that it is applied to the interface, but a "show access-list" won't show as output, as it isn't considered valid.

Keith

[vicky9323480065]

Keith in the video the host is 1.1.1.1 and the destination is 3.3.3.3 and u have created extended access-list.according to my knowledge the exetended access list is placed closed to source .so why u have not placed it on R1.correct me if i m wrong

[Keith6783]

@vicky9323480065

Great question. R1 owns the IP address of 1.1.1.1 That being said, if R1 sends pings, sourced from 1.1.1.1 that is traffic generated by R1 himself. Outbound ACLs don't block any traffic that was sourced by that same router. Outbound ACLs can stop transit traffic (other devices traffic that may be denied), but not traffic from the same router who has the outbound ACL.

Great question.

Best wishes,

Keith

[xrystalise]

Hey man , This is a good one , Appreciate it . Do you have any videos (offcourse! it should be your make ) anything about VPN's ?

[Keith6783]

@xrystalise

I added a VPN video last month. Hope you enjoy it.

Best wishes,

Keith

[kxzyan]

nice .. Thanks for all Videos, I am trying to watch one by one as go a long , very clear explanations... give me A give C give L ... access list lol... Thanks

[vicky9323480065]

thanks for ur comment.

[veganath]

@Keith6783 Makes sense, keep overheads down, thx for your reply;-)

[Keith6783]

@samarintine

Thanks for your comments. It is appreciated.

Keith

[Keith6783]

@veganath

Great question. If we were going to travel to Disneyland today, but it is closed, and not open for business, when would be the best time to find discover there was no access, before we travel hundreds of miles and waste a lot of fuel, or after we arrive outside the gate at Disneyland. Denying the packet, as early as possible, without otherwise negatively affecting the network, is why we would block on R2 instead of R3.

Best wishes and thanks for the comments.

Keith