hello this is Edie from practical
martinet welcome to a new video series
where I'm going to teach you about
access control lists this series is
meant to be the last set of videos
you'll ever have to watch to understand
this concept this is the first video in
the series where we will be answering
the fundamental question what are access
lists
at its core an access control list is
simply a tool you use to identify
traffic how you apply the access list
then determines what the access list is
actually doing for example if you apply
an axle issed to an interface then any
traffic that is identified by your
access list is being permitted through
that interface this is the most common
application of an ax list but there are
many other use cases for a nexus for
example if you apply an access list to a
network address translation
configuration then whatever traffic is
identified by the X list is processed
through a net if you apply an X list to
a VPN configuration then whatever
traffic you identify with your access
list is then encrypted and sent through
a particular tunnel if you apply your X
list to a route map then whatever
advertisements match your access lists
are being accepted by a routing process
if you apply your X list to quality of
service and whatever traffic matches
your X list is going to be prioritized
or D prioritized so there are these in
many other ways to apply an ax list
again an ACL is simply a tool on a Cisco
router used to identify traffic now for
the purpose of this video series we're
going to be focusing on ax List applied
to interfaces because this is the most
common use for an access list we'll be
using this topology to talk through the
various concepts our topology features a
router in between the inside segment and
the internet we have a couple hosts on
the inside segment and a couple hosts on
the internet now when you apply an ax
list to an interface that access is
sometimes referred to as a packet filter
the idea there if any packets being sent
out by your inside host are gonna be
matched against this ax list to
determine whether the router likes those
packets or it doesn't like those packets
so it's to talk through it let's go
ahead and shoot some packets over let's
have post a shoot a packet to each one
of the servers in our topology in both
cases these packets have a source IP
address of host A's IP address because
host a is sending these packets this top
packet has a destination IP address for
the top server and this bottom packet
has a destination IP address of the
bottom server in both cases the source
port is randomly selected by the client
in this case host a now it's not
explicitly as sit in this illustration
but we can assume that this is a TCP
packet this top packet is destined to
TCP port 80
this means that that is probably a web
request and this bottom packet is
destined to TCP port 443 so we can
assume that as an HTTP request now we're
going to use these two packets to talk
through various concepts for access
control is starting with the two types
of ACLs that exist there are two types
of access control lists on a cisco
router they are standard and extended
the difference between these two is
simply which fields in the packet they
are using to identify particular traffic
a standard acts list is only matching on
the source IP address which means I can
match both these packets by identifying
traffic with the source IP address of
1000 11 that's the only option you have
with a standard axel issed now this does
create a limitation because it only
allows you to provide complete trust or
complete distrust so here's what I mean
by that let's say you had a requirement
that said allow host a to speak to this
top server but don't allow host a to
speak to this bottom server well with
the standard acts list all you can do is
say either permit the source IP address
1000 11 in which case host a can speak
to both servers or deny the IP address
1000 dot 11 which means host a is not
allowed to speak to any server so that
is a limitation of standard axle astiz
that you can only provide complete trust
or complete distress that is why an
extended access list exists an extended
access list allows you to filter on many
more fields five of them to be exact the
source IP address is just like a
standard X list but also the destination
IP address the source port the
destination port and the protocol the
key benefit there is you can create
acces entries that say allow host a
source IP address to speak to this
server but deny host A's IP address for
speaking to this server she can be much
more granular in how you match traffic
so these are the two types of access
that exist you can create either these
types of acts lists and then apply them
to a particular router now when you
apply them you can only apply them once
per interface / direction and per
protocol so let's talk through that bi
interface I mean the actual physical
interface of a router if you recall our
router had two interfaces one of
facing the inside segment and then the
other one facing the internet well I can
apply an axis to a specific interface
now why this is important is because
depending on which interface you're
going to apply your axis to the packet
might look a little different for
example let's just say this router is
performing network address translation
that would mean these two packets on the
other side of the router might look a
little different
notice the source IP address has changed
well if I'm applying an ax list to FA 0
1 and I want to match on the source IP
address this is the source IP address I
need to match but if I'm applying my ACL
to FA 0 0 then this is the source IP
address I want to match so it's
important to know where you're going to
apply the ax list before you actually
write the ax list statements the other
thing to consider is the direction the
packets are going in to discuss it let's
go ahead and get rid of this yellow
packet and let's focus on this blue
packet for a minute this blue packet is
the packet that host a sent to the
server at some point the server is going
to respond win that server responds the
packets are going to look like this the
response traffic is simply a flipping of
the source and destination in the
initial packet notice the source in the
initial packet is the destination in the
response packet either way
notice that both of these packets are
being processed against one interface FA
0 1 the difference is one of those
packets is going out of that interface
and then the other packet is going in to
that interface so when you're applying
your access list you have to choose not
only what interface you're applying it
to but also the direction that's going
to affect how you write your ACL
statements for example if I want to
match this packet I'll be matching
traffic as it comes in to FA 0 1 and
I'll be matching against say this source
IP address whereas if I wanted to match
this packet I would still apply it the
ACL to FA 0 1 but I'd be applying to
traffic as it goes out of that interface
and I'd be matching on this source IP
address the last thing to consider of
where you're applying your access list
is the IP protocol and by that I simply
means ipv4 or ipv6 a single access list
will
only filter ipv4 traffic or ipv6 traffic
you can't have a single axis filtering
both so if you want to filter both v4
and v6 traffic you would have to create
two different access lists and apply
them to a particular interface in a
particular direction now I'll be looking
at the application of axis to router
interfaces in more details in a later
video in this series for now the key
takeaways from this video are these
right here we discussed that an ax list
is simply there to identify traffic and
then how you apply the ax list
determines what the axis is doing we
then discussed that an ax list applied
to an interface is sometimes called a
packet filter and that you can only
apply an ACL once per interface per
direction and for protocol and finally
we discussed the two different types of
excellest that exist and the difference
between them are the fields that they
use to match traffic on with a standard
ax list only matching on the source IP
address and the extended ax lists
matching on source IP destination IP
source port destination port and
protocol in the next video we'll be
looking at the syntax to configure ax
list on cisco routers but as far as this
videos your key takeaways are on your
slide right now I hope you enjoyed this
video I want to thank you for watching
and I'll see you in the next one