Cisco CCNA Training/Exam Tips that are helpful for your Certification Exam! To be Cisco Certified please Check out: http://asmed.com/information-technology-it/

1. CISCO CCNA
Extended Access List
To watch our Cisco CCNA Training Videos Please Check out the link below:
www.asmed.com/c1
ASM Educational Center Inc. (ASM)
Where Training, Technology & Service Converge
Phone: (301) 984-7400

2. CISCO CCNA- Extended Access List

3. CISCO CCNA- Extended Access List
In this Lab we will cover the concept of Extended ACL.
The Goal is that only Pc1=10.10.10.1 will not browse (80) and (FTP =21) on
the web server=30.30.30.200

4. CISCO CCNA- Extended Access List
Solution:
Pre step 1) I know this is Extended ACL why? Since I have both source and destination
Step 1) write your ACL
r1#config t
access-list 110 deny TCP 10.10.10.1 0.0.0.0 30.30.30.200 0.0.0.0 eq 80
access-list 110 deny TCP 10.10.10.1 0.0.0.0 30.30.30.200 0.0.0.0 eq 21
access-list 110 permit IP any any
Blue: Source
Red: Destination

5. CISCO CCNA- Extended Access List
Now source can be a single IP address like above; or a network
For ex: 10.10.10.0 0.0.0.255 (that can be source)

6. CISCO CCNA- Extended Access List
Now I will configure my ACL on R1
R1#
R1#config
Configuring from terminal, memory, or network [terminal]?
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#
R1(config)#
R1(config)#
R1(config)#acc

7. CISCO CCNA- Extended Access List
R1(config)#access-list ?
<1-99> IP standard access list
<100-199> IP extended access list
R1(config)#access-list 110 ?
deny Specify packets to reject
permit Specify packets to forward
remark Access list entry comment
R1(config)#access-list 110 deny
R1(config)#access-list 110 deny ?

8. CISCO CCNA- Extended Access List
ahp Authentication Header Protocol
eigrp Cisco’s EIGRP routing protocol
esp Encapsulation Security Payload
gre Cisco’s GRE tunneling
icmp Internet Control Message Protocol
ip Any Internet Protocol
ospf OSPF routing protocol
tcp Transmission Control Protocol
udp User Datagram Protocol

9. CISCO CCNA- Extended Access List
R1(config)#access-list 110 deny tcp ?
A.B.C.D Source address
any Any source host
host A single source host
R1(config)#access-list 110 deny tcp 10.10.10.1 ?
A.B.C.D Source wildcard bits
R1(config)#access-list 110 deny tcp 10.10.10.1 0.0.0.0 ?
A.B.C.D Destination address
any Any destination host

10. CISCO CCNA- Extended Access List
eq Match only packets on a given port number
gt Match only packets with a greater port number
host A single destination host
lt Match only packets with a lower port number
neq Match only packets not on a given port number
range Match only packets in the range of port numbers
R1(config)#access-list 110 deny tcp 10.10.10.1 0.0.0.0 30.30.30.200 ?
A.B.C.D Destination wildcard bits

11. CISCO CCNA- Extended Access List
R1(config)#access-list 110 deny tcp 10.10.10.1 0.0.0.0 30.30.30.200 0.0.0.0 ?
dscp Match packets with given dscp value
eq Match only packets on a given port number
established established
gt Match only packets with a greater port number
lt Match only packets with a lower port number
neq Match only packets not on a given port number
precedence Match packets with given precedence value

12. CISCO CCNA- Extended Access List
range Match only packets in the range of port numbers
<cr>
R1(config)#access-list 110 deny tcp 10.10.10.1 0.0.0.0 30.30.30.200 0.0.0.0 eq ?
<0-65535> Port number
ftp File Transfer Protocol (21)
pop3 Post Office Protocol v3 (110)
smtp Simple Mail Transport Protocol (25)
telnet Telnet (23)
www World Wide Web (HTTP, 80)
R1(config)#access-list 110 deny tcp 10.10.10.1 0.0.0.0 30.30.30.200 0.0.0.0 eq www
R1(config)#

13. CISCO CCNA- Extended Access List
Here is my show run
access-list 110 deny tcp host 10.10.10.1 host 30.30.30.200 eq www
Hint:
Single Ip address can be written in 10.10.10.1 0.0.0.0 or HOST 10.10.10.1
Now I will do same ACL for FTP=21. Make sure do step by step with? Do not
use up arrow key

14. CISCO CCNA- Extended Access List
R1#
R1#config t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#acc
R1(config)#access-list ?
<1-99> IP standard access list
<100-199> IP extended access list

15. CISCO CCNA- Extended Access List
R1(config)#access-list 110 ?
deny Specify packets to reject
permit Specify packets to forward
remark Access list entry comment
R1(config)#access-list 110 deny ?
ahp Authentication Header Protocol
eigrp Cisco’s EIGRP routing protocol
esp Encapsulation Security Payload

16. CISCO CCNA- Extended Access List
gre Cisco’s GRE tunneling
icmp Internet Control Message Protocol
ip Any Internet Protocol
ospf OSPF routing protocol
tcp Transmission Control Protocol
udp User Datagram Protocol
R1(config)#access-list 110 deny tcp ?
A.B.C.D Source address

17. CISCO CCNA- Extended Access List
any Any source host
host A single source host
R1(config)#access-list 110 deny tcp host ?
A.B.C.D Source address
R1(config)#access-list 110 deny tcp host 10.10.10.1 ?
A.B.C.D Destination address
any Any destination host
eq Match only packets on a given port number

18. CISCO CCNA- Extended Access List
gt Match only packets with a greater port number
host A single destination host
lt Match only packets with a lower port number
neq Match only packets not on a given port number
range Match only packets in the range of port numbers
R1(config)#access-list 110 deny tcp host 10.10.10.1 host ?
A.B.C.D Destination address

19. CISCO CCNA- Extended Access List
R1(config)#access-list 110 deny tcp host 10.10.10.1 host 30.30.30.200 ?
dscp Match packets with given dscp value
eq Match only packets on a given port number
established established
gt Match only packets with a greater port number
lt Match only packets with a lower port number
neq Match only packets not on a given port number
precedence Match packets with given precedence value
range Match only packets in the range of port numbers
<cr>

20. CISCO CCNA- Extended Access List
R1(config)#access-list 110 deny tcp host 10.10.10.1 host 30.30.30.200 eq ?
<0-65535> Port number
ftp File Transfer Protocol (21)
pop3 Post Office Protocol v3 (110)
smtp Simple Mail Transport Protocol (25)
telnet Telnet (23)
www World Wide Web (HTTP, 80)
R1(config)#access-list 110 deny tcp host 10.10.10.1 host 30.30.30.200 eq ftp
R1(config)#

21. CISCO CCNA- Extended Access List
Now I will look at show run
access-list 110 deny tcp host 10.10.10.1 host 30.30.30.200 eq www
access-list 110 deny tcp host 10.10.10.1 host 30.30.30.200 eq ftp
Make sure you give permit; remember there is an implicit deny at end of ACL
R1#
R1#
R1#

22. CISCO CCNA- Extended Access List
R1#config t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#acc
R1(config)#access-list 110 ?
deny Specify packets to reject
permit Specify packets to forward
remark Access list entry comment

23. CISCO CCNA- Extended Access List
R1(config)#access-list 110 permi
R1(config)#access-list 110 permit ?
ahp Authentication Header Protocol
eigrp Cisco’s EIGRP routing protocol
esp Encapsulation Security Payload
gre Cisco’s GRE tunneling
icmp Internet Control Message Protocol
ip Any Internet Protocol

24. CISCO CCNA- Extended Access List
ospf OSPF routing protocol
tcp Transmission Control Protocol
udp User Datagram Protocol
R1(config)#access-list 110 permit ip ?
A.B.C.D Source address
any Any source host
host A single source host
R1(config)#access-list 110 permit ip any ?

25. CISCO CCNA- Extended Access List
A.B.C.D Destination address
any Any destination host
host A single destination host
R1(config)#access-list 110 permit ip any any ?
dscp Match packets with given dscp value
precedence Match packets with given precedence value
<cr>
R1(config)#access-list 110 permit ip any any

26. CISCO CCNA- Extended Access List
Here is my show run
access-list 110 deny tcp host 10.10.10.1 host 30.30.30.200 eq www
access-list 110 deny tcp host 10.10.10.1 host 30.30.30.200 eq ftp
access-list 110 permit ip any any
!

27. CISCO CCNA- Extended Access List
Now I will apply to s0/0
R1#
R1#config t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#int s0/0
R1(config-if)#ip acc
R1(config-if)#ip access-group ?
<1-199> IP access list (standard or extended)

28. CISCO CCNA- Extended Access List
WORD Access-list name
R1(config-if)#ip access-group 110 ?
in inbound packets
out outbound packets
R1(config-if)#ip access-group 110 out
R1(config-if)#

29. CISCO CCNA- Extended Access List
Here is my show run
interface Serial0/0
ip address 20.20.20.9 255.255.255.252
ip access-group 110 out
clock rate 64000
!
!
access-list 110 deny tcp host 10.10.10.1 host 30.30.30.200 eq www
access-list 110 deny tcp host 10.10.10.1 host 30.30.30.200 eq ftp
access-list 110 permit ip any any

30. CISCO CCNA- Extended Access List
Now I will go to PC1=10.10.10.1 make sure I cannot access web server
R1#show access-lists
Extended IP access list 110
deny tcp host 10.10.10.1 host 30.30.30.200 eq www (12 match(es))
deny tcp host 10.10.10.1 host 30.30.30.200 eq ftp
permit ip any any (7 match(es))
R1#

31. CISCO CCNA- Extended Access List
As we see when I tried it; I cannot access from PC1 but i can go to web server from other PC
As we see in order to see where it is applied I do not use #show access-list
I will use R1# show ip int s0/0
R1#show ip int s0/0
Serial0/0 is up, line protocol is up (connected)
Internet address is 20.20.20.9/30

32. CISCO CCNA- Extended Access List
Broadcast address is 255.255.255.255
Address determined by setup command
MTU is 1500
Helper address is not set
Directed broadcast forwarding is disabled
Outgoing access list is 110
Inbound access list is not set

33. ASM Educational Center Inc. (ASM)
Where Training, Technology & Service Converge
To watch our Cisco CCNA Video Trainings Please Check out the link below:
www.asmed.com/c1
Phone: (301) 984-7400