Sing a demonstration often helps reinforce a concept.
And that also applies to this Nugget.
Let's go ahead and do a demonstration
of setting up an access control list
to filter specific types of traffic through our network.
So we'll use this typology.
And here is our objective.
We want to filter all UDP traffic.
So at the transport layer, we want
to filter all UDP traffic between computer one, which
is this guy right here at the IP address of 10.1.0.11
and the server out here at 67.83.0.2.
And before we apply any filtering,
let's just verify basic connectivity
with a few protocols between this PC, which is
at 10.1.0.11 11 and the server.
And this little virtual machine that I'm
running as a virtual PC has a command
called Trace, which, among other things,
is going to help us verify connectivity
all the way to the destination along with the path
that we're taking to get there.
So we're going to Trace, the IP address of our server, which
is 67.83.0.2.
And then we're doing a dash, capital P, space 1.
Now protocol number 1 is ICMP, which means it's going
can do this Trace leveraging ICMP.
If we change that number for the protocol to a 6, 6 is TCP.
And that'll come in handy in our testing as well.
And then if we change it to a 17,
17 is the protocol number for UDP.
As see the cool thing is, if we set up an access control
list that just blocks one of these,
we can still verify connectivity with the other two.
So let's get a baseline by testing all three
of these first.
So the first is a Trace with ICMP.
And then we'll put 6.
We'll do our trace with TCP.
And then last, but not least, we'll put in a 17
there for the protocol number.
And then I'll use UDP.
All right, so with out baseline set, let's go over to router 1.
So here on router 1, let's take a quick look
and see if we have any access control lists already in place.
And we do have one access list in place.
It basically is identifying any source PCs
that have the IP address of 10.1 or 10.2.
So this access control list, access list 1,
is being used with translation statements
for the benefit of network address or port address
translation, depending on how the rest of the router
is configured.
So let's go ahead and create a new access control list
that we can then apply to the router interface
to block the UDP traffic.
So we'll do that by going into configuration
mode on the router.
And we'll create the new access list with this entry.
Let's break it down.
This is creating an access list numbered 100.
The action is deny, regarding this access list entry.
And what we're looking for is anything at the transport
layer, which is UDP and if it's coming from the host 10.1.0.11,
that's the source, going to the destination host of 67.82.0.2,
which is our server.
And if we knew specific UDP port numbers,
we could also tack them on with a little eq space.
And then put the actual port number there.
But in our case, what we're going to is,
we're just going to block any UDP traffic between computer
1's address and the server with an access control list
that we're going to use for filtering of traffic.
If we apply this access control list to the interface gig
1/0 on the router, it's basically
going to follow this to the letter.
It's going to compare all traffic coming
into the interface.
And traffic that does match is going to be dropped.
But traffic that does not match, by default,
is also going to be dropped.
So we need one more entry to permit
everything else that's not exactly
matching the first line.
So the second entry in our access control list
numbered 100 says it wants to go ahead and permit traffic
if it happens to be IP, which is referring to layer 3.
That means anything this IP from any source to any destination.
So we'll go ahead and press Enter.
And let's take a look at this access control list.
So the access list, list 100, has two entries.
It has line number 10, line number 20.
And after this is applied to an interface,
these entries will be processed top to bottom.
So every packet coming into the interface
is going to be checked against line number 10.
If it doesn't match, it will checked against line the 20.
And then our last step is to apply this to an interface.
So we'll go to interface configuration
on router 1 for gig 1/0.
And we'll use the Cisco command of IP access group to 100.
And then we want to apply this to all inbound traffic
on that interface.
And we'll press Enter.
So our next step is to test it.
So let's go over to PC 1 and do a test.
And we'll do a Trace with ICMP.
That should work, great.
We'll do a Trace with TCP.
That should also work.
However, if we do a Trace with protocol 17, which is UDP,
that should fail.
And right here we have some telltale signs
that that's happening.
Communication administratively prohibited,
which is the router communicating back
to PC 1 saying, sorry buddy.
Couldn't do it.
In this Nugget, we've verified one application
of an access control list.
And that is to permit or deny certain types of traffic
at an interface on a router.
I hope this has been informative for you.
And I'd like to thank you for viewing.