Ch9 Access Control Lists - Practical

Question 1

Standard ACL Number Ranges

Answer 1

1 to 99, 1300, and 1999

Question 2

Extended ACL Number Ranges

Answer 2

100 to 199 and 2000 to 2699

Question 3

Calculating Wildcard Mask

Answer 3

Subtract specific network’s subnet mask from 255.255.255.255.

Question 4

Command to Configure IPv4 Standard ACL

Answer 4

access-list access_list_number { deny | permit | remark } source_ip [source_wildcard] [log]

Question 5

Command that displays lists/contents of access lists.

Answer 5

show access-list

Question 6

Command to Attach ACL to an Interface

Answer 6

ip access-group {acl_number | acl_name} {in | out}

Question 7

Configuring Numbered Standard IPv4 ACL (3)

Answer 7

1. access-list acl_number {deny | permit | remark } source source_ip [source_wildcard] [log] // repeat to create multiple entries which are numbered automatically.
2. interface interface_id
3. ip access-group acl_number { in | out } // applies ACL to interface

Question 8

Configuring Named Standard IPv4 ACL (5)

Answer 8

1. ip access-list standard acl_name
2. {deny | permit | remark } source_ip [source_wildcard] [log] to create entries.
3. Exit ACL Config Mode
4. interface interface_id
5. ip access-group acl_name {in | out } // applies ACL to interface.

Question 9

Editing ACLs with Text Editor (3)

Answer 9

1. use show running-config | include access-list acl_number | acl_name to display lists.
2. Copy acl section into text editor.
3. Make changes to ACL and then paste back into router terminal.

Question 10

Editing ACLs with Sequence Number (4)

Answer 10

1. use show access-lists { acl_number | acl_name } to display current ACE’s within the designated ACL.
2. use ip access-list {standard | extended } {acl_number | acl_name } to enter ACL config mode.
3. Delete old ACE by using no acl_number
4. Edit by using : acl_sequence_number modified_ACE
   ex: 10 deny host 192.168.10.10

Question 11

3 Methods to Verify ACLs

Answer 11

1. show access-lists [acl_name | acl_number]
2. show ip interface interface_id
3. show running-config | include access-list [acl_name | acl_number]

Question 12

How to Determine if an ACL is Working Properly.

Answer 12

show access lists : will display matches to permit or deny entries as the ACL is used.

Question 13

Command used to clear the match counters in an access list.

Answer 13

clear access-list counters [acl_number | acl_name]

Question 14

Using ACL to Control VTY Access

Answer 14

1. line vty vty_range
2. ip access-class acl_number {in [vrf-also] | out}
3. exit
4. access-list acl_number {permit | deny | remark } source_ip [source_wildcard] [log]
5. access-list acl_number deny any

Question 15

Logical Operators That Can Be Used in Extended ACLs (4)

Answer 15

1. eq (equal)
2. neq (not equal)
3. gt (greater than)
4. lt (less than)

Question 16

Command used to display list of port numbers and keywords that can be used to build an ACL

Answer 16

access-list 101 permit tcp any any eq ?

Question 17

Command Used to Configure Extended ACL

Answer 17

access-list [extended] acl_number { deny | permit | remark } {protocol_number | protocol_name} source_ip [source_wildcard] [operator operand] [port port_number_or_name] destination [destination_wildcard] [operator operand] [port port_number_or_name] [established]

Question 18

2 Methods to Verify Extended ACLs

Answer 18

1. show access-lists
2. show ip interface interface_id

Question 19

IPv6 Version of the access-group Command.

Answer 19

ipv6 traffic-filter acl_name {in | out}

Question 20

Command Used to Create IPv6 Access List

Answer 20

ipv6 access-list access_list_name

Question 21

IPv6 ACE

Answer 21

{deny | permit | remark } ipv6 | ipv4 {source_ipv6_prefix/prefix_length | any | host source_ipv6_address} [operator [port_number]][destination_ipv6_prefix/prefix_length | any | host destination_ipv6_address} [operator [port_number]]

Question 22

Procedute to Apply IPv6 ACL to Interface

Answer 22

1. interface interface_id
2. ipv6 traffic-filter acl_name {in | out}

Question 23

How Do You Apply ACLs to VTYs in IPv6?

Answer 23

access-class acl_name {in [vrf-also] | out}

Question 24

3 Methods to Verify IPv6 ACLs

Answer 24

1. show ipv6 interface interface_id
2. show access lists
3. show running-config

Question 25

FTP Port

Answer 25

21 TCP

Question 26

SSH Port

Answer 26

22 TCP

Question 27

Telnet Port

Answer 27

23 TCP

Question 28

SMTP Port

Answer 28

25 TCP Outgoing Mail

Question 29

POP Port

Answer 29

110 Incoming Mail

Question 30

HTTP Port

Answer 30

80 TCP

Question 31

IMAP Port

Answer 31

143 TCP

Question 32

IRC Port

Answer 32

194 TCP

Question 33

HTTPS Port

Answer 33

443 TCP

Question 34

TFTP Port

Answer 34

69 UDP

Question 35

RIP Port

Answer 35

520 UDP

Question 37

When is it best to use an Inbound ACL

Answer 37

When attached network is the only source of packets needing to be examined.

Question 38

When is it best to use an Outbound ACL

Answer 38

When ACL will be applied to multiple inbound interfaces, but exiting the same outbound interface.