Acls - Access Control Lists|2023/24 Update|Graded A+

Access Control Lists are made up of Access Control Entries which are a series of _________ or _________ rules. Permit or Deny Aside from ACLs being used as a security feature, what other use do they serve? ACLs are also used for software policies when traffic has to be indentified e.g. QoS policy or NAT policy. An Access Control List is made up of multiple Access Control Entries. True What are the three types of ACLS? Standard, Extended and Named What is the difference between a standard ACL and an Extended ACL? Standard ACLs reference the source address only. Range 1-99, Extended ACLs check based on the protocol, source address, destination address and port number. Range 100-199, What kind of ACL is this: 99 ? Standard. Standard ACL range is 1-99, Extended ACL range is 100-199, What is this ACL doing? Is it standard or extended? access-list 1 deny 10.10.10.10 0.0.0.0 access-list 1 permit 10.10.10.0 0.0.0.255 It's denying 10.10.10.10 but allowing everything else. What ACL command uses IP access-list? Named ACL. A number ACL access list command uses access-list ### Instead of using numbers, can use a name. Modern versions of Windows use source port numbers equal or greater to what number? Older versions of windows was 1024. 49151 What three ACL actions are there? deny, permit and remark What command creates an ACE entry to ACL 100 to block tcp from 10.10.10.0 /24 to 10.10.50.0 /24 on port 80? access-list 100 deny tcp 10.10.10.0 0.0.0.255 10.10.50.0 0.0.0.255 eq 80 What command creates an ACE entry for ACL 100 to deny 10.10.10.0 /24 to 10.10.50.0 /24 network? access-list 100 deny ip 10.10.10.0 0.0.0.255 10.10.50.0 What action is different between these two ACE's? 1. access-list 100 permit tcp 0.0.0.0 255.255.255.255 2. access-list 100 permit tcp any Nothing. They do the same thing. What action is different between these two ACE's? 1. access-list 100 permit tcp 10.10.10.10 0.0.0.0 2. access-list 100 permit tcp host 10.10.10.10 Nothing Using ACL 100, create an ACE that denies tcp on host 10.10.10.10 to the 10.10.20.0 /24 network using http and log this. access-list 100 deny tcp host 10.10.10.10 10.10.20.0 0.0.0.255 eq www log What command shows you Access List 100 info? show access-list 100 Can ACLs be applied aside from an interface level with the Access-Group command? No. ACLs cannot be applied in the inbound and outbound direction False. ACLs can be applied in the inbound or outbound direction. You can have a maximum of one ACL per interface per direction. True You can have both an inbound and an outbound ACL on the same interface, using either 2 inbound or 2 outbound ACLs. False. You can have both inbound and an outbound ACL on the same interface, but not 2 inbound or outbound ACLs. What are the four interface options for ACLs? 1. Have no ACL applied 2. An inbound ACL only 3. An outbound ACL only 4. ACLs in both directions. An ACL is read by the router from bottom to top. False. It's read from top to bottom. As soon as a rule matches the packet, the permit or deny action is applied and the ACL is not processed any further. True If a packet matches a rule, it stops process the ACL. True What will happen to 10.10.10.10 with these ACE's? 1. access-list 1 deny 10.10.10.10 2. access-list 1 permit 10.10.10.0 0.0.0.255 This will deny 10.10.10.10 but permit the rest of the 10.10.10.0/24 subnet ACLs work from top down, so the first will take precedence. What will happen to 10.10.10.10 with these ACE's? 1. access-list 1 permit 10.10.10.0 0.0.0.255 2. access-list 1 deny host 10.10.10.10 This will permit all of the 10.10.10.0/24 subnet including 10.10.10.10 The most specific ACLs need to be at the top and the least specific at the bottom. ACEs are automatically numbered in increments of _______. 10. This leaves room so you can insert other ACEs into the ACL. You need to inject an ACE into ACL 110, what command do you enter to do this first? You are in Global Configuration mode. ip access-list extended 110 You need to inject an ACE into an ACL (110), so you've entered ip access-list extended 110. You need to insert it between 10 and 20 that already exist, so you are going to use 15 as the ACE. You need to deny 10.10.10.11 being able to telnet to 10.10.50.10, over tcp. What command do you enter? 15 deny tcp host 10.10.10.11 host 10.10.50.10 eq telnet