23.ACL access Control list
We can configure ACL to control whether packets are allowed or denied to reach the destination. Increase network security.
ACL is divided into:
V standard ACL: control, allow or deny according to the source of the packet. List number range: 1: 99.
V extended ACL: control, allow or deny based on the source, destination, protocol, and port of the packet. List number range: 100,199.
V command ACL: manage standard ACL and extended ACL, and command ACL for easy identification.
Cisco ACL related commands:
Command
Description
(config) # access-list 1 permit 192.168.1.0 (source network segment) 0.0.0.255 (reverse mask)
Allow standard ACL
(config) # access-list 1 deny 192.168.1.0 (source network segment) 0.0.0.255 (reverse mask)
Reject standard ACL
(config) # access-list 100 permit tcp (protocol) 192.168.1.0 (source network segment) 0.0.0.255 (reverse mask) 192.168.1.0 (destination network segment) 0.0.0.255 (reverse mask) eq 80 (port number)
Allow extension of ACL
(config) # access-list 100 deny tcp (protocol) 192.168.1.0 (source network segment) 0.0.0.255 (reverse mask) 192.168.1.0 (destination network segment) 0.0.0.255 (reverse mask) eq 80 (port number)
Refuse to extend ACL
(config-if) # ip access-list standard a (name)
Create a standard named ACL
(config-std-nad) # 10 (serial number) permit 192.168.1.0 (source network segment) 0.0.0.255 (reverse mask)
Allow standard ACL
(config-if) # ip access-list extended a (name)
Create an extended named ACL
10 deny tcp (protocol) 192.168.1.0 (source network segment) 0.0.0.255 (reverse mask) 192.168.1.0 (destination network segment) 0.0.0.255 (reverse mask) eq 80 (port number)
Refuse to extend named ACL
(config-if) # ip access-group 1 in (entry)
Apply ACL to the portal
(config-if) # ip access-group 1 out (Export)
Apply ACL to exits
# show access-list
View ACL status
Note: standard ACL can only be used for portals, while extended ACL can be applied to entrances and exits.
Permit: allow, deny: deny, eq: equal, standad: standard, extended: extension
Case: apply ACL to remote login.
Huawei H3C related orders:
Command
Description
[huawei] acl 2000
Create and enter ACL
[huawei] acl name ren
Named ACL
[huawei-acl-basic-2000] rule permit source 192.168.1.0 0.0.0.255
Standard ACL
[huawei-acl-basic-2000] rule deny ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255
Extended ACL
[huawei] display acl
View ACL
[huawei] display acl name
View named ACL
Note: Huawei H3C ACL must be associated with a flow policy if it is to be applied to an interface.
Case study:
Configuration ideas:
V define ACL
V configuration flow classification
V configure flow behavior
V configure flow policy
Call policy on interface v
