- [Narrator] Now that we have an understanding of
standard access lists and how we can configure them
with both named and numbered access lists,
let's run out to San Francisco
and demonstrate how we can stop the corp router
from telnetting into San Francisco
by using a named standard access list.
Let's take a look.
The first thing I want to as Corp
is I'm gonna ping corp 10.2
and telnet to Corp or San Francisco from Corp.
All right, looking good, and we'll get back out.
And let's run out.
I wanna call (mumbles) San Francisco
because I'm gonna block Corp.
So I'm gonna say config T.
Now I can type access list and use a numbered access list
for standard B1 to 99.
We also have 13 to 1999, we usually don't use those.
You don't usually use standard access list really,
but IP that's the (mumbles) objective.
IP access list standard.
So we're using a named.
I'm gonna call this Block Corp.
Nice, okay.
Not much we can do here, guys,
with the standard access list.
Block the source, right?
So I'm gonna say deny host 172.16.10.1.
That's all I can do.
And then permit all other traffic.
That's a standard access list.
Very simple.
I'm completely blocking the Corp router now.
From doing what though?
And that's what we got to say
011 is the inbound interface from Corp.
IP access group, and it's case sensitive here, guys.
Block Corp in.
Pretty straight forward.
We're blocking the whole router.
The whole IP suite.
So let's run back out to Corp here,
and now we're gonna ping 172.16.10.2.
Okay, can't do that because I've blocked everything,
all protocols.
And I'll type San Francisco and see I can't telnet either.
So, I guess we win, but I'm gonna up arrow
and do a control A and take that off the interface.
So that is no longer on the interface.
Everything should work again.
Very limited with standard.
So let's take a quick look above the objectives
at an extended list and how much better we can do this.
Access extended.
I'm gonna say block, name it something else.
Corp2.
Here we go.
Deny, check this out, TCP from source Corp.
Going to the destination San Francisco.
EQ to telnet.
I can type in telnet here or 23.
It doesn't matter.
All right.
And then since we're keeping this simple,
permit the IP stack from any source and any destination.
Pretty simple.
We're just blocking telnet.
Now what are we blocking it from doing,
and that's what we do here.
Interface S011.
IP access group block sales, not sales.
Block Corp2 and in.
Okay.
So a little bit more specific here.
I'm only blocking telnets.
Take a quick look.
So now I'm gonna ping, and I should be able to ping.
But they shouldn't be able to telnet.
Okay.
Very successful.
Let's do a verification real quick.
This is a much better way to go, guys.
That is a nice (mumbles) two objective,
not an (mumbles) one objective so much.
Show access list.
So we can see I have two of them.
One standard, one extended,
and we can see that I have matches on the lines.
So I denied one match when I tried to telnet in.
It was denied, but I permitted six matches when I pinged
or whatever else was going on.
So it's always better to use an extended access list.
Much more efficient.
Just block what you want.
You can see the limitations of standard access list.
It blocked the complete Corp router in
and any packets coming in of any type.
Thus the limitations of standard access lists.