- [Narrator] Alright, now that we have some sort of
understanding of the difference between standard
and extended access lists and saw how they worked
and how limited standard access lists were for sure.
But really what you really wanted to learn was
how to configure a standard access list using names.
In this section here, we're gonna
move onto securing our VTY lines.
Now when we look at our last configuration here,
we added an access list to an interface.
We don't want to do that unless it's absolutely necessary
because it causes latency on the router.
In this case, I want to remove an access list
from an interface and then the access
list is still in global config.
It's not gonna do anything if I
don't have it on an interface.
So in this case here, I'm going to bring up the command.
I did a Control A, which took my cursor to
the beginning of the line, typed a no, space and Press
Enter, that takes the access list off the interface.
Alright, so the access list is no longer working.
And I would be able to now telnet
from corporate San Fransico.
Now we don't want to put an access list
on interface if we can help it.
As I mentioned, it causes latency.
But I want security, I don't want people
telnating into my router or trying to.
So what about if I can put an access list on a VTY line?
Let's go ahead and do that.
So the first thing I wanna do is go back
and I'm gonna say, ip and we'll use the name again.
Access-list standard 'cause I use standard, guys.
Save, I'll make it long, Save_My_VTY, alright.
So this is go, I'm gonna put on every router.
Because now I can put an access list on the VTY lines
themselves, not put one on the interfaces
and it'll allow me to have
great security on my network devices.
So now I'm just gonna do this.
I'm gonna only allow the Corp router in.
In this case here and everyone else will be denied.
So I'm gonna say permit 172.16.10.1, alright.
We're using a standard, I don't really have a lot.
Now, what's the next line?
Well, I'm not gonna type anything there
so what's the next line by default?
Deny any, so if I just leave this, only this
source address can telnat in, okay.
So in this case, here now I need to go to my lines though.
And assign them all, let me do an exit.
Not puttin' this on the interfaces.
Line vty 0, space, 988, choose all my lines.
And you don't use the IP access group,
you use access-class command, okay.
And that's gonna be Save_My, gotta type
it in perfectly _VTY in.
So the only host that can come into my VTY lines
is 172.16.10.1 so let's run out to Corp router.
So let's see if I can ping.
So I don't have anything on the interfaces.
So if I just type San Francisco, I'm gonna
get in because I'm, now that I could telnat
from Corp to San Francisco, we need to verify
that I can't get from somewhere else.
'Cause the only thing we permitted was Corp.
So let's log into LA, we shouldn't be able to telnat.
Let's try ping, 172.16.10.2, I can do that, great.
Oh, I wonder if I can telnat, denied, alright.
So we created an access list, put it on the VTY lines,
secured our router without creating any latency.