book

Cisco IOS Access Lists

Name: Cisco IOS Access Lists
Author: Jeff Sedayao
ISBN: 9781565923850

by Jeff Sedayao

June 2001

Intermediate to advanced

272 pages

9h 2m

English

O'Reilly Media, Inc.

Read now

Unlock full access

Cisco IOS Access Lists
Preface
Organization
Audience
Conventions used in this book
We’d like to hear from you
Acknowledgments
1. Network Policies and Cisco Access Lists
Policy setsCharacteristics of policy setsPolicy sets in networksPolicy sets of host IP addressesPolicy sets of packetsComplex policy sets
The policy toolkit
Controlling router resourcesControlling packets passing through a routerControlling routes accepted and distributedControlling routes accepted and distributedbased on route characteristicsPutting it all together
2. Access List Basics
Standard access listsThe implicit denyStandard access lists and route filteringAccess list wildcard masksSpecifying hosts in a subnet versus specifying a subnetAccess list wildcard masks versus network masksThe implicit wildcard maskSequential processing in access listsStandard access lists and packet filteringGeneric format of standard access lists
Extended access lists
Some general properties of access listsMatching IP protocolsMore on matching protocol portsText substitutes for commonly used ports and masksGeneric format of extended access lists

More on matching
Good numbering practices
Building and maintaining access lists
Risks of deleting access lists as an update techniqueDisplaying access listsStoring and saving configurationsUsing the implicit deny for ease of maintenance
Named access lists
3. Implementing Security Policies
Router resource controlControlling login modeRouter login permissionAddresses reachable from the routerRestricting SNMP accessThe default access list for router resources
Packet filtering and firewalls
A simple example of securing a web serverAdding more access to the web serverAllowing FTP access to other hostsAllowing FTP access to the serverPassive mode FTPAllowing DNS accessPreventing abuse from the serverDirection of packet flow and extended access listsUsing the established keyword to optimize performanceExploring the inbound access listImplementing a policy with inbound access listsImplementing the same policy with outbound access listsComparing the inbound and outbound access list implementationsUsing inbound access lists to prevent IP address spoofingMaking routing protocols go through an inbound access listSession filtering using reflexive access listsAn expanded example of packet filteringDefining what access lists are necessaryOptimizing the order of access list entries
Alternatives to access lists
Routing to the null interfaceStopping directed broadcastsRemoving router resources
4. Implementing Routing Policies
Fundamentals of route filteringRouting information flowElements in a routing updateNetwork robustnessStatic routes do not scaleImplementing network robustness through route filteringBusiness drivers and route preferences
Implementing routing modularity
Minimizing the impact of local routing errorsManaging routing updates to stub networksRedistributing routing information between routing protocolsMinimizing routing updates to stub networks using default networksFiltering routes distributed between routing processes
Implementing route preferences
Eliminating undesired routesRoute preferences through offset-listLimitations of using distribute-list for preferring routesUsing offset-list statements to prefer routesSelecting metric offsetsRoute preferences through administrative distance
Alternatives to access lists
Static routingImplementing route preference with static routesFloating static routesStatic routes to the null deviceDenying all route updates in or out of an interfaceUsing distance to ignore updatesOmitting network statements
5. Debugging Access Lists
Router resource access control listsChecking for correctnessManual tests of masksWhen access lists don’t workDebugging router resource access lists
Packet-filtering access control lists
Checking for correctnessUsing show ip interface to display applied access listsTesting the functionality of packet filtersTCP port probing using TelnetAccess list entry accountingIP accountingDebugging extended access listsAccess list entry accountingIP accountingAccess list entry logging
Route-filtering access control lists
Checking for correctnessLimiting routing outputVerifying the correctness of access lists in outbound distribute-list statementsVerifying that hosts receive correct routing informationTracerouteDebugging routing policies with access list accountingVerifying routing protocol activity using debugViewing routing topologyDebugging route-filtering access listsWhen the wrong route is presentStopping routing updates with extended access listsWhen access lists are used incorrectlyWhen route-filtering access lists are wrong
6. Route Maps
Other access list typesPrefix listsAS-path access listsBGP community attribute
Generic route map format
Interior routing protocols and policy routing
BGP
Match clauses in BGPRoute maps as command qualifiersImplementing path preferencesThe weight attributeAS-path prependingCommunitiesMulti-Exit DiscriminatorsPropagating route map changes
Debugging route maps and BGP
7. Case Studies
A WAN case studySecurity concernsRobustness concernsBusiness concernsSite 1 router configurationsSite 2 router configurationsSite 3 router configurations
A firewall case study
Screening router configurationChoke router configuration
An Internet routing case study
Robustness concernsSecurity concernsPolicy concernsRouter configurations
A. Extended Access List Protocols and Qualifiers
B. Binary and Mask Tables
C. Common Application Ports
Index
Colophon

Content preview from Cisco IOS Access Lists

Appendix B. Binary and Mask Tables

Table B-1. 8-bit binary/decimal conversion chart from 0 to 255

Decimal	Binary	Decimal	Binary	Decimal	Binary	Decimal	Binary
0	00000000	64	01000000	128	10000000	192	11000000
1	00000001	65	01000001	129	10000001	193	11000001
2	00000010	66	01000010	130	10000010	194	11000010
3	00000011	67	01000011	131	10000011	195	11000011
4	00000100	68	01000100	132	10000100	196	11000100
5	00000101	69	01000101	133	10000101	197	11000101
6	00000110	70	01000110	134	10000110	198	11000110
7	00000111	71	01000111	135	10000111	199	11000111
8	00001000	72	01001000	136	10001000	200	11001000
9	00001001	73	01001001	137	10001001	201	11001001
10	00001010	74	01001010	138	10001010	202	11001010
11	00001011	75	01001011	139	10001011	203	11001011
12	00001100	76	01001100	140	10001100	204	11001100
13	00001101	77	01001101	141	10001101	205	11001101
14	00001110	78	01001110	142	10001110	206	11001110
15	00001111	79	01001111	143	10001111	207	11001111
16	00010000	80	01010000	144	10010000	208	11010000
17	00010001	81	01010001	145	10010001	209	11010001
18	00010010	82	01010010	146	10010010	210	11010010
19	00010011	83	01010011	147	10010011	211	11010011
20	00010100	84	01010100	148	10010100	212	11010100
21	00010101	85	01010101	149	10010101	213	11010101
22	00010110	86	01010110	150	10010110	214	11010110
23

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Cisco OSPF Command and Configuration Handbook

Publisher Resources

ISBN: 1565923855Catalog Page Errata

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Cisco IOS Access Lists

by Jeff Sedayao

Appendix B. Binary and Mask Tables

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.