background image
476 Chapter 7: Understanding Access List Security
The access-class command refers to the matching logic in access-list 3. The keyword in refers
to packets that are entering the router when you are trying to Telnet to that router's vtys. The
out keyword would be used both with outbound Telnet from a router and when using the reverse
Telnet feature of the IOS (which is unlikely to be on the exam). The out keyword implies that
the packets originated by the Telnet client in the router are checked using the destination
address of the packets.
IP Access List Summary
To pass the CCNA exam, you must be proficient in using IP access lists. The most important
details to recall are as follows:
·
The order of the list is important.
·
All matching parameters must be true before a statement is "matched."
·
An implied "deny all" is at the end of the list.
The philosophy of choosing the location for access lists is covered in more depth in the CCNP
exam than in the CCNA exam. However, filtering packets closer to the source of the packet
generally is better because the soon-to-be discarded packets will waste less bandwidth than if
the packets were allowed to flow over additional links before being denied.
Be particularly careful of questions relating to existing lists. In particular, if the question
suggests that one more access-list command should be added, simply adding that command
will place the statement at the end of the list, but the statement might need to be earlier in the
list to accomplish the goal described in the question. Also focus on the differences between
named and numbered IP access lists.
Filtering IPX Traffic and SAPs
IPX access lists can be used to filter IPX packets sent by clients and servers, just as IP access
lists are used to filter IP packets. However, similar functions can be performed by using Service
Advertising Protocol (SAP) filters, which filter SAP updates sent by servers and routers. SAP
filters are more common because they can be used to prevent clients and servers from trying to
send packets, as well as to reduce the overhead of SAP updates.
Example 7-10
vty Access Control Using the access-class Command
line vty 0 4
login
password cisco
access-class 3 in
!
! Next command is a global command
access-list 3 permit 10.1.1.0 0.0.0.255
ch07.fm Page 476 Monday, March 20, 2000 5:14 PM