background image
Filtering IPX Traffic and SAPs 483
the access list. So, unless you are using locally administered MAC addresses on your IPX
nodes, the node mask will almost never be useful.
Cisco expects CCNAs to be familiar enough with TCP/IP and IPX protocols to recognize
oversights in an access list design before the access-lists are deployed. Such an oversight is true
of Example 7-11--or, more accurately, the criteria used for Example 7-11. Note that the criteria
all mentioned network numbers, but no servers were mentioned. The oversight is that when
clients connect to servers whose code level is NetWare 3.11 and beyond, the address used by
the server to communicate with the client uses the server's internal network number. So, in
Example 7-11, the effect is an interesting mental exercise. access-list 810, with the explicit
"permit all," would permit the client-server traffic exiting R1's Ethernet0, while access-list 820,
with the implied "deny all" would prevent all client-server traffic from entering R1's serial1
interface.
Now thinking in terms of client/server flows with NetWare, consider the following changes in
the criteria for these access lists:
1
Packets from Server 1 are not allowed onto network 200.
2
Packets from Server 2 are allowed onto network 200.
3
Packets from Server 3 are not allowed onto network 200, 101, or 102.
4
Packets from Server 4 are allowed to go anywhere.
5
All combinations not mentioned should be permitted.
The new configuration in Example 7-12 successfully focuses on the servers' network numbers,
not the network numbers on the LAN segments.
Example 7-12
R1 Configuration for Standard IPX Access Lists, Modified
ipx routing 0200.1111.1111
!
interface serial0
ip address 10.1.1.1 255.255.255.0
ipx network 1001
!
interface serial1
ip address 10.1.2.1 255.255.255.0
ipx network 1002
ipx access-group 820 in
!
interface ethernet 0
ip address 10.1.200.1 255.255.255.0
ipx network 200
ipx access-group 810
!
access-list 810 deny 2001
access-list 810 permit -1
!
access-list 820 deny 3001
access-list 820 permit -1
ch07.fm Page 483 Monday, March 20, 2000 5:14 PM