background image
510 Chapter 7: Understanding Access List Security
The default action can be used to shorten the list. For example, in Example 7-24 the commands
access-list 101 deny tcp host 10.1.4.98 198.1.1.0 0.0.0.255 lt 1023 and access-list 101 deny
ip 10.1.4.0 0.0.0.255 198.1.1.0 0.0.0.255 eq www in access list 101 are not really needed
because the default is to deny these anyway. So, list 101 would perform the same function if it
had only one statement in it (access-list 101 permit tcp host 10.1.4.98 198.1.1.0 0.0.0.255 eq
www).
Answers to Scenario 7-4: IPX Filtering
Refer to the network illustrated in Figure 7-14 and Examples 7-17 through 7-20 to establish the
Scenario 7-4 design details and the context of the answers to the three tasks for this scenario.
Answers to Task 1 for Scenario 7-4
Task 1 for Scenario 7-4 asks you to characterize the traffic that is discarded due to the access
lists used on Atlanta. Furthermore, you need to determine whether clients in the remote sites
can access the servers in Atlanta. The answer is not obvious in this case. The extended access
list is particularly confusing, given all the options. The parameters coded in the first entry in list
903 in Example 7-17 are as follows:
·
Deny--Direction to throw away packets that match.
·
Any--Any protocol type.
·
102.0000.0000.0000--Source IPX address. The node part of the address will be masked,
so all 0s are coded in the node part of the address. The node part of the address must be
configured; otherwise, the syntax does not allow the right to use the network wildcard
mask.
Example 7-25
Scenario 7-3 Answer--Gorno Access List
! Next statements meet Criterion 1
access-list 101 permit tcp host 210.1.1.1 198.1.1.0 0.0.0.255 eq www
access-list 101 permit tcp host 210.1.1.2 198.1.1.0 0.0.0.255 eq www
! Next statements meet Criterion 2
access-list 101 deny tcp host 210.1.1.1 198.1.1.0 0.0.0.255 lt 1023
access-list 101 deny tcp host 210.1.1.2 198.1.1.0 0.0.0.255 lt 1023
! Next statement meets criterion 4
access-list 101 permit ip 210.1.1.0 0.0.0.255 198.1.1.0 0.0.0.255
!Default meets Criterion 6
!
interface serial 0
ip access-group 101
!
interface serial 1
ip access-group 101
ch07.fm Page 510 Monday, March 20, 2000 5:14 PM