Hi my name is you have from teach ethics.
Welcome you all to Cisco firewalls course.
In this video we will cover the topic of access control lists or what we call AC ls by the end of this
video.
You will be able to understand what is meant by an access control list.
Why we need them and how to apply them so let's start as many of you might hurt an exit control list
actually is a table that defines and controls what access rights each user or type of traffic has to
a particular network or System object.
For example if I am a user here with these computers with this IP address and I need to access for example
the Internet a web server if the access control list can control these behavior by either allowing or
denying my access OK.
So mainly the access control list is considered a filter that enables you to control what packets or
which packets are permitted or denied.
Either out or in the network so you have both sites.
If you are on this site for example which is considered the inside network when the packets go from
this computer to this firewall it's considered an in or inbound packet when it's come when it's coming
to the firewall is considered outbound or out coming back it so firewall firewalls apply the concept
of AC s or access control lists in both sides inbound outbound.
The rules are either allow or deny OK so what kind of traffic you can actually permit or deny.
Actually all types of traffic you can control each TTP which is the Internet traffic FTB File Transfer
Protocol emails even you can control like Ping traffic you can allow or deny ping traffic you can or
you cannot be linked to a specific station or a specific IP address anything you can control using the
access control list right.
So let's move forward to the next slide by the way.
Not only Cisco apply this concept of access control list almost all vendors or all of them.
Let's see an example.
Microsoft uses Windows firewall to apply access control list.
Let's see you.
Is that.
Let's go to Control Panel for example here in Windows system and security Windows Defender firewalls
go to the advantage settings.
Here you go.
Do you see inbound rolls outbound rules if you click on the inbounds rules you will see a set of rules.
This is the kind of traffic allowed or denied.
This is the action either allowed also denied or those traffic types are allowed.
So this is just a simple example of what an access control list means.
The same applies to the outbound rules which means that traffic that's going out of your computer room
system.
OK
so the access control list concept actually exists in all the networking vendors and one of them of
course is Cisco so let's move forward to the next slide here.
As I said Here you go.
We have an is a firewall here between the Internet and the Internet network you can apply an easy end
for the outbound traffic which means the traffic going out or for the inbound traffic which is the traffic
entering the flat.
OK.
So this is the concept as I explained in the previous slide.
So what do we need to know here this actually terminology inside outside or inbound outbound.
All right.
And of course each access control list is associated with an interface.
So if we could create an access control list on this firewall we apply it on a specific interface either
the inside interface or the outside interface.
OK because the firewall can have many interfaces.
So we need to specify and define what interface we will apply our access control list on.
OK.
Next
heat is the concept.
How access control list what access control list actually works based on the concept of packet filtering.
So mainly the filter packets filter packets based on what on many many actually categories you can allow
or deny source IP or destination ip address specific like message type like ICMP specific port source
port or destination port.
Specific protocol like IP protocol you can actually allow or deny also some traffic on a specific interface
you can apply it like I said on a specific interface like a fast internet interface or also or inside
or outside in or out.
So apply it on a specific interface in a specific direction in or out like we see here in this ticket
in is that incoming traffic out is the outcome in traffic we call it inbound and outbound
so many of filter based on many categories like we would see in the next slides IP address fourth type
message type protocol type.
All right.
Here you go.
What are the general characteristics of that access control list as we all agreed Access Control Risks
are set of rules applied in sequence like we see here in this figures this is an access control list
which has actually many statements you can include like many statements in the same access control list
some of them are denied some of them are permanent.
So here is an example here.
There is one access control list that has many statements in sequence each statement has actually a
number or what we call a line number or a sequence number.
For example you see here this list first statement is permitting this IP address.
To any which means to any destination.
Second is deny DCP protocol type it's denying actually that the S empty P traffic which is that type
of an email traffic here also denying pop to which is a type of e-mail traffic.
Many many things he is denying FCP traffic they denying telnet denying the C M.D. which is the command
the command prompt.
So many roles or many statements actually in sequence can be included in the same access control list.
OK.
What if I don't need anymore one of those statements like for example I need to allow FTB instead of
denying it.
So I need to delete one line or one statement.
Very easy.
You can actually just type no before either the pyramids or deny and the line will be deleted so then
I FTB just type the same command.
Just type no before the command and the statement will be removed from your access control list.
OK here you go.
There is one very important point here in Cisco specifically all access control list are ending with
an implicit deny statement like by default they are denying all traffic by default unless you explicitly
permit the traffic.
Let's see this example or this figure here.
This figure here has 5 lines here.
You might deny it deny permit different statements at the end.
There is an implicit deny implicit deny actually means deny all so if I didn't type all those commands
if that access control list is empty I didn't type all those comments.
The default behavior of the firewall is to deny everything.
Denial OK so this is very important.
Unless of course I have a pyramid statement before the deny before the implicit deny all traffic will
be denied and prohibited.
OK
here like I mentioned you so you need at least one pyramid statements in your access control list.
Otherwise all packets are denied and no traffic will pass.
Ok ok let's discuss this concept of what we call a wildcard mask the wild card of mask is actually something
like that subnet mask however it's that actually opposite of the subnet mask.
What do we mean by opposite.
For example we have this IP address in decimal and this is the equivalent in binary.
This is the wild card mask which is 0 0 2 5 5 2 5 5 the wild card mask actually indicates which part
of the IP address are available for examination.
As we all remember the subnet mosque.
If you use the subnet mask of 2 5 5 2 5 5 0 0 that bits that are corresponding to the 2 5 5 will be
taking into consideration while the bits that are equivalent or correspond to the zero will be ignored.
Here is the opposite here.
So the wildcard mask is actually the opposite.
They operate or function the other way.
Not like the Sabbath mask.
So first of all how do we calculate the subnet mask.
Very easy if you have the subnet mask you subtract it from four to five five.
So if this is the submit mask put 2 5 5 2 5 5 2 5 5 2 5 5.
Subtract the subnet mask the result here will be the wildcard mask Okay.
Cisco access control lists.
Use wildcard mask.
They don't use subnet mask.
This is how they function this would be actually clearer clearer more clear in the next slide.
So let's see this.
Access Control List which actually has numbers to it has many statements deny permit deny.
As I mentioned the zero bits in the Wildcat mask represents the bits in the IP address which is this
one or the sum of the IP addresses that will be considered why the 2 5 5 2 present the bits in the IP
address that will be ignored.
So if I have here this access list permit this is the IP address and this is the wildcard mask.
0 0 0 2 5 5 that means the fittest 3 Oct it's here 1 7 2 the 16 that one will be taken into consideration
by these access controls.
The last one.
Would be actually ignored.
Why.
Because we have here 0 0 0 2 5 1 second one.
Same thing.
It's deny statement 1 7 2 the 16.
This is the subnet mask.
The wildcard mask I'm sorry 0 0 2 5 5 2 2 5 5.
So that means the first two acts of this IP address will be examined examined again is what again is
destroyed again is the deny statement and the last thing here is 0 2 5 5 2 5 5 5 5 only the first octet
will be examined.
Okay.
You might ask me why this IP address doesn't have a wildcard mask because it's a single for an individual
IP address for a single host so it doesn't need a wildcard mask.
The wildcard mask is used for IP address of a subnet so all these three are what got masks they define
what part of this IP represent the subnet and what part is actually ignored however this one on the
top doesn't need a wildcard mask because it's just a single individual IP.
It's not a subnet.
OK he couldn't be more clear access control list or access list.
This is actually a type of access control list that we call we call it standard access list Cisco has
two types of fight over access control list standard and extended the standard access control list actually
walks or filter packets based on the source IP address only.
And they have the numbers from one to ninety nine and from 1 3 0 0 to 1 9 9 9.
So if we here give this access list number then it's in the range from 1 to 99.
So that means it's a standard access list.
OK the rule here is permit and this is actually the source IP address that the access list will work
on.
And this is what we call again the wildcard mask.
So this list will permit this subnet IP address.
Will examine or consider the first three updates because though I've got musky 0 0 0 2 5 5
as simple as that.
The second type of the access list is called extended access list the extended access control list actually
takes many factors in consideration into consideration rather than only the source IP address.
Consider the source and destination ip address optionally be considered a protocol type like DCP or
UDP or IP ICMP.
Also consider the source and destination port extended access list you can give them numbers from 100
to 1 nine and then from two thousand to twenty six ninety nine OK.
Here is an example of extended access list.
It has the number of 1 0 3 which which is within this range 100 to 1 99 Paramount DCP is the protocol
type he is the source address here is actually the destination address and here is the protocol type
or protocol number.
You can either define the protocol type 80 is the TTP protocol and each TTP protocol has
actually a port number of 80 OK
one last thing here any access list whether it's the standard or extended you can give it either a number
from those ranges I mentioned above or a name you can just give it the name instead of one or three
you can just say it's TTP pink whatever you want you can just give it a name or a number.
All right so that's all for this video in the next video.
We will discuss some details about Cisco s a access control list specifically and we will have a small
lab configuration to show you how actually you can configure the access control list.
Thank you very much for watching.
I hope you enjoyed the video.