Now, this complicates things.
We're told that we need to put the access list in the most efficient place on the router to, for instance,
deny external hosts getting access to internal hosts, but being able to access the HTTP servers.
So I'm going to place the access list here.
It's also good to put your access list on the outside interface of your router.
In other words, the interface facing the Internet so that you could, for example, block traffic to
the router to protect the router.
You want to place your access lists, especially your external access lists on the outside interface.
In other words, you want to protect yourself from the Internet as far away from your internal network
as you can.
So we don't want to place the access list here or here.
We want to put it here.
In any way based on this criteria, you wouldn't be able to create one access list that meets all the
criteria.
If you try to bind it here or here, it's going to need to be here.
That also creates another problem, because when this PC sends traffic to the Internet, it's going
to have to pass to access lists, one going from left to right and one going from right to left for
the return traffic.
And that is what makes things more complicated.
So we are told to use access list 101.
So access list 101, we have to permit traffic so that any external device can access the internal servers
using HTTP or HTTPS, so that requires TCP IP.
The source will be any device going to 10.1.2.0.
That's our service subnet.
Over here, and we want to permit HTTP and HTTPS.
So port 80 and port 443.
So show access lists, these two access list entries are part of access list 101, notice the numbers
automatically added to the access list, which would allow us to edit the access list if required.
I showed you that in the previous access list lab.
No external device can access subnet 10.1.2.0.
We need to explicitly add this line, but that causes problems.
Because this PC shouldn't be able to access, for instance, these PCs.
But what happens if PC 1 wants to connect to Cisco.com?
What about the return traffic?
And when that PC connects to Cisco.com or Facebook.com, what does it do?
It sends a DNS request.
In other words, it needs the name to be resolved.
So this is where it gets a little bit more complicated, because what we want to do is permit DNS replies
from our DNS server with IP address 8.8.8.8.
So we want to allow that server to reply back to DNS requests.
So when the host sends the DNS request, it's going to go to Port 53 and the reply is going to come
back with a source port of 53, going to a random port number on the PC.
So we want to specify that the source port is going to be 53 and the destination will be any one in
our internal network.
Now, in this lab, I'm not using NAT addresses.
We cover NAT in a separate part of the course.
So for the moment, we just ignoring the requirement that you need to NAT RFC 1918 addresses
onto the Internet.
If you want me to add a combined NAT and access list lab, let me know I can do that.
It just makes things a little bit more complicated.
We also need to think about the return traffic of sessions to the servers, so when the PC sends HTTP
traffic to the server, the server needs to be able to return that back to the PC.
But we only want to allow TCP traffic from our servers in response to requests to the servers.
Now, you could tie it down here by specifying port 80, 443 and so forth, but what about the PCs
initiating other kinds of sessions.
So what about FTP or TFTP or other kinds of sessions.
So I'm not going to specify a source port here.
I'm going to allow all returned traffic, but what I'm going to do is use the word established.
Established means that the ACK BIT is set.
If you think back to your TCP three way handshake, the first host, when it initiates a session, sets
the SIN BIT but not the ACK BIT, the ACK BIT is only set on return traffic.
So this is looking for an acknowledgment or ACK in the return traffic.
Now, in the real world, you don't want to use this because hacking tools can spoof ACK very easily.
But when configuring an access list like this, that is an option to use, in the real world
we want to use stateful firewalls, which are a lot more powerful than standard and extended access
lists.
But here we are using an access list and that would accomplish what we need to accomplish.
And then we want to deny as a lost step all traffic to our internal network.
So deny IP any going to 10.1.2.0
with subnet mask
and then we want to bind that, but let's have a look at our access list first, there's our new access
list 101 and we want to bind it to gigabit 001.
So Interface Gigabit 001, IP Access Group, 101 inbound.
So again, show run
access list 100 is bound inbound on gigabit 000, access list 101 is bound inbound on gigabit
001
and that's what our access lists look like, it's fairly complicated, so let's test whether it actually
works.