Podcast
Questions and Answers
All access control lists (ACLs) must be ______.
All access control lists (ACLs) must be ______.
planned
It is suggested that you use a text ______ and write out the specifics of the policy.
It is suggested that you use a text ______ and write out the specifics of the policy.
editor
Include ______ to document the ACL.
Include ______ to document the ACL.
remarks
Always thoroughly test an ACL to ensure that it correctly applies the desired ______.
Always thoroughly test an ACL to ensure that it correctly applies the desired ______.
Configure a standard IPv4 ACL to secure ______ access.
Configure a standard IPv4 ACL to secure ______ access.
Use sequence numbers to edit existing standard ______ ACLs.
Use sequence numbers to edit existing standard ______ ACLs.
Configure extended IPv4 ACLs to filter traffic according to networking ______.
Configure extended IPv4 ACLs to filter traffic according to networking ______.
Add the IOS configuration ______ to accomplish those tasks.
Add the IOS configuration ______ to accomplish those tasks.
A standard ACL can secure remote administrative access to a device using the ______ lines.
A standard ACL can secure remote administrative access to a device using the ______ lines.
The access-class command is used to secure ______ access.
The access-class command is used to secure ______ access.
To restrict access to the vty lines, an ACL must be applied to incoming ______.
To restrict access to the vty lines, an ACL must be applied to incoming ______.
The local database entry for users includes a username and ______.
The local database entry for users includes a username and ______.
After configuring the ACL, it's important to verify the VTY port is ______.
After configuring the ACL, it's important to verify the VTY port is ______.
To check ACL statistics, you can use the ______ command.
To check ACL statistics, you can use the ______ command.
SSH traffic needs to be ______ for secure VTY access.
SSH traffic needs to be ______ for secure VTY access.
The example demonstrates how to configure an ACL to filter ______ traffic.
The example demonstrates how to configure an ACL to filter ______ traffic.
The ACL needs to identify which administrative ______ should be allowed remote access.
The ACL needs to identify which administrative ______ should be allowed remote access.
R1 is configured to use the local database for ______.
R1 is configured to use the local database for ______.
The current statement must be deleted first with the no 10 ______.
The current statement must be deleted first with the no 10 ______.
Named ACLs can also use sequence ______ to delete and add ACEs.
Named ACLs can also use sequence ______ to delete and add ACEs.
An ACE is added to deny hosts ______.
An ACE is added to deny hosts ______.
The show access-lists command shows statistics for each statement that has been ______.
The show access-lists command shows statistics for each statement that has been ______.
The deny ACE has been matched ______ times.
The deny ACE has been matched ______ times.
The permit ACE has been matched ______ times.
The permit ACE has been matched ______ times.
The implied deny any statement does not display any ______.
The implied deny any statement does not display any ______.
To track how many implicit denied packets have been matched, you must manually configure the ______ command.
To track how many implicit denied packets have been matched, you must manually configure the ______ command.
Use the clear access-list ______ command to clear the ACL statistics.
Use the clear access-list ______ command to clear the ACL statistics.
In this Packet Tracer, you will complete the following objectives: Configure Devices and Verify ______.
In this Packet Tracer, you will complete the following objectives: Configure Devices and Verify ______.
The established keyword enables inside traffic to exit the inside private network and permits the returning reply traffic to enter the inside private ______.
The established keyword enables inside traffic to exit the inside private network and permits the returning reply traffic to enter the inside private ______.
ACL 120 is configured to only permit returning web traffic to the inside ______.
ACL 120 is configured to only permit returning web traffic to the inside ______.
A match occurs if the returning TCP segment has the ACK or reset (RST) flag bits set, indicating that the packet belongs to an existing ______.
A match occurs if the returning TCP segment has the ACK or reset (RST) flag bits set, indicating that the packet belongs to an existing ______.
To create a named extended ACL, use the ip access-list ______ configuration command.
To create a named extended ACL, use the ip access-list ______ configuration command.
The named extended ACL called NO-FTP-ACCESS is created in the named extended ACL ______ mode.
The named extended ACL called NO-FTP-ACCESS is created in the named extended ACL ______ mode.
Extended ACLs can filter on different port number and port name ______.
Extended ACLs can filter on different port number and port name ______.
The first ACE uses the www port ______.
The first ACE uses the www port ______.
Both ACEs achieve exactly the same ______.
Both ACEs achieve exactly the same ______.
Configuring the port number is required when there is not a specific ______ name listed.
Configuring the port number is required when there is not a specific ______ name listed.
ACL 110 is applied inbound on the R1 G0/0/0 ______.
ACL 110 is applied inbound on the R1 G0/0/0 ______.
The ACL permits both HTTP and ______ traffic.
The ACL permits both HTTP and ______ traffic.
TCP can also perform basic stateful firewall services using the TCP established ______.
TCP can also perform basic stateful firewall services using the TCP established ______.
Extended ACLs can be applied in various ______.
Extended ACLs can be applied in various ______.
In this example, the ACL filters ______ traffic.
In this example, the ACL filters ______ traffic.
The example configures an extended ACL 100 to filter ______ traffic.
The example configures an extended ACL 100 to filter ______ traffic.
Flashcards are hidden until you start studying
Study Notes
Module Overview
- Focus on implementing IPv4 Access Control Lists (ACLs) to filter traffic and secure administrative access.
Objectives
- Configure Standard IPv4 ACLs to meet networking requirements.
- Modify existing IPv4 ACLs using sequence numbers.
- Secure Virtual Terminal (VTY) ports with Standard IPv4 ACLs.
- Configure Extended IPv4 ACLs for detailed traffic filtering.
Configure Standard IPv4 ACLs
- Planning is essential: draft policies using a text editor before configuration.
- Use IOS commands to apply configurations following the planned policy.
- Include remarks for documentation purposes.
- Test ACLs thoroughly to ensure proper functionality.
- Modifying ACLs requires deleting the current configuration first with the
no {sequence number}command.
Modifying IPv4 ACLs
- Named ACLs can be modified using sequence numbers for adding or deleting Access Control Entries (ACEs).
- Use
show access-liststo check statistics of matched entries. - The implicit deny statement does not display statistics unless manually configured with
deny any.
Secure VTY Ports with Standard IPv4 ACL
- Secure remote access to devices using the VTY lines by creating and applying an ACL.
- Example configuration includes user authentication settings and permissions for SSH traffic.
- Verify VTY security through
show access-liststo ensure correct restrictions are in place.
Configure Extended IPv4 ACLs
- Extended ACLs filter traffic based on specific protocols and port numbers.
- Example: ACL can filter HTTP and HTTPS traffic using both protocol names (like www) and port numbers (like 80).
- Generally applied close to the source of traffic for effectiveness.
TCP Established Extended ACL
- Allows stateful firewall functions with the TCP established keyword, permitting replies to outgoing requests while blocking unsolicited inbound traffic.
- Example involves configuring an ACL to allow only returning web traffic from the internet to internal hosts, based on TCP flags.
Named Extended IPv4 ACL
- Use descriptive naming for easy identification of ACL functions.
- Create named extended ACLs with the command
ip access-list extended {name}. - Enter ACE statements in the named ACL configuration mode for clarity.
Additional Practical Applications
- Named extended ACLs can manage multiple types of traffic through specific configurations like SURFING, which allows HTTP and HTTPS traffic to exit while restricting FTP access.
Studying That Suits You
Use AI to generate personalized quizzes and flashcards to suit your learning preferences.
