CCNA ppt Day 7
- 1. ACL (Access Control List) ACLS’s are used for network security Conditions for controlling traffics through router is called ACL. Two conditions are:- 1. Permit 2. Deny Two types are:- 1. Standard (1-99) 2. Extended (100-199)
- 2. Standard ACL Range 1-99 Standard ACL is configured under destination Router Source IP is given for Standard ACL Entire TCP/IP protocol stack is blocked when Deny condition is applied
- 3. Configuring Standard ACL Router(config)#access-list ‘no:’ deny host ‘destination address’ Router(config)#access-list ‘no:’ permit any
- 4. Filter Design Filter is designed at the interface which is nearest to destination in standard ACL ACL will only be accessible if filter is designed. Syntax:- Router(config-if)# ip access group ‘access list no:’ ‘in or out ‘
- 5. Verifying ACL’s Router #show access-list To remove:- Router(config)#no access-list ‘no:’ Router(config-if)#no ip access group ‘access list no:’ ‘in or out’
- 6. Extended ACL Range- 100-199 Extended ACL is configured under the source router. Source IP and Destination IP is given for Extended ACL Each or any protocols could be blocked when Deny condition is applied
- 7. Configuring Extended ACL Router(config)#access-list ‘no:’ deny ‘service’ host ‘address’ host ‘address’ Router(config)#access-list ‘no:’ permit ‘service’ host ‘address’ network ‘address’ ‘mask’ For blocking a network- Router(config)#access-list ‘no:’ deny ‘service’ host ‘address’ network ‘address’ ‘mask’ For blocking TCP Router(config)#access-list ‘no:’ deny tcp host ‘address’ network ‘address’ ‘mask’ eq ‘port no:’
- 8. Named ACL ACL’s with name are called Named ACLs. Syntax:- For Standard Router(config)#ip access-list standard ‘access list name’ Router(config-std-nacl)#deny host ‘address’ Router(config-std-nacl)#permit any For Extended Router(config)#ip access-list extended ‘access list name’ Router(config-std-nacl)#deny ‘service’ host ‘address’ host ‘address’ Router(config-std-nacl)#permit any any
- 9. Filter Design Router(config-if)#ip access group ‘access list name:’ ‘in or out’ To verify:- Router#show ip access-list
- 10. NAT (Network Address Translation) This service converts Private IP address to Public IP address To avoid IP wastage Implements Network Security. Types of NAT:- 1. Static 2. Dynamic 3. NAT Overloading or PAT (Port Address Translation)
- 11. Static NAT One to one mapping Each private range IP is provided with each public range IP
- 12. Dynamic NAT One to many mapping A pool is created inside the NAT service. In that it holds the information about public IP and its corresponding Private IP Each private IP selects its own Public IP for communication with the help of Router
- 13. NAT overloading or PAT (Port Address Translation) Each Private IP is Translated on one single Public IP. Each one is Provided with Port Numbers in order to avoid conflict.
- 14. Static NAT Configuration Router(config)#Int fast Ethernet 0/0 Router(config-if)# IP NAT inside Router(config)#Int s 1/0 Router(config-if)# IP NAT outside Router(config-if)# Exit Router(config)# ip NAT inside source static 10.0.0.1 200.0.0.1 To see the table Router(config)#show ip nat translations Router(config)#show ip nat statistics
- 15. Dynamic NAT Configuration Access list creation- for grouping the private IP’s in our network Pool creation- Creating pool in which the translations are to be included. Nat Activation Create an Access List Router(config)# Access-list 1 permit 10.0.0.0 0.255.255.255 Configure NAT dynamic Pool Router(config)# IP NAT pool pool1 200.0.0.1 200.0.0.254 netmask 255.255.255.0 Link Access List to Pool Router(config)# IP NAT inside source list 1 pool pool1
- 16. PAT Configuration Router#config t Router(config)# int e 0 Router(config-if)# ip nat inside Router(config)# int s 0 Router(config-if)# ip nat outside Router(config)#access-list 1 permit 10.0.0.0 0.255.255.255 Router(config)#ip nat inside source list 1 interface s 0 overload To see host to host ping configure static or dynamic routing To check translation #show ip nat translations