cisco ccna 200-301 flashcards

cisco ccna 200-301 flashcards.Exam Points Be sure to familiarize yourself with how wildcard masks work and the special representation Cisco uses to match all devices or specific hosts (as shown in Table 21.4). o Wildcard mask 0.0.1.255 matches addresses in two Class C networks.21.2.3 Activating ACLsAfter you create an IPACL, you must apply it to the interface, otherwise it is useless. The focus of this chapter is on filtering traffic flowing through an interface, and for the I0S to filter traffic flowing through an interface, you must access the appropriate interface and activate the ACL. here are the commands to activate the ACL on the interface.Router(config)# interface type [slot_#]port_# Router(config-if)# ip access-group ACL_# in|out At the end of the command ipaccess-group, you must specify the ACL to be activated and in which direction it is to be used.. in: when traffic enters the interface. . out: when traffic leaves the interface.Chapter 21 Access Control Lists 557Using the command ip access-gnwp to activate an ACLO on an interface You must specify the ACL number or name and the direction (in or out). For an inbound ACL, the ACL is processed before the packet is forwarded to the outbound interface. ACLs can also be applied to sub-interfaces: the LAN sub-interface (for filtering VLAN traffic) and the WAN sub-interface. Only one ACL can be applied to each protocol in each direction on each interface.Note that the same ACL can be applied to multiple interfaces of the router, and the same ACL can be activated twice on the same interface: in the inbound and outbound directions, respectively. Alternatively, a non-existent ACL can be applied to an interface. A nonexistent ACL is an ACL null ACL without any statements, allowing all traffic to pass. An ACL contains an implicit deny statement only if it contains at least one permit or deny statement. It is strongly recommended that you do not apply a non-existent ACL to a router interface. If you do, when you add the first statement to this ACL, the implicit deny statement will automatically be added to the end of that ACL, which could cause reachability problems for the router.Here is an example to see the problems that can be caused by applying a non-existent ACL. Suppose you apply a non-existent ACL (#10) to the router's interface ethemetO, which does not currently have any permit or deny statements (it is empty). Next, you use Telnet to connect to the router through interface ethemetO, and your PC's IP address is 192.168.1.lo Then, you create a statement in ACL#10 that allows traffic from 172.16.0.0/16 to pass. After doing so, your Telnet connection is disconnected as you may have guessed because the implicit deny statement caused the router to disconnect the connection. Immediately after an ACL contains a statement, an implicit deny statement is added to the end of it. In this example, because your PC's IP address is 192.168.1.1, and that IP address does not match the first statement, the router disconnects you because it does not find any matching statements in ACL#10.Published authors vary on null ACLs: some say that a null ACL drops all traffic, some say it allows all traffic through, and some say it depends on the IOS version. I have been using ACLs since they were introduced in IOS7, and from IOS7 to 15.x, null ACLs have always allowed all traffic to pass. I recommend that you test it this way: apply an inbound ACL without any statements to the router interface, and ping that interface. You will find that this works.