ccna 3 chapter 1 pdf

ccna 3 chapter 1 pdf.4.1.2.2 ACL PlacementThe placement of ACLs is as important as the direction of traffic. The placement of ACLs depends on the type of ACL being used. Standard ACL placement One-by-one standard ACLs are placed as close to the destination as possible. Standard ACLs can only filter packets based on the source address. Placing these ACLs close to the source may result in denial of all traffic, including valid traffic. Extended ACL placement - On the router, extended ACLs should be placed as close as possible to the source being filtered. The further away from the source an extended ACL is placed, the less efficient the use of network resources. For example, packets are sent a long way down the path before they are dropped or rejected.4.1.2.3 ACL DesignTypically, ACLs are used to prevent most traffic from entering the network. At the same time, ACLs also need to selectively allow certain secure traffic types for business purposes, such as HTTPS (TCP port 443) This usually requires the use of extended ACLs, and specifying which ports must be blocked and which are allowed.Nmap programs can be used to determine which ports are open on a device. For example, an ACL can prevent POP3 traffic from downloading mail from a mail server on the corporate network over the Internet, but allow downloads from workstations inside the corporate network. The results of an Nmap scan of a POP3 server depend on where the scan begins. The POP3 port is open (TCP port 110) only when the scan is completed through a PC within the network.4.1.2.4 Verifying the Functionality of ACLsOnce an ACL is placed on an interface, verify that it is functioning as we expect. That is, traffic that should be denied is had and legitimate traffic is released.4.1 Access Control Lists 87When a match occurs on a log packet and the log option indicates that match, it may overburden the network device resources. The log option is best used when verifying or troubleshooting the configuration of an ACL.The showrunning-config command can be used to see which interface has ACLs applied.