Ah, forum working again, for me. . .
Extended ACLs aren't hugely different from standard ACLs, they just provide some additional (and very worthwhile) parameters.
Remember what we want to do with the ACL, block all outbound, from VLANs 10 or 30, except for ping replies. Also, keep in mind, an ACL is going to be a major component to our solution.
If we look at PT ACL help first we can use access-list number to denote standard or extended (we can also used named ACLs, but I'll use numbered for this discussion):
Router(config)#access-list ?
<1-99> IP standard access list
<100-199> IP extended access list
If we look at the standard options:
Router(config)#access-list 1 ?
deny Specify packets to reject
permit Specify packets to forward
remark Access list entry comment
Router(config)#access-list 1 permit ?
A.B.C.D Address to match
any Any source host
host A single host address
Router(config)#access-list 1 permit any ?
<cr>
We're lacking parameters for dealing with source or destination of packets and/or kind of traffic.
But the extended ACL seems to offer all the options we need.
So, what should the ACE look like?
Router(config)#access-list 100 ?
deny Specify packets to reject
permit Specify packets to forward
remark Access list entry comment
Router(config)#access-list 100 permit ?
ahp Authentication Header Protocol
eigrp Cisco's EIGRP routing protocol
esp Encapsulation Security Payload
gre Cisco's GRE tunneling
icmp Internet Control Message Protocol
ip Any Internet Protocol
ospf OSPF routing protocol
tcp Transmission Control Protocol
udp User Datagram Protocol
Router(config)#access-list 100 permit icmp ?
A.B.C.D Source address
any Any source host
host A single source host
Router(config)#access-list 100 permit icmp any ?
A.B.C.D Destination address
any Any destination host
host A single destination host
Router(config)#access-list 100 permit icmp any any ?
<0-256> type-num
echo Echo (ping)
echo-reply Echo reply
host-unreachable Host unreachable
net-unreachable Net unreachable
port-unreachable Port unreachable
protocol-unreachable Protocol unreachable
ttl-exceeded TTL exceeded
unreachable All unreachables
<cr>
What do you think this ACE should be?
Again, look at the above and remember we want the source to be VLANs 10 or 30, the destination to be VLAN 20 and allow ping responses. We also need to insure all other traffic is blocked (two ACEs required?).
One you have the necessary ACL, you need to decide where and how it should be deployed. Of course, thinking about where and how the ACL should be deployed, might impact the structure of the ACL. Your thoughts?
