ACL : 1.

line by line (dikerjakan per baris) - urutan sangat penting - bila cocok identitasnya di sebuah baris, kemudian di baris itu dia di-Permit -> maka dia lolos. di-Deny -> maka dia ditolak. tidak akan dites lagi di baris berikutnya. - yang lebih spesifik taruh di baris lebih atas 2. ACL diterapkan di interface (in atau out) ACL bisa diterapkan juga di vty (khusus telnet) 3. di baris terakhir IMPLICIT DENY ALL, karena itu minimal 1 baris PERMIT contoh Standard ACL : di wg_ro_b (config)# access-list 1 deny host 14.1.1.11 --> penulisan IP & Wild Card : (config)# access-list 1 deny 14.1.1.11 0.0.0.0 --------- ------1 IP WC u/ 1 IP (config)# access-list 1 deny host 14.1.1.10 (config)# access-list 1 permit any implicit : (config)# access-list 1 deny any --> penulisan IP & Wild Card : (config)# access-list 1 permit 0.0.0.0 255.255.255.255 ------- --------------any network WC u/ any network --> penulisan IP & Wild Card u/ range jaringan, misal deny jaringan 172.30.16.0/24 sampai dengan 172.30.31.0/24 (config)# access-list 1 deny 172.30.16.0 0.0.15.255 ----------- ---------jaringan asal WC u/ range jaringan --> u/ mengetahui sampai dengan jaringan berapa? 172.30.16.0 0.0. 15.255 -> 255 di WC berarti ignore (=0 di Netmask) _____________+ 172.30.31.0 (config)# int s0/0 (config-if)# ip access-group 1 in -> inbound ACL (paket yang masuk s1) (config-if)# end wg_ro_b# show access-list -> lihat urutan ACL wg_ro_b# show ip interface s0/0 -> lihat inbound/outbound ACL -> tes ping dari PC 14.1.1.11 ke 10.1.1.100 : GAGAL

contoh Extended ACL : di wg_ro_b : (config)# ip http server -> mengaktifkan web server di switch & router (config)# no access-list 1 (config)# access-list 100 deny icmp any host 10.1.1.10

(config)# access-list 100 deny tcp host 16.1.1.11 host 10.1.1.10 eq 80 (config)# access-list 100 deny tcp host 14.1.1.11 host 10.1.1.10 eq 80 (config)# access-list 100 permit ip any any (config)# int s1 (config-if)# ip access-group 100 in (config-if)# end wg_ro_b# show access-list -> lihat urutan ACL wg_ro_b# show ip interface s1

contoh Standard ACL menggunakan nama : di wg_ro_b (config)# no access-list 100 (config)# int s1 (config-if)# no ip access-group 100 in (config-if)# exit (config)# ip access-list standard coba (config-coba-nacl)# deny host 14.1.1.11 (config-coba-nacl)# deny host 14.1.1.10 (config-coba-nacl)# permit any (config-coba-nacl)# int s1 (config-if)# ip access-group coba in ACL untuk telnet : di wg_ro_b (config)# no ip access-list standard coba (config)# int s1 (config-if)# no ip access-group coba in (config-if)# exit (config)# access-list 1 deny host 14.1.1.11 (config)# access-list 1 permit any -> implicit deny any (config)# line vty 0 15 (config-line)# access-class 1 in

MENAMBAH BARIS ACL: # sh ip access-list Standard IP access list 1 2 permit ... 5 permit ... 10 permit ... 20 permit ... ---> cara menambah baris ACL (config)# ip access-list standard 1 (config-std-nacl# 15 permit ... # sh ip access-list 2 permit ...

5 permit ... 10 permit ... 15 permit ... 20 permit ...