Cisco : Standard Access Control List

ACL Standard Cisco adalah sebuah daftar akses kontrol yang digunakan untuk menyaring lalu lintas jaringan berdasarkan Source IP Address.

Router(config)# access-list [ACL_NUMBER] [permit | deny] [SOURCE_IP] [WILDCARD_MASK]

• ACL_NUMBER : 1-99 atau 1300-1999
• permit: Mengizinkan lalu lintas dari alamat IP yang ditentukan.
• deny: Menolak lalu lintas dari alamat IP yang ditentukan.
• SOURCE_IP: source ip address yang ingin di filter.
• WILDCARD_MASK: Menentukan range network source ip.

Contoh:

Router(config)# access-list 10 permit  192.168.1.100 0.0.0.0

Router(config)# ip access-list standard [ACL_NAME]
Router(config-std-nacl)# permit [source] [wildcard-mask]
Router(config-std-nacl)# deny [source] [wildcard-mask]

contoh:

Router(config)# ip access-list standard BLOCK_LAN1
Router(config-std-nacl)# deny 192.168.1.0 0.0.0.255
Router(config-std-nacl)# permit any
Router(config-std-nacl)# exit

Router(config)# interface <nama_interface>
Router(config-if)# access-list <nomor_acl>/<named_acl> in/out

• in: Menerapkan ACL pada paket yang kearah interface.
• out: Menerapkan ACL pada paket yang keluar dari interface.

Contoh:

Router(config)# interface FastEthernet0/0
Router(config-if)# access-list 10 in

Router(config)# interface GigabitEthernet 0/0
Router(config-if)# ip access-group BLOCK_LAN1 in

Router# show access-lists

Tujuan:

1. LAN 1 Dilarang mengakses Server-B
2. LAN 2 Dilarang mengakses Server-C

hostname R1
!
ip dhcp excluded-address 192.168.1.1 
ip dhcp excluded-address 192.168.2.1
!
ip dhcp pool LAN1
   network 192.168.1.0 255.255.255.0
   default-router 192.168.1.1
!
ip dhcp pool LAN2
   network 192.168.2.0 255.255.255.0
   default-router 192.168.2.1
interface FastEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 no shutdown
!
interface FastEthernet0/1
 ip address 192.168.2.1 255.255.255.0
 no shutdown
!
interface FastEthernet1/0
 ip address 172.16.1.1 255.255.255.25
 no shutdown
!
router ospf 1
 network 172.16.1.0 0.0.0.3 area 0
 network 192.168.1.0 0.0.0.255 area 0
 network 192.168.2.0 0.0.0.255 area 0
!

hostname R2
!
interface FastEthernet0/0
 ip address 10.0.1.1 255.255.255.0
 no shutdown
!
interface FastEthernet0/1
 ip address 10.0.2.1 255.255.255.0
 no shutdown
!
interface FastEthernet1/0
 ip address 172.16.1.2 255.255.255.252
 no shutdown
!
router ospf 1
 network 10.0.1.0 0.0.0.255 area 0
 network 10.0.2.0 0.0.0.255 area 0
 network 172.16.1.0 0.0.0.3 area 0

• Router terdekat dengan tujuan addlah R2, mari kita buat rulesnya

R2(config)#access-list 10 deny 192.168.1.0 0.0.0.255
R2(config)#access-list 10 permit any

• Terapkan pada interface menuju server B Fa0/1

R2(config)#interface f0/1
R2(config-if)#ip access-group 10 out
R2(config-if)#exit

R2(config)#access-list 20 deny 192.168.2.0 0.0.0.255
R2(config)#access-list 20 permit any

• Terapkan pada interface menuju server A Fa1/1

R2(config)#interface fa0/0
R2(config-if)#ip access-group 20 out
R2(config-if)#exit