ACL question
Printed From: CertCities.com Forums
Forum Name: CCNA/CCNP
Forum Discription: Discuss these Cisco networking certs and related technologies here.
URL: http://certcities.com/forums/forum_posts.asp?tid=5501
Printed Date: 15 October 2007 at 9:36am
Topic: ACL question
Posted by: toybits
Subject: ACL question
Date Posted: 08 October 2007 at 10:41pm
Hi,
I got into this cisco eigrp faq website while im reviewing for ccnp, hxxp://www.cisco.com/warp/public/103/eigrpfaq.shtml
I got confused about this question.
From my newbie understanding, There were 2 routes learned and that engr want to block 172.16.1.0/28, w/c I think learned from another router that has ip subnet zero enabled. Then there was an explanation that an ACL would not work on this because it does not check the mask? hmm then why do we need to use a wildcard mask if its no use with ACL? And would this route be learned from a router that has its ip subnet zero disabled? Pls lighten me up. Thanks
Q. I have two routes: 172.16.1.0/24 and 172.16.1.0/28. How can I deny 172.16.1.0/28 while I allow 172.16.1.0/24 in EIGRP?
A. In order to do this you need to use a prefix-list as shown here:
router eigrp 100
network 172.16.0.0
distribute-list prefix test in
auto-summary
no eigrp log-neighbor-changes
!
ip prefix-list test seq 5 permit 172.16.1.0/24
This allows only the 172.16.1.0/24 prefix and therefore denies 172.16.1.0/28.
Note: The use of ACL and distribute-list under EIGRP does not work in this case. This is because ACLs do not check the mask, they just check the network portion. Since the network portion is the same, when you allow 172.16.1.0/24, you also allow 172.16.1.0/28. |
Replies:
Posted by: Headhunter
Date Posted: 09 October 2007 at 1:01am
1 it is not an access-list but a prefix-list
2 it is a specific prefix-list allowing just 1 prefix
3 the network statement is not to advertise routes it is to enable the routing process on the interface that belong to that network
4 because prefix-lists are better then access-list to control routing updates
-------------
Koen
CCSI#30501 CCNP CCIP CCVP CCSP CCDP CQS-Cisco Wireless LAN Design & Support Cisco Unity Design Specialist Cisco IP Telephony Design Specialist JNCIA-ER MCSE MCSA:Messaging |
Posted by: toybits
Date Posted: 09 October 2007 at 7:13am
Hi, If im not mistaken again.
The engr got 2 routes, or Subnets and engr want to only allow 172.16.1.0/24 in eigrp.
so why not configure like.
router eigrp 100
network 172.16.1.0 0.0.0.255 => /24
no auto-summary
Would this only allow /24?
If added this will allow /28
network 172.16.1.0 0.0.0.15 => /28
Or there will still be 2 routes showing up on eigrp route table? even though a /24 is the only defined.
172.16.0.0 is subnetted
172.16.1.0/24
172.16.1.0/28
I still dont get this.. sorry
Note: The use of ACL and distribute-list under EIGRP does not work in this case. This is because ACLs do not check the mask, they just check the network portion. Since the network portion is the same, when you allow 172.16.1.0/24, you also allow 172.16.1.0/28.
Thanks! |
Posted by: Headhunter
Date Posted: 09 October 2007 at 10:48am
read nr 3
you are NOT advertising the classfull network you ENABLE the routing process on an interface with that falls under that network
personal note... if you don't even know that well then CCNP is not for you
-------------
Koen
CCSI#30501 CCNP CCIP CCVP CCSP CCDP CQS-Cisco Wireless LAN Design & Support Cisco Unity Design Specialist Cisco IP Telephony Design Specialist JNCIA-ER MCSE MCSA:Messaging |
Posted by: toybits
Date Posted: 10 October 2007 at 10:16pm
1 it is not an access-list but a prefix-list
-I know its a prefix-list, im just asking why it was stated that "ACL does not look at the mask"? - I got confused over there since wildcard mask is being used in ACL.
2 it is a specific prefix-list allowing just 1 prefix
-I know this already.
3 the network statement is not to advertise routes it is to enable the routing process on the interface that belong to that network
-so is there a seperate "advertise" command in eigrp? does enabling the statement network allows the interface w/in the subnet to participate in eigrp operation? does eigrp send its routing table to its neighbors or need to manually configure an "advertise" command? does the eigrp route advertisement not part of the "routing process" that you are saying?
Heres what i know. If you configured a network statement - you want to enable the routing process on the router to the interface w/in the subnet so that it would be put on the routing table after computation, to be sent to another neighbor so that it would be reachable to other network because it was learned due to route advertisement or exchange of full routing table w/c is part of routing process.
4 because prefix-lists are better then access-list to control routing updates
-As I thought so.
you are NOT advertising the classfull network you ENABLE the routing process on an interface with that falls under that network
- Where did this answer came from? I im not asking about the "network" command.
personal note... if you don't even know that well then CCNP is not for you
-Now thats a great encouragement...
Q. I have two routes: 172.16.1.0/24 and 172.16.1.0/28. How can I deny 172.16.1.0/28 while I allow 172.16.1.0/24 in EIGRP?
-At first I thought the routes are being learned, but its on the local network. then defined by a classful 172.16.0.0 network in eigrp, instead of using the wildcard mask for the network statement or an ACL to deny. A prefix-list was suggested then followed up by saying ACL does not look at the mask, just the network portion.
Anyway thanks for replying, Ill just check out some other resources. |
|