ACL or BCL

1. Definisi
ACL akn beraction(deny,permit ato remark) untuk service QoS,firewall,tunneling ato IPSec
Contoh ACL:
#access-list 10 permit 192.168.1.0 0.0.0.255
#access-list 100 deny tcp 192.168.1.0 0.0.0.255 host 10.10.10.10 eq 80
#ip access-list firewall
#permit 192.168.1.0 0.0.0.255

2. Cara kerja
Dari yg lebih spesifik ke yg lebih global
a. Top down,ACL dibaca dari atas kebawah
b. With ordered/sesuai urutan, sesuai dg urutan konfigurasi
c. Implicit deny,klu ta ad diACL,akn lgsg dideny

3. Type Access list
a. Numbered/named
b. Standart/Extended

Standart by numbered 1-99,1300-1999
Extended by numbered 100-199

Perbedaan standart dan extended:
Standart(Source) dan Extended(Source, Destination, Service(ip/tcp/udp/icmp), Port)

Jadi,standart tu hanya menanyakan “dari mana lw?” klu extended lebih spesifik “dari mana lw?tujuan lw kemana?ngpain aj?”

4. Configure access list+case
- Standart by named
#ip access-list standart NAMA
#permit 192.168.1.0 0.0.0.255
- Standart by numbered
#access-list 1 permit 192.168.1.0 0.0.0.255

Configure:
a. Range IP yg mo dideny ato dipermit
b. Placement,penempatan diinterface mana
c. Test+troubleshoot

Standart tu bikin ACL dirouter destination ato deket ma tujuan
Extended tu bikin ACL dirouter source,deket ma sourceny


tp blun ngerti...mohon bantuannya tuk menjelaskan tentang ACL...

Belajar PPP dan Access-List

SKENARIO

R1
ip address s0/0(DCE) 172.16.10.1/24
ip address f0/0 192.168.10.1/24

R2
ip address s0/1(DTE) 172.16.10.2/24
ip address f0/0 192.168.20.1/24

PC1, ip address 192.168.10.10/24
PC2, ip address 192.168.20.10/24

Routing protocol: OSPF
Protocol WAN: PPP PAP

Skenario accesslist:
1. PC1 bisa ping ke PC2,tp tidak sebaliknya
2. Semua bisa telnet R1, kecuali PC2
3. Block PC2 dari akses TFTP di PC1

R1
Router>en
Router#conf t
Router(config)#hostname R1
R1(config)#enable secret cisco
R1(config)#line console 0
R1(config-line)#pass cisco
R1(config-line)#login
R1(config-line)#line vty 0 4
R1(config-line)#pass cisco
R1(config-line)#login
R1(config-line)#exit
R1(config)#int f0/0
R1(config-if)#ip add 192.168.10.1 255.255.255.0
R1(config-if)#no shut
R1(config-if)#int s0/0
R1(config-if)#description ***Link to R2***
R1(config-if)#ip add 172.16.10.1 255.255.255.0
R1(config-if)#clock rate 64000
R1(config-if)#bandwidth 512
R1(config-if)#encapsulation ppp
R1(config-if)#ppp authentication pap
R1(config-if)#ppp pap sent-username R1 pass R1-PAP
R1(config-if)#no shut
R1(config-if)#exit
R1(config)#username R2 pass R2-PAP
R1(config)#router ospf 10
R1(config-router)#net 192.168.10.0 0.0.0.255 area 0
R1(config-router)#net 172.16.10.0 0.0.0.255 area 0
R1(config-router)#exit
R1(config)#access-list 101 deny icmp 192.168.20.0 0.0.0.255 192.168.10.0 0.0.0.255 echo
R1(config)#access-list 101 deny tcp 192.168.20.0 0.0.0.255 host 172.16.10.1 eq 23
R1(config)#access-list 101 deny udp host 192.168.20.10 host 192.168.10.10 eq 69
R1(config)#access-list 101 permit ip any any
R1(config)#int s0/0
R1(config-if)#ip access-group 101 in


R2
Router>en
Router#conf t
Router(config)#line console 0
Router(config-line)#pass cisco
Router(config-line)#login
Router(config-line)#exit
Router(config)#hostname R2
R2(config)#enable secret cisco
R2(config)#int f0/0
R2(config-if)#ip add 192.168.20.1 255.255.255.0
R2(config-if)#no shut
R2(config-if)#exit
R2(config)#int s0/1
R2(config-if)#description ***Link to R1***
R2(config-if)#ip add 172.16.10.2 255.255.255.0
R2(config-if)#bandwidth 512
R2(config-if)#encapsulation ppp
R2(config-if)#ppp authentication pap
R2(config-if)#ppp pap sent-username R2 pass R2-PAP
R2(config-if)#no shut
R2(config-if)#exit
R2(config)#username R1 pass R1-PAP
R2(config)#router ospf 10
R2(config-router)#net 192.168.20.0 0.0.0.255 area 0
R2(config-router)#net 172.16.10.0 0.0.0.255 area 0
R2(config-router)#exit

Konfigurasi Router sebagai DHCP Server

Hmm..klu dijaringan cuma ada 10,20 atau 30 client si enak-enak aja pake static ip address,tp klo udah mpe ratusan gimana??yupz,pke DHCP aj. Tp klo ga punya server DHCP??? Mending pke router yang udah ada aj,yupz.

router(config)#ip dhcp pool DHCP //DHCP hanya nama pool dan dapat diubah sesuai dg keinginan
router(dhcp-config)#default-router <ip-address> //biasanya ip address gateway di router interface
router (dhcp-config)#network <network> <subnet mask> //network yang akan diDHCP

konfigurasi optinonalnya:
router(dhcp-config)#dns-server <ip address dnsserver>
router(dhcp-config)#domain-name <nama>
router(dhcp-config)#lease <days> <hours> <minutes> //berapa lama IP DHCP itu digunakan

perlu diINGAT, untuk ip server atau printer gunakan static ip address di network yang sama dg pool DHCP,lalu exclude ip addressnya.Konfigurasi untuk meng-exclude ip address:
router(config)#ip dhcp excluded-address <start-ip-address> <end-ip-address> //untuk banyak ip address yg terpakai
atau
router(config)#ip dhcp excluded-address <ip-address> //untuk 1 ip address saja