Security
Contents
Time Range Access Lists 2
Diagram .........................................................................................................................2
Task 1 .............................................................................................................................2
Task 1 Solution ...............................................................................................................2
Task 2 .............................................................................................................................5
Task 2 solution ...............................................................................................................5
Verification ....................................................................................................................6
Aung Naing Moe 1
Security
Time Range Access Lists
Diagram
OSPF
10.0.13.0/24 10.0.23.0/24
L0 = 192.168.1.1/24 L0 = 192.168.2.2/24
R1 E0/0 E0/0 R3 E0/1 E0/0 R2
Internal E0/2 External
AAA Server
Task 1
Configure R1 to allow its internal users to have the ability to browse the
Internet during the weekdays only.
R2 should be configured such that its internal users can browse the
Internet in weekends only.
The access-list should be appied outbound on their E0/0 interface, since
this is the interface that connects these routers to the Internet.
Task 1 Solution
IP assignment ကိစၥေတြ၊ OSPF စတဲ့ basic configuration ေတြက Basic IOS Access List
lab အတိိုင္းပျဖစ္ပါတယ္။
R1
R1(config)#time-range WEEKDAYS
R1(config-time-range)# periodic weekdays 0:00 to 23:59
R1(config-time-range)#exit
R1(config)#access-list 101 permit tcp any any eq 80 time-range WEEKDAYS
R1(config)#interface Ethernet0/0
R1(config-if)# ip access-group 101 out
2 Aung Naing Moe
Security
R2
R2(config)#time-range WEEKENDS
R2(config-time-range)#periodic weekdays 0:00 to 23:59
R2(config-time-range)#exit
R2(config)#access-list 101 permit tcp any any eq 80 time-range WEEKENDS
R2(config)#interface Ethernet0/0
R2(config-if)#ip access-group 101 out
Configuration point of view က ၾကညဲ့္မယ္္ိိုရင္ -
အ္င္ဲ့တစ္ - ကိုိယ္ခြင္ဲ့ျပဳခ်င္တဲ့ time range ကိို သတ္မွတ္ဖိို႔ time range configure လိုပ္ပါ။
အ္င္ဲ့ႏွစ္ - time range ကိို reference လိုပ္ဖိို႔ ACL ေရးပါ။
အ္င္ဲ့သိုး - ip access-group command န႔ interface ေအာက္မွာ ACL ကိို apply လိုပ္ပါ။
အကယ္၍ ေန႔ရက္၊ နာရီအတိက်ေရးခ်င္လည္း ေရးလိို႔ရပါတယ္။ ဥပမာ - Mon to Friday
မွာ္ိိုရင္ 2:00 PM ကေန 6:30 PM အထိပ internet ေပးသိုးမယ္။
July 1 ရက္ေနစၿပီး၊ August 26 ရက္ထိ၊ wee days ေတြမွာ 9:00 AM ကေန 5:00 PM အထိ
အင္တာနက္ ေပးမသိုးဘး စသျဖင္ဲ့ အဒီလိို ပိုစမ်ဳိးလည္း ေရးလိို႔ရပါတယ္။ ေရးတဲ့ ဥပမာကိို
ေအာက္မွာေလဲ့လာၾကည္ဲ့ပါ။
R1
R1(config)#time-range ALLOWED_INTERNET
R1(config-time-range)# periodic weekdays 14:00 to 18:30
R1(config-time-range)#exit
R1(config)#time-range DENIED_INTERNET
R1(config-time-range)# absolute start 00:00 20 July 2018 end 23:29 26 August
2018
R1(config-time-range)#exit
R1(config)#access-list 102 deny tcp any any eq 80 time-range
DENIED_INTERNET
Aung Naing Moe 3
Security
R1(config)#access-list 102 permit tcp any any eq 80 time-range
ALLOWED_INTERNET
R2(config)#interface Ethernet0/0
R2(config-if)#ip access-group 101 out
Verification
R1#show access-lists
Extended IP access list 102
10 deny tcp any any eq www time-range DENIED_INTERNET (inactive)
20 permit tcp any any eq www time-range ALLOWED_INTERNET (inactive)
R1#
Show access-list န႔စစ္ၾကည္ဲ့တဲ့အခါ ACL က inactive ျဖစ္ေနတာကိို ေတြ႔ပ
ြ ါလိမ္ဲ့မယ္။
ဘာေၾကာင္ဲ့လ္ိိုေတာဲ့ ACL မွာ ေရးထားတဲ့ အခ်ိန္န႔ R1 မွာ လက္ရွိ အခ်ိန္က မတလိို႔
ျဖစ္ပါတယ္။ အခ်ိန္ကိိုစစ္ၾကညဲ့္ပါ။
R1#sh clock
*08:26:14.315 UTC Thu Mar 29 2018
R1#
R1#clock set 10:00:00 20 August 2018
R1#show clock
10:00:29.268 UTC Mon Aug 20 2018
R1#
R1#show access-lists
Extended IP access list 102
10 deny tcp any any eq www time-range DENIED_INTERNET (active)
20 permit tcp any any eq www time-range ALLOWED_INTERNET (inactive)
4 Aung Naing Moe
Security
Task 2
Configure R2 using the following policy:
Outgoing telnet traffic should only be denied between the hours of 11:00
AM and 2:00 PM, Monday to Friday.
Outgoing HTTP traffic should be denied Monday to Friday, between the
hours of 9:00 AM and 2:00 PM starting March 29th 2018 to April 24th 2018.
Any other traffic should be denied.Ensure that the access-list is applied
outbound on their E0/0 interface.
Task 2 solution
R2
R2(config)#time-range AMS_TELNET
R2(config-time-range)#periodic weekdays 11:00 to 14:00
R2(config-time-range)#exit
R2(config)#time-range AMS_HTTP
R2(config-time-range)#absolute start 00:00 29 March 2018 end 23:59 29 April
2018
R2(config-time-range)#exit
R2(config)#access-list 102 deny tcp any any eq 23 time-range AMS_TELNET
R2(config)#access-list 102 permit tcp any any eq 23
R2(config)#access-list 102 deny tcp any any eq www time-range AMS_HTTP
R2(config)#access-list 102 permit tcp any any eq 80
R2(config)#interface Ethernet0/0
R2(config-if)#ip access-group 101 out
Aung Naing Moe 5
Security
Verification
R2#show access-lists
Extended IP access list 102
10 deny tcp any any eq telnet time-range AMS_TELNET (inactive)
20 permit tcp any any eq telnet
30 deny tcp any any eq www time-range AMS_HTTP (active)
40 permit tcp any any eq www
R2#
telnet န႔ပက္သက္တဲ့ ACL က inactive ျဖစ္ေနပါတယ္။ ဒါေၾကာင္ဲ့ clock ကိိုစစ္ၾကညဲ့္ပါဲ့မယ္။
R2#show clock
*09:23:08.361 EET Thu Mar 29 2018
R2(config)#clock timezone UTC 6 30
Clock ကိို YGN time zone ကိို ေျပာင္းလိိုက္ပါတယ္။ ျပန္စစ္ၾကညဲ့္ပါ။
အ္င္ေျပသြားပါလိမ္ဲ့မယ္။
R2#show access-lists
Extended IP access list 102
10 deny tcp any any eq telnet time-range AMS_TELNET (active)
20 permit tcp any any eq telnet
30 deny tcp any any eq www time-range AMS_HTTP (active)
40 permit tcp any any eq www
R2#
6 Aung Naing Moe
