Restricting virtual terminal access

Restricting virtual terminal access

11.2.6

This page will explain how ACLs are created for virtual ports.

Standard and extended access lists apply to packets that travel through a router.

They are not designed to block packets that originate within the router. An outbound Telnet extended access list does not prevent router initiated Telnet sessions, by default.

Just as there are physical ports or interfaces, such as Fa0/0 and S0/0 on the router, there are also virtual ports. These virtual ports are called vty lines. There are five vty lines, which are numbered 0 through 4, as shown in Figure

. For security purposes, users can be denied or permitted virtual terminal access to the router but denied access to destinations from that router.

The purpose of restricted vty access is increased network security. The Telnet protocol can also be used to create a nonphysical vty connection to the router. There is only one type of vty access list. Identical restrictions should be placed on all vty lines since it is not possible to control the line on which a user will connect.

The process to create the vty access list is the same as described for an interface. However, applying the ACL to a terminal line requires the access-class command instead of the access-group command.

The following should be considered when configuring access lists on vty lines:

A name or number can be used to control access to an interface.
Only numbered access lists can be applied to virtual lines.
Identical restrictions should be set on all the virtual terminal lines, because a user can attempt to connect to any of them.

In the second Lab Activity, students will use ACLs to control IP traffic.

This page concludes this lesson. The next page will summarize the main points from this module.

Comments

OSI layers / Peer-to-peer communications / TCP/IP model

OSI layers 2.3.4 This page discusses the seven layers of the OSI model. The OSI reference model is a framework that is used to understand how information travels throughout a network. The OSI reference model explains how packets travel through the various layers to another device on a network, even if the sender and destination have different types of network media. In the OSI reference model, there are seven numbered layers, each of which illustrates a particular network function. - Dividing the network into seven layers provides the following advantages: • It breaks network communication into smaller, more manageable parts. • It standardizes network components to allow multiple vendor development and support. • It allows different types of network hardware and software to communicate with each other. • It prevents changes in one layer from affecting other layers. • It divides network communication into smaller parts to make learning it easier to understand. In the foll...

Advantages and disadvantages of link-state routing

Advantages and disadvantages of link-state routing 2.1.5 This page lists the advantages and disadvantages of link-state routing protocols. The following are advantages of link-state routing protocols: Link-state protocols use cost metrics to choose paths through the network. The cost metric reflects the capacity of the links on those paths. Link-state protocols use triggered updates and LSA floods to immediately report changes in the network topology to all routers in the network. This leads to fast convergence times. Each router has a complete and synchronized picture of the network. Therefore, it is very difficult for routing loops to occur. Routers use the latest information to make the best routing decisions. The link-state database sizes can be minimized with careful network design. This leads to smaller Dijkstra calculations and faster convergence. Every router, at the very least, maps the topology of it...

Ports for services

Ports for services 10.2.2 Services running on hosts must have a port number assigned to them so communication can occur. A remote host attempting to connect to a service expects that service to use specific transport layer protocols and ports. Some ports, which are defined in RFC 1700, are known as the well-known ports. These ports are reserved in both TCP and UDP. These well-known ports define applications that run above the transport layer protocols. For example, a server that runs FTP will use ports 20 and 21 to forward TCP connections from clients to its FTP application. This allows the server to determine which service a client requests. TCP and UDP use port numbers to determine the correct service to which requests are forwarded. The next page will discuss ports in greater detail.

CCNA :) Be a Good Network Administrator

Search This Blog