Guide membuat access-list (ACL)

1. Deny dulu baru permit. Denying the network traffic from accessing another network comes before permitting all other traffic.
2. Selalu tempatkan access-list standard dekat ke network/host yang mau di deny
3. Selalu tempatkan/urutkan most specific ke least specific.
4. Kalau tidak ada mention port, mending pakai access-list standard
5. Kalau ada mention port, pakai access-list extended
6. Numbered atau named terserah, kalau yang lebih mudah di edit named.
7. Untuk nge-view atau examine access-list jangan pakai show run tapi lebih enak pakai show access-list atau show ip access-list

Contoh:
• For the 192.168.10.0/24 network, block Telnet access to all locations and TFTP access to the corporate Web/TFTP server at 192.168.20.254. All other access is allowed.
• For the192.168.11.0/24 network, allow TFTP access and web access to the corporate Web/TFTP server at 192.168.20.254. Block all other traffic from the 192.168.11.0/24 network to the 192.168.20.0/24 network. All other access is allowed.

Terjemahan:

• Untuk network 192.168.10.0/24, blok akses Telnet ke semua lokasi dan akses TFTP ke corporate Web/TFTP server di 192.168.20.254. Semua akses lain diperbolehkan.
• Untuk network 192.168.11.0/24, izinkan/bolehkan akses TFTP dan akses web ke corporate Web/TFTP server. Blok semua trafik lain dari 192.168.11.0/24 (network ini) ke network 192.168.20.0/24. Semua akses lain diperbolehkan.

Dengan bahasa lain / yang lebih sederhana:
Network 192.168.10.0/24 bisa akses ke semua kecuali telnet ke semua lokasi dan akses TFTP ke corporate Web/TFTP server.
Network 192.168.11.0/24

Penjabaran:
For 192.168.10.0/24
Block:

• Telnet access to all locations
• TFTP access to the corporate Web/TFTP server 192.168.20.254

Permit

• All other access (Mail, Database, Ping/ICMP)

For 192.168.11.0/24

Block:

• Block all other traffic from the 192.168.11.0/24 to the 192.168.20.0/24 network

Permit:

• TFTP access and web access to the corporate Web/TFTP server at 192.168.20.254

Access-list

R1(config)#access-list 100 

Distance vector routing protocol
- RIP is product that inherit distance vector specification.

Loop avoidance
- Split horizon: prevent route information packet received from one interface to go
- don't turn it off.

Specific distance vector
- route poisoning


RIP
- doesn't converged quickly; the routers don't agree quickly


Routing troubleshooting tools:
1. show ip protocols
2. 

Subnetting visualization

/24 = hhhhhhhh
/25 = shhhhhhh
/26 = sshhhhhh
/27 = ssshhhhh
/28 = sssshhhh
/29 = ssssshhh
/30 = sssssshh
/31 = sssssssh
/32 = ssssssss