N4N066: Access Lists

Holly Podbilak (0:07)

One of the things you'll learn as a network engineer is that multi-vendor networks are an operational challenge. Life is easier when your gear is alike, and you're dealing with a small number of vendors.

Ethan Banks (0:17)

Our sponsor Meter is a solid option here. They offer an integrated wired, wireless, and cellular stack with hardware and software that they built in-house. Pricing is predictable, and you remain in the driver's seat for your network management if you want to.

Holly Podbilak (0:30)

Check out meter.com/n4n. That's meter.com/n4n to book a demo.

Ethan Banks (0:39)

Welcome to N is for Networking, where a grizzled veteran of the packet wars chats with a modern networker about how networking works and why it's that way. I'm Ethan Banks, your battle-hardened router nerd and recovering CCIE.

I once managed a team of people custom cabling a data center until their fingerprints wore off. But that is a true story, and my co-host is Holly Podbalak, a certification aficionado working deep inside the networking industry. And Holly and I love to hear from you. You can ping us at packetpushers.net/follow up with your topic requests and tales from the trenches and your well actually corrections.

Today's topic, access lists. They are not just for security. We're going to walk you through what an access list is, how an access list is processed, the various ways you might use an access list, and more. Access lists show up all the time in networking device configurations, and so they are really important to understand. Of course, Holly, I'm going to give you, this is not a fair question, but I'm going to give you this question anyway. You work for a security company these days. Do you have any opening thoughts on access lists?

Holly Podbilak (1:43)

What an interesting question. Because I think often people associate access lists with firewalls. I thought to myself, well, I've been at this company now for three months, and actually access lists have not come up in conversation at all.

Ethan Banks (1:58)

And just for clarification, you work for Palo Alto Networks.

Holly Podbilak (2:01)

Yes. Yes, I work for Palo.

Ethan Banks (2:02)

The biggest security company in the world, they're certainly one of them, if not the very biggest.

Holly Podbilak (2:06)

Yeah. And it's not that we're not doing the thing that access lists are intended to do, but we do it very, very differently with much more granularity than a typical access list with things like app ID and content ID and device ID and all these identification things. But for a moment, you had me there, Ethan. I was like, wait, have I gone three months and just totally missed something here?

Ethan Banks (2:31)

No, I actually intentionally asked that question because I wanted to stress to people, particularly those who are new, who assume if you're doing a firewall, it must be like a really complicated box with lots of access lists. Yeah, not really, not in a modern scenario. That could be part of it. You might see some similarities and some parallels, but we're really going to be focused today on access lists in the conjunction, in the context of routers and switches and using access lists for those devices. When you get into firewalls and pure security devices, the way security is enforced, the way you write a policy is, as you said, a lot more granular, Holly, a lot more complex, there's a lot more capability and features there. And so what you see there that's a security policy, maybe doesn't look much like an access list anymore.

Holly Podbilak (3:17)

No, and it's very cool. I love it. I'm enjoying it. Just in case anybody was wondering.

There's one thing that I do want to mention about accesses before we even jump into it is that typical networking industry, access list is not necessarily a common term across every vendor. So while we're calling them access lists today, you might see it pop up in different forms or different words being used to refer to the same thing.

Ethan Banks (3:46)

Yeah, which makes it a little hard. So that's a great point. We're going to talk about access list. That is a Cisco centric term. And a lot of you that are going through CCNA, you will run into that term access list. I also, when working on this script, brought in some Juniper terminology as well. So you have a couple of points of comparison. But don't think of this in terms of Cisco or Juniper. Think of this in terms of the bigger concepts that apply commonly, no matter what they're called in whatever platform that you might be working on.