 |
 |
|
|
|
|
|
|
|
|
|
 |
|
|
||||||||||||||||||||||||||||||||||||||||||
|
|
 |
 |
 |
 |
||||||||||||||||||||||||||||||||||||||||||
|
|
|
|
|
|||||||||||||||||||||||||||||||||||||||||||
|
|
 |
|
|
|
|
|||||||||||||||||||||||||||||||||||||||||
|
|||
|
Close Window | |
|
|
|||
|
|
|
|
|
|
|
|
|
All contents copyright © 2003 Cisco Systems, Inc. All rights reserved. | |
  |
Overview |
|
|
|
11.1 |
|
Access Control List Fundamentals | |
| 11.1.1 |
|
What are ACLs |
ACLs are lists of conditions that are
applied to traffic traveling across a router's interface. 
These lists tell the router what types of packets to accept or deny.
Acceptance and denial can be based on specified conditions. ACLs enable
management of traffic and secure access to and from a network.ACLs can be created for all routed network protocols, such as Internet Protocol (IP) and Internetwork Packet Exchange (IPX). ACLs can be configured at the router to control access to a network or subnet. ACLs filter network traffic by controlling
whether routed packets are forwarded or blocked at the router's interfaces.
ACLs must be defined on a per-protocol, per
direction, or per port basis.
The following are some of the primary reasons to create ACLs:
If ACLs are not configured on the router, all packets passing through the router will be allowed onto all parts of the network.
|
|
|
11.1 |
|
Access Control List Fundamentals | |
| 11.1.2 |
|
How ACLs work |
| An ACL is a group of statements that define
whether packets are accepted or rejected at inbound and outbound interfaces.
These decisions are made by matching a condition statement in an access list
and then performing the accept or reject action defined in the statement. The order in which ACL statements are placed is important. The Cisco IOS software tests the packet against each condition statement in order from the top of the list to the bottom. Once a match is found in the list, the accept or reject action is performed and no other ACL statements are checked. If a condition statement that permits all traffic is located at the top of the list, no statements added below that will ever be checked. If additional condition statements are needed
in an access list, the entire ACL must be deleted and recreated with the new
condition statements.
The beginning of the router’s process is the
same, whether ACLs are used or not.
As a review, ACL statements operate in sequential, logical order. If a condition match is true, the packet is permitted or denied and the rest of the ACL statements are not checked. If all the ACL statements are unmatched, an implicit "deny any" statement is placed at the end of the list by default. Even though the "deny any" is not visible as the last line of an ACL, it is there and it will not allow any packets not matched in the ACL to be accepted. When first learning how to create ACLs, it is a good idea to add the implicit deny at the end of ACLs to reinforce the dynamic presence of the command line.
|
|
|
11.1 |
|
Access Control List Fundamentals | |
| 11.1.3 |
|
Creating ACLs |
ACLs are created in the global configuration
mode.
There are many different types of ACLs including standard, extended, IPX,
AppleTalk, and others. When configuring ACLs on a router, each ACL must be
uniquely identified by assigning a number to it. This number identifies the
type of access list created and must fall within the specific range of
numbers that is valid for that type of list.
After the proper command mode is entered and the
list type number is decided upon, the user enters the access list statements
using the keyword access-list,
followed by the proper parameters.
ACLs are assigned to one or more interfaces
and can filter inbound traffic or outbound traffic by using the
access-group
command.
These basic rules should be followed when creating and applying access lists:
|
|
|
11.1 |
|
Access Control List Fundamentals | |
| 11.1.4 |
|
The function of a wildcard mask |
| A wildcard mask is a 32-bit quantity that is
divided into four octets.
A wildcard mask is paired with an IP address. The numbers one and zero in
the mask are used to identify how to treat the corresponding IP address
bits. The term wildcard masking is a nickname for the ACL mask-bit matching
process and comes from of an analogy of a wildcard that matches any other
card in the game of poker. Wildcard masks have no functional relationship
with subnet masks. They are used for different purposes and follow different
rules. Subnet masks start from the left side of an IP address and work
towards the right to extend the network field by borrowing bits from the
host field. Wildcard masks are designed to filter individual or groups of IP
addresses permitting or denying access to resources based on the address.
Trying to figure out how wildcard masks work by relating them to subnet
masking will only confuse the entire matter. The only similarity between a
wildcard mask and a subnet mask is that they are both thirty-two bits long
and use ones and zeros for the mask.
Another issue is that the ones and zeros mean something different in a
wildcard mask as opposed to a subnet mask.
In the wildcard mask process, the IP address in the access-list statement has the wildcard mask applied to it. This creates the match value, which is used to compare and see if a packet should be processed by this ACL statement, or sent to the next statement to be checked. The second part of the ACL process is that any IP address that is checked by a particular ACL statement will have the wildcard mask of that statement applied to it. The result of the IP address and the wildcard mask must equal the match value of the ACL. This process is illustrated in the animation. There are two special keywords that are used
in ACLs, the any
and host
options.
|
|
|
11.1 |
|
Access Control List Fundamentals | |
| 11.1.5 |
|
Verifying ACLs |
| There are many
show
commands that will verify the content and placement of ACLs on the router.
The
show ip interface command displays IP
interface information and indicates whether any ACLs are set.
These show commands will verify the list contents and placement. It is also a good practice to test the access lists with sample traffic to ensure that the access list logic is correct.
|
|
|
11.2 | Access Control Lists (ACLs) | ||
| 11.2.1 |
|
Standard ACLs |
| Standard ACLs check the source address of IP
packets that are routed.
The comparison will result in either permit or deny access for an entire
protocol suite, based on the network, subnet, and host addresses. For
example, packets coming in Fa0/0 are checked for source address and
protocol. If they are permitted, the packets are routed through the router
to an output interface. If they are not permitted, they are dropped at the
incoming interface. The standard
version of the access-list
global configuration command is used to define a standard ACL with a number
in the range of 1 to 99 (also from 1300 to 1999 in recent IOS).
The full syntax of the standard ACL command is:
The no form of this command is used to remove a standard ACL. This is the syntax:
The table shows descriptions of the
parameters used in this syntax.
|
|
|
11.2 |
|
Access Control Lists (ACLs) | |
| 11.2.2 |
|
Extended ACLs |
| Extended ACLs are used more often than
standard ACLs because they provide a greater range of control.
Extended ACLs check the source and destination packet addresses as well as
being able to check for protocols and port numbers. This gives greater
flexibility to describe what the ACL will check. Packets can be permitted or
denied access based on where the packet originated and its destination as
well as protocol type and port addresses. An extended ACL can allow e-mail
traffic from Fa0/0 to specific S0/0 destinations, while denying file
transfers and web browsing. When packets are discarded, some protocols send
an echo packet to the sender, stating that the destination was unreachable.
For a single ACL, multiple statements may be
configured.
The syntax for the extended ACL statement can
get very long and often will wrap in the terminal window. The wildcards also
have the option of using the host or any keywords in the
command.
At the end of the extended ACL statement,
additional precision is gained from a field that specifies the optional
Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) port
number.
The
ip access-group
command links an existing extended ACL to an interface. Remember that only
one ACL per interface, per direction, per protocol is allowed. The format of
the command is:
|
|
|
11.2 |
|
Access Control Lists (ACLs) | |
| 11.2.3 |
|
Named ACLs |
IP named ACLs were introduced in Cisco IOS
Software Release 11.2, allowing standard and extended ACLs to be given names
instead of numbers.
The advantages that a named access list provides are:
Consider the following before implementing named ACLs. Named ACLs are not compatible with Cisco IOS releases prior to Release 11.2. The same name may not be used for multiple ACLs. For example, it is not permissible to specify both a standard and extended ACL named George. It is important to be aware of named access lists because of the advantages just discussed. Advanced access list operations such as named ACLs will be presented in the CCNP curriculum. A named ACL is created with the
ip access-list
command.
The configuration shown creates a standard
ACL named Internet filter and an extended ACL named “marketing_group”.
|
|
|
11.2 |
|
Access Control Lists (ACLs) | |
| 11.2.4 |
|
Placing ACLs |
| ACLs are used to control traffic by
filtering packets and eliminating unwanted traffic on a network. Another
important consideration of implementing ACLs is where the access list is
placed. If the ACLs are placed in the proper location, not only can traffic
be filtered, but it can make the whole network more efficient. If traffic is
going to be filtered, the ACL should be placed where it has the greatest
impact on increasing efficiency. Suppose the enterprise policy aim is to deny telnet or FTP traffic from Router A Ethernet LAN segment to the switched Ethernet LAN Fa0/1 on Router D. At the same time, other traffic must be permitted. Several approaches can accomplish this policy. The recommended approach uses an extended ACL specifying both source and destination addresses. Place this extended ACL in Router A. Then, packets do not cross Router A's Ethernet, do not cross the serial interfaces of Routers B and C, and do not enter Router D. Traffic with different source and destination addresses will still be permitted. The general rule is to put the extended ACLs as close as possible to the source of the traffic denied. Standard ACLs do not specify destination addresses, so they should be placed as close to the destination as possible. For example, a standard ACL should be placed on Fa0/0 of Router D to prevent traffic from Router A. An administrator can only place an access list on a device that they control. Therefore access list placement must be determined in the context of where the network administrator’s control extends.
|
|
|
11.2 |
|
Access Control Lists (ACLs) | |
| 11.2.5 |
|
Firewalls |
| A firewall is an architectural structure
that exists between the user and the outside world to protect the internal
network from intruders. In most circumstances, intruders come from the
global Internet and the thousands of remote networks that it interconnects.
Typically, a network firewall consists of several different machines that
work together to prevent unwanted and illegal access. In this architecture, the router that is connected to the Internet, referred to as the exterior router, forces all incoming traffic to go to the application gateway. The router that is connected to the internal network, the interior router, accepts packets only from the application gateway. In effect, the gateway controls the delivery of network-based services both into and from the internal network. For example, only certain users might be allowed to communicate with the Internet, or only certain applications might be permitted to establish connections between an interior and exterior host. If the only application that is permitted is mail, then only mail packets should be allowed through the router. This protects the application gateway and avoids overwhelming it with packets that it would otherwise discard. ACLs should be used in firewall routers, which are often positioned between the internal network and an external network, such as the Internet. The firewall router provides a point of isolation so that the rest of the internal network structure is not affected. ACLs can be used on a router positioned between the two parts of the network to control traffic entering or exiting a specific part of the internal network. A configuration of ACLs on border routers, which are routers situated on the boundaries of the network, is necessary to provide security benefits. This provides basic security from the outside network, or from a less controlled area of the network, into a more private area of the network. On these border routers, ACLs can be created for each network protocol configured on the router interfaces.
|
|
|
11.2 |
|
Access Control Lists (ACLs) | |
| 11.2.6 |
|
Restricting virtual terminal access |
| Standard and extended access lists apply to
packets traveling through a router.
They are not designed to block packets that originate within the router. An
outbound Telnet extended access list does not prevent router initiated
Telnet sessions, by default. Just as
there are physical ports or interfaces, such as Fa0/0 and S0/0 on the
router, there are also virtual ports. These virtual ports are called vty
lines. There are five such vty lines, numbered 0 through 4, as shown in
figure
The purpose of restricted vty access is increased network security. Access to vty is also accomplished using the Telnet protocol to make a nonphysical connection to the router. As a result, there is only one type of vty access list. Identical restrictions should be placed on all vty lines as it is not possible to control which line a user will connect on. The process to create the vty access list is
the same as described for an interface. However, applying the ACL to a
terminal line requires the
access-class command instead of the
access-group
command.
The following should be considered when configuring access lists on vty lines:
|
|
|
Summary |
An understanding of the following key points
should have been achieved:
|
To control traffic flow on an interface, an ACL must be defined for each
protocol enabled on the interface. ACLs control traffic in one direction at
a time on an interface. A separate ACL would need to be created for each
direction, one for inbound and one for outbound traffic. Finally every
interface can have multiple protocols and directions defined. If the router
has two interfaces configured for IP, AppleTalk, and IPX, 12 separate ACLs
would be needed. One ACL for each protocol, times two for direction in and
out, times two for the number of ports.
Web Links
The access-group
command is issued in the interface configuration mode. When assigning an ACL
to an interface inbound or outbound placement should be specified. The
filter direction can be set to check packets that are traveling into or out
of an interface. When determining if the ACL is addressing inbound or
outbound traffic, the network administrator needs to look at at the
interfaces from inside the router. This is a very important concept. Traffic
coming in from an interface is filtered by an inbound access list, traffic
going out an interface is filtered by the outbound access list. After
creating a numbered ACL, it must be assigned to an interface.
To alter an ACL containing numbered ACL statements, all the statements in
the numbered ACL must be deleted by using the command
no access-list list-number.
