Module Overview
22.1 Access
Control List Fundamentals
22.1.1
Introduction to ACLs
22.1.2 How ACLs
work
22.1.3 Creating
ACLs
22.1.4 The
function of a wildcard mask
22.1.5 Verifying
ACLs
22.2 Access
Control Lists (ACLs)
22.2.1 Standard
ACLs
22.2.2 Extended
ACLs
22.2.3 Named
ACLs
22.2.4 Placing
ACLs
22.2.5
Firewalls
22.2.6
Restricting virtual terminal access
Module:
Summary
Overview
Network
administrators must be able to deny unwanted access to a network and allow
authorized users to access necessary services. Security tools such as
passwords, callback equipment, and physical security devices are helpful.
However, they often lack the flexibility of basic traffic filters and the
specific controls that most administrators prefer. For example, a network administrator
may want to allow users access to the Internet, but not permit external users
Telnet access into the LAN.
Routers provide
the capability to filter traffic, such as blocking Internet traffic, with
access control lists (ACLs). An ACL is a sequential list of permit or deny
statements that apply to addresses or upper-layer protocols. This module will
introduce standard and extended ACLs as a way to control network traffic and
explain how they are used as part of a security solution.
This module includes tips,
considerations, recommendations, and general guidelines on how to use ACLs. It
also includes the commands and configurations needed to create ACLs. Finally,
this module provides examples of standard and extended ACLs and describes ACL
placement on router interfaces.
An ACL can be as
simple as a single line that permits packets from a specific host or it can be
a complex set of rules and conditions that defines network traffic and
determines the router processes. While many of the advanced uses of ACLs are
beyond the scope of this course, this module provides details about standard
and extended ACLs, the proper placement of ACLs, and some special applications
of ACLs.
This module
covers some of the objectives for the CCNA 640-801 and ICND 640-811 exams.
Students who
complete this module should be able to perform the following tasks:
- Describe the differences
between standard and extended ACLs
- Explain the rules for placement
of ACLs
- Create and apply named ACLs
- Describe the function of firewalls
- Use ACLs to restrict virtual
terminal access
22.1
Access Control List Fundamentals
22.1.1 Introduction to ACLs
This page will
explain what ACLs are and how they are used.
ACLs are lists of
conditions used to test network traffic that tries to travel across a router
interface. These lists tell the router
what types of packets to accept or deny. Acceptance and denial can be based on
specified conditions. ACLs enable management of traffic and secure access to
and from a network.
ACLs can be
created for all routed network protocols such as IP and Internetwork Packet
Exchange (IPX). ACLs can be configured at the router to control access to a
network or subnet.
To filter network
traffic, ACLs determine if routed packets are forwarded or blocked at the
router interfaces. The router examines
each packet and will forward or discard it based on the conditions specified in
the ACL. An ACL makes routing decisions based on source address, destination address,
protocols, and upper-layer port numbers.
ACLs must be
defined on a per protocol, per direction, or per port basis. To control traffic flow on an interface, an
ACL must be defined for each protocol enabled on the interface. ACLs control
traffic in one direction at a time on an interface. Two separate ACLs must be
created to control inbound and outbound traffic. Every interface can have
multiple protocols and directions defined. If the router has two interfaces
configured for IP, AppleTalk, and IPX, 12 separate ACLs would be needed. There
would be one ACL for each protocol, times two for each direction, times two for
the number of ports.
ACLs can be used
to perform the following tasks:
- Limit network traffic and
increase network performance. For example, ACLs that restrict video
traffic could greatly reduce the network load and increase network
performance.
- Provide traffic flow control.
ACLs can restrict the delivery of routing updates. If updates are not
required because of network conditions, bandwidth is preserved.
- Provide a basic level of
security for network access. ACLs can allow one host to access a part of
the network and prevent another host from accessing the same area. For
example, Host A is allowed to access the Human Resources network and Host
B is prevented from accessing it.
- Decide which types of traffic
are forwarded or blocked at the router interfaces. ACLs can permit e-mail
traffic to be routed, but block all Telnet traffic.
- Control which areas a client
can access on a network.
- Screen hosts to permit or deny
access to a network segment. ACLs can be used to permit or deny a user to
access file types such as FTP or HTTP.
If ACLs are not
configured on the router, all packets that pass through the router will be
permitted to access the entire network.
The next page
will describe how ACLs work.
22.1 Access Control List Fundamentals
22.1.2 How ACLs work
An ACL is made up
of statements that define whether packets are accepted or rejected at inbound
and outbound interfaces. This page will
explain how these statements are edited and added to an ACL. These decisions
are made by matching a condition statement in an access list and then
performing the accept or reject action defined in the statement.
The order in
which ACL statements are placed is important. The Cisco IOS software tests the
packet against each condition statement in order from the top of the list to
the bottom. Once a match is found in the list, the accept or reject action is
performed and no other ACL statements are checked. If a condition statement
that permits all traffic is located at the top of the list, no statements added
below that will ever be checked.
If additional
condition statements are needed in an access list, the entire ACL must be
deleted and recreated with the new condition statements. To make the process of revising an ACL
simpler it is a good idea to use a text editor such as Notepad and paste the
ACL into the router configuration.
The beginning of
the router process is the same, whether ACLs are used or not. As a frame enters an interface, the router
checks to see whether the Layer 2 address matches or if it is a broadcast
frame. If the frame address is accepted, the frame information is stripped off
and the router checks for an ACL on the inbound interface. If an ACL exists, the
packet is now tested against the statements in the list. If the packet matches
a statement, the packet is either accepted or rejected. If the packet is
accepted in the interface, it will then be checked against routing table
entries to determine the destination interface and switched to that interface.
Next, the router checks whether the destination interface has an ACL. If an ACL
exists, the packet is tested against the statements in the list. If the packet
matches a statement, it is either accepted or rejected. If there is no ACL or
the packet is accepted, the packet is encapsulated in the new Layer 2 protocol
and forwarded out the interface to the next device.
As a review, ACL
statements operate in sequential, logical order. If a condition match is true,
the packet is permitted or denied and the rest of the ACL statements are not
checked. If all the ACL statements are unmatched, an implicit deny any
statement is placed at the end of the list by default. The invisible deny any
statement at the end of the ACL will not allow unmatched packets to be
accepted. When first learning how to create ACLs, it is a good idea to add the
deny any at the end of ACLs to reinforce the dynamic presence of the implicit
deny.
The next page
will describe how ACLs are created.
22.1 Access
Control List Fundamentals
22.1.3 Creating ACLs
This page will
explain how ACLs are created in global configuration mode. There are many types of ACLs. This lesson
explains standard ACLs, extended ACLs, and named ACLs. When ACLs are configured
on a router, each ACL must have a unique identification number assigned to it.
This number identifies the type of access list created and must fall within the
specific range of numbers that is valid for that type of list.
After the proper
command mode is entered and the ACL type is decided upon, the user enters the
access list statements using the keyword access-list, followed by the proper
parameters. This is the first of the
two-step process. The second step of the process is assigning the ACL to the
proper interface.
In TCP/IP, ACLs
are assigned to one or more interfaces and can filter inbound traffic or
outbound traffic by using the ip access-group command in interface
configuration mode. The access-group
command is issued in the interface configuration mode. When an ACL is assigned
to an interface, inbound or outbound placement should be specified. The filter
direction can be set to check packets that travel into or out of an interface.
To determine if an ACL controls inbound or outbound traffic, the network
administrator must view the interfaces as if looking at them from inside the
router. This is a very important concept. Traffic that travels into an
interface is filtered by the inbound access list. Traffic going out of an interface
is filtered by the outbound access list. After a numbered ACL is created, it
must be assigned to an interface. An ACL containing numbered ACL statements
cannot be altered. It must be deleted by using the no access-list list-number
command and then recreated.
Use the following
rules to create and apply access lists:
- There should be one access list
per protocol per direction.
- Standard access lists should be
applied closest to the destination.
- Extended access lists should be
applied closest to the source.
- The inbound or outbound
interface should be referenced as if looking at the port from inside the
router.
- Statements are processed
sequentially from the top of the list to the bottom until a match is
found. If no match is found then the packet is denied, and discarded.
- There is an implicit deny any
at the end of all access lists. This will not appear in the configuration
listing.
- Access list entries should
filter in the order from specific to general. Specific hosts should be
denied first, and groups or general filters should come last.
- The match condition is examined
first. The permit or deny is examined only if the match is true.
- Never work with an access list
that is actively applied.
- A text editor should be used to
create comments that outline the logic. Then fill in the statements that
perform the logic.
- New lines are always added to
the end of the access list. A no access-list x command will remove the
whole list. It is not possible to selectively add and remove lines with
numbered ACLs
- An IP access list will send an
ICMP host unreachable message to the sender of the rejected packet and
will discard the packet in the bit bucket.
- An access list should be
removed carefully. If an access list that is applied to a production
interface is removed, some versions of IOS will apply a default deny any
to the interface and all traffic will be halted.
- Outbound filters do not affect
traffic that originates from the local router.
The Lab Activity
will help students become more familiar with the syntax that is used to create
an ACL.
The next page will discuss
wildcard masks.
22.1 Access Control List Fundamentals
22.1.4 The function of a wildcard mask
This page will
explain what a wildcard mask is and how it is used.
A wildcard mask
is a 32-bit quantity that is divided into four octets. A wildcard mask is paired with an IP address.
The numbers one and zero in the mask are used to identify how to treat the
corresponding IP address bits. The term wildcard mask represents the ACL mask-bit
matching process and comes from an analogy of a wildcard that matches any other
card in the game of poker. Wildcard masks have no functional relationship with
subnet masks. They are used for different purposes and follow different rules.
The subnet mask
and the wildcard mask represent two different things when they are compared to
an IP address. Subnet masks use binary ones and zeros to identify the network,
subnet, and host portion of an IP address. Wildcard masks use binary ones and
zeros to filter individual or groups of IP addresses to permit or deny access
to resources based on an IP address. The only similarity between a wildcard
mask and a subnet mask is that they are both thirty-two bits long and use
binary ones and zeros.
The mask in Figure would be written as 0.0.255.255. A zero
indicates a value that will be checked. The Xs, or ones, are used to block
values.
In the wildcard
mask process, the IP address in the access-list statement has the wildcard mask
applied to it. This creates the match value, which is used to compare and see
if a packet should be processed by this ACL statement, or sent to the next
statement to be checked. The second part of the ACL process is that any IP
address that is checked by a particular ACL statement will have the wildcard
mask of that statement applied to it. The result of the IP address and the
wildcard mask must equal the match value of the ACL. This process is
illustrated in the animation in Figure .
There are two
special keywords that are used in ACLs, the any and host options. The any option substitutes 0.0.0.0 for the IP
address and 255.255.255.255 for the wildcard mask. This option will match any
address that it is compared against. The host option substitutes 0.0.0.0 for
the mask. This mask requires that all bits of the ACL address and the packet
address match. This option will match just one address.
The next page
will teach students how to verify ACLs.
22.1 Access Control List Fundamentals
22.1.5 Verifying ACLs
This page will
explain how show commands can be used to verify the content and placement of
ACLs on a router.
The show ip
interface command displays IP interface information and indicates whether any
ACLs are assigned to the interface. The
show access-lists command displays the contents of all ACLs on the router. To see a specific list, add the ACL name or
number as an option for this command. The show running-config command will also
reveal the access lists on a router and the interface assignment information.
These show
commands will verify the list contents and placement. It is also a good
practice to test the access lists with sample traffic to ensure that the access
list logic is correct.
In the Lab
Activity, students will use show commands to verify ACLs on a router.
This page
concludes this lesson. The next lesson will provide more information about
ACLs. The first page will describe standard ACLs.
22.2 Access Control Lists (ACLs)
22.2.1
Standard ACLs
This page will
explain the function of standard ACLs. Students will also learn the syntax used
for a standard ACL.
Standard ACLs
check the source address of IP packets that are routed. The ACL will either permit or deny access for
an entire protocol suite, based on the network, subnet, and host addresses. For
example, packets that come in Fa0/0 are checked for their source addresses and
protocols. If they are permitted, the packets are routed through the router to
an output interface. If they are not permitted, they are dropped at the incoming
interface.
The standard
version of the access-list global configuration command is used to define a
standard ACL with a number in the range of 1 to 99 (also from 1300 to 1999 in
recent IOS). In Cisco IOS Software
Release 12.0.1, standard ACLs began using additional numbers (1300 to 1999) to
provide a maximum of 798 possible standard ACLs. These additional numbers are
referred to as expanded IP ACLs. In the first ACL statement, notice that there
is no wildcard mask. Since no list is shown, the default mask of 0.0.0.0 is
used. The entire address must match or the router must check for a match in the
next line in the ACL.
The full syntax
of the standard ACL command is as follows:
Router(config)#access-listaccess-list-number
deny permit remarksource [source-wildcard ] [log]
The remark
keyword makes the access list easier to understand. Each remark is limited to
100 characters. For example, it is not immediately clear what the purpose of
the following entry is:
Router(config)#access-list
1 permit 171.69.2.88
It is much easier
to read a remark about the entry to understand its effect, as follows:
Router(config)#access-list
1 remark Permit only Jones workstation through access-list 1 permit 171.69.2.88
The no form of
this command is used to remove a standard ACL. The syntax is as follows:
Router(config)#no
access-list access-list-number
The ip
access-group command links an existing standard ACL to an interface:
Router(config-if)#ip
access-group {access-list-number | access-list-name } {in | out }
The table shows
descriptions of the parameters used in this syntax.
The Lab
Activities will teach students how to plan, configure, and apply standard ACLs
to permit or deny traffic.
The next page
will describe extended ACLs.
22.2
Access Control Lists (ACLs)
22.2.2 Extended ACLs
This page will
provide an overview of extended ACLs.
Extended ACLs are
used more often than standard ACLs because they provide a greater range of
control. Extended ACLs check the source
and destination packet addresses and can also check for protocols and port
numbers. This gives greater flexibility to describe what the ACL will check.
Access can be permitted or denied based on where a packet originates, its
destination, protocol type, and port addresses. An extended ACL can
simultaneously allow e-mail traffic from Fa0/0 to specific S0/0 destinations
and deny file transfers and Web browsing. When packets are discarded, some
protocols send an echo packet to the sender, stating that the destination was
unreachable.
For a single ACL,
multiple statements may be configured.
Each statement should have the same access list number, to relate the
statements to the same ACL. There can be as many condition statements as
needed, limited only by the available router memory. Of course, the more
statements there are, the more difficult it will be to comprehend and manage
the ACL.
The syntax for
the extended ACL statement can get very long and often will wrap in the
terminal window. The wildcards also have the option of using the host or any
keywords in the command.
At the end of the
extended ACL statement, an administrator can specify a TCP or UDP port
number. The well-known port numbers for
TCP/IP are shown in Figure . Logical operations may be specified such as, equal
(eq), not equal (neq), greater than (gt), and less than (lt). The extended ACL
will perform these operations on specific protocols. Extended ACLs use an
access-list-number in the range 100 to 199 (also from 2000 to 2699 in recent
IOS). In Cisco IOS Software Release 12.0.1, extended ACLs began using
additional numbers (2000 to 2699) to provide a maximum of 799 possible extended
ACLs. These additional numbers are referred to as expanded IP ACLs.
The ip
access-group command links an existing extended ACL to an interface. Remember
that only one ACL per interface, per direction, per protocol is allowed. The format of the command is as follows:
Router(config-if)#ip
access-group access-list-number {in | out }
The Lab
Activities on this page will help students plan, configure, and apply extended
ACLs to filter network traffic.
The next page
will describe named ACLs.
22.2 Access Control Lists (ACLs)
22.2.3 Named
ACLs
This page will
explain the benefits and restrictions of named ACLs.
IP named ACLs
were introduced in Cisco IOS Software Release 11.2. Named ACLs allow standard
and extended ACLs to be given names instead of numbers. The following are advantages that are
provided by a named access list:
- Alphanumeric names can be used
to identify ACLs.
- The IOS does not limit the
number of named ACLs that can be configured.
- Named ACLs provide the ability
to modify ACLs without deletion and reconfiguration. However, a named
access list will only allow for statements to be inserted at the end of a
list. It is a good idea to use a text editor to create named ACLs.
Consider the
following before implementing named ACLs.
Named ACLs are
not compatible with Cisco IOS releases prior to Release 11.2.
The same name may
not be used for multiple ACLs. For example, it is not permissible to specify
both a standard and extended ACL named George.
It is important
to be aware of named access lists because of the advantages just discussed.
Advanced access list operations such as named ACLs will be presented in the
CCNP curriculum.
A named ACL is
created with the ip access-list command.
This places the user in the ACL configuration mode. In ACL configuration
mode, specify one or more conditions to be permitted or denied. This determines whether the packet is passed
or dropped when the ACL statement matches.
The configuration
in Figure creates a standard ACL named
Internetfilter and an extended ACL named marketing_group. The figure also shows
how the named access lists are applied to an interface.
The Lab Activities
on this page will show students how to create named ACLs to control network
traffic.
The next page
will discuss the placement of ACLs.
22.2 Access Control Lists (ACLs)
22.2.4 Placing ACLs
This page will
explain where an ACL should be placed. The placement of ACLs is an important
consideration.
Proper ACL
placement will filter traffic and make the network more efficient. The ACL
should be placed where it has the greatest impact on efficiency.
In Figure the administrator wants to deny Telnet or FTP
traffic from the Router A Ethernet LAN segment to the switched Ethernet LAN
Fa0/1 on Router D. At the same time, other traffic must be permitted. There are
several ways to do this. The recommended solution is an extended ACL that
specifies both source and destination addresses. Place this extended ACL in
Router A. Then, packets do not cross the Router A Ethernet segment or the
serial interfaces of Routers B and C, and do not enter Router D. Traffic with
different source and destination addresses will still be permitted.
The general rule
is to put the extended ACLs as close as possible to the source of the traffic
denied. Standard ACLs do not specify destination addresses, so they should be
placed as close to the destination as possible. For example, a standard ACL
should be placed on Fa0/0 of Router D to prevent traffic from Router A.
Administrators
can only place access lists on devices that they control. Therefore access list
placement must be determined in the context of where the network administrator's
control extends.
The Interactive
Media Activity will teach students where to place ACLs.
The next page
will discuss firewalls.
22.2 Access Control Lists (ACLs)
22.2.5 Firewalls
This page will explain how ACLs
are used in firewall routers.
A firewall is an
architectural structure that exists between the user and the outside world to
protect the internal network from intruders. In most circumstances, intruders
come from the global Internet and the thousands of remote networks that it
interconnects. Typically, a network firewall consists of several different
machines that work together to prevent unwanted and illegal access.
In this
architecture, the router that is connected to the Internet, referred to as the
exterior router, forces all incoming traffic to go to the application gateway.
The router that is connected to the internal network, the interior router,
accepts packets only from the application gateway. The gateway controls the
delivery of network-based services both into and from the internal network. For
example, only certain users might be allowed to communicate with the Internet,
or only certain applications might be permitted to establish connections
between an interior and exterior host. If the only application that is
permitted is e-mail, then only e-mail packets should be allowed through the
router. This protects the application gateway and avoids overwhelming it with
packets that it would otherwise discard.
ACLs should be
used in firewall routers, which are often positioned between the internal
network and an external network, such as the Internet. This allows control of
traffic entering or exiting a specific part of the internal network. The
firewall router provides a point of isolation so that the rest of the internal
network structure is not affected.
A configuration
of ACLs on border routers, which are routers situated on the boundaries of the
network, is necessary to provide security benefits. This provides basic
security from the outside network, or from a less controlled area of the
network, into a more private area of the network. On these border routers, ACLs
can be created for each network protocol configured on the router interfaces.
The next page
will describe virtual ports.
22.2 Access Control Lists (ACLs)
22.2.6 Restricting virtual terminal access
This page will explain how ACLs
are created for virtual ports.
Standard and
extended access lists apply to packets that travel through a router. They are not designed to block packets that
originate within the router. An outbound Telnet extended access list does not
prevent router initiated Telnet sessions, by default.
Just as there are
physical ports or interfaces, such as Fa0/0 and S0/0 on the router, there are
also virtual ports. These virtual ports are called vty lines. There are five
vty lines, which are numbered 0 through 4, as shown in Figure . For security
purposes, users can be denied or permitted virtual terminal access to the
router but denied access to destinations from that router.
The purpose of
restricted vty access is increased network security. The Telnet protocol can
also be used to create a nonphysical vty connection to the router. There is
only one type of vty access list. Identical restrictions should be placed on
all vty lines since it is not possible to control the line on which a user will
connect.
The process to
create the vty access list is the same as described for an interface. However,
applying the ACL to a terminal line requires the access-class command instead
of the access-group command.
The following
should be considered when configuring access lists on vty lines:
- A name or number can be used to
control access to an interface.
- Only numbered access lists can
be applied to virtual lines.
- Identical restrictions should
be set on all the virtual terminal lines, because a user can attempt to
connect to any of them.
In the second Lab Activity,
students will use ACLs to control IP traffic.
This page
concludes this lesson. The next page will summarize the main points from this
module.
Summary
This page
summarizes the topics discussed in this module.
ACLs are lists of
conditions that are applied to traffic that travels across a router interface.
They can be created for all routed network protocols such as IP and IPX.
Packets are accepted or denied based on these lists.
Network
administrators create ACLs to control network access. ACLs provide the ability
to limit network traffic, increase performance, and manage security issues. ACL
statements operate in sequential, logical order. When a condition is matched as
true, the packet is permitted or denied and the rest of the ACL statements are
not checked. If all the ACL statements are unmatched, an implicit deny any
statement is placed at the end of the list by default. The invisible deny any
statement at the end of the ACL will not allow unmatched packets to be
accepted. When first learning how to create ACLs, it is a good idea to add the
deny any at the end of ACLs to reinforce the dynamic presence implicit deny.
ACLs are created
in the global configuration mode and the basic rules should be applied. Each
ACL on a router must be configured with a unique number or a name. When a
numbered ACL is used, the number identifies the type of access list. Numbered
ACLs may be either standard or extended, and must fall within the specific
range of numbers that is valid for that type of list . Standard IP ACLs use the
numbers from 1 to 99. Extended IP ACLs use the numbers from 100 to 199. ACLs
are created by entering the command access-list. Once created, the list is then
assigned to the proper interface.
The placement of
an ACL has a great impact on network efficiency. The general rule is to put the
extended ACLs as close as possible to the source of the traffic denied.
Standard ACLs do not specify destination addresses, so they should be placed as
close to the destination as possible.
A wildcard mask
is a 32-bit quantity that is divided into four octets. The numbers one and zero
in the mask are used to determine the treatment of the corresponding IP address
bits. In the wildcard mask process, the IP address in the access-list statement
has the wildcard mask applied to it. This creates the match value, which
compares the two and determines whether the packet should be processed by this
ACL statement, or sent to the next statement to be checked.
The show ip
interface command displays IP interface information and indicates whether any
ACLs are set. The show access-lists command displays the contents of all ACLs
on the router. To see a specific list, add the ACL name or number as an option
for this command. The show running-config command will also display the access
lists on a router and the interface assignment information.
Standard ACLs
check the source IP address of packets that are routed. The ACL will permit or
deny access based on the network, subnet, and host address. Extended ACLs are
used more often than standard ACLs because they provide a greater range of
control. Extended ACLs check the source and destination packet addresses and
can also check for protocols and port numbers. A named ACL may be either an
extended or standard ACL. Named ACLs provide the ability to modify ACLs without
deleting and then reconfiguring them. A named access list will allow the deletion
of statements but will only allow for statements to be inserted at the end of a
list.
No comments:
Post a Comment