Access Control Lists (ACLs)

• Chapter 4 focuses on implementing firewall technologies, specifically Access Control Lists (ACLs).

Objectives

• Explain how ACLs filter traffic
• Compare standard and extended IPv4 ACLs
• Explain how ACLs use wildcard masks
• Explain guidelines for creating and placing ACLs
• Configure standard and extended IPv4 ACLs to filter traffic according to networking requirements
• Modify a standard IPv4 ACL using sequence numbers
• Configure a standard ACL to secure vty access
• Explain the structure of an extended Access Control Entry (ACE)
• Configure an ACL to limit debug output
• Explain how a router processes packets when an ACL is applied
• Troubleshoot common ACL errors using CLI commands

ACL Operation

• ACLs are sequential lists of permit or deny statements, also known as Access Control Entries(ACEs).
• An ACL statement is also an ACE.
• ACLs control whether a router permits or denies packets based on criteria, identifying the source IP, destination IP, IP protocols (ICMP, TCP, UDP, EIGRP), and TCP/UDP source/destination ports.
• A router functions as a packet filter when forwarding/denying packets based on filtering rules.
• By default, routers do not filter traffic.
• When applied to an interface, an ACL evaluates network packets to determine if packets are permitted or denied.
• Inbound ACLs filter packets coming into a specific interface and before being routed to the outbound interface.
• Outbound ACLs filter packets after being routed, regardless of the inbound interface.
• The last statement of an ACL is always an implicit deny and blocks all traffic, even if not physically present.
• An ACL without a permit statement will block all traffic because of the implicit deny.

Types of Cisco IPv4 ACLs

• Standard ACLs filter IP packets based on the source address only.
• Extended ACLs filter IP packets based on several attributes: Source/destination IPs, TCP/UDP ports, and protocol type/number (IP, ICP, UDP, TCP).

Numbering & Naming ACLs

• Numbered ACLs are assigned a number based on the protocol to be filtered :
• Standard IP ACLs range from 1-99 and 1300-1999.
• Extended IP ACLs range from 100-199 and 2000-2699.
• Named ACLs assign a name and have alphanumeric characters.
• Names should be in CAPITAL LETTERS
• Cannot contain spaces or punctuation
• Entries can be added or deleted within the ACL.

Introducing ACL Wildcard Masking

• Wildcard masks and subnet masks differ in the way they match binary 1s and 0s
• Wildcard mask rules for matching binary 1s and 0s:
• Wildcard mask bit 0: Match the corresponding bit value in the address.
• Wildcard mask bit 1: Ignore the corresponding bit value in the address.
• Wildcard masks are inverse masks - unlike subnet masks (binary 1 = match, binary 0 = not match), the reverse is true
• Calculate wildcard masks by subtracting the subnet mask from 255.255.255.255.
• Shorthand wildcard mask keywords host refers to a 0.0.0.0 mask and any refers to a 255.255.255.255 mask.

General Guidelines for Creating ACLs

• Use ACLs in firewall routers between the internal network and external networks like the Internet.
• Use ACLs on a router between two parts of the network to control traffic entering/exiting a specific part of the internal network.
• Configure ACLs on border routers (routers at the edge of networks).
• Configure ACLs for each network protocol configured on border router interfaces.
• Three P's of ACL traffic control.
• One ACL per protocol: Define an ACL for each protocol enabled on the interface to control traffic flow.
• One ACL per direction: Use two ACLs for inbound and outbound control, as ACLs control traffic in one direction at a time.
• One ACL per interface: ACLs control traffic for an interface, such as GigabitEthernet 0/0.

ACL Best Practices

• Base ACLs on the organization's security policy to implement security guidelines.
• Prepare a description of what the ACLs should do to avoid inadvertently creating potential access problems.
• Use a text editor to create, edit, and save ACLs for a library of reusable ACLs.
• Test ACLs on a development network before implementing them on a production network to avoid costly errors.

Where to Place ACLs

• Place an ACL where it has the greatest impact on efficiency.
• Extended ACLs: Locate as close as possible to the traffic source to be filtered.
• Standard ACLs: Locate as close as possible to the destination as they do not specify destination addresses.
• The extent of the network administrator's control, bandwidth of the networks, and ease of configuration also affects ACL placement and type of ACL used.

Configuring Standard ACLs

• Standard ACLs use the command access-list access-list-number deny | permit | remark source [source-wildcard] [log]
• Remove an ACL using global configuration command no access-list
• The remark keyword provides documentation, making access lists easier to understand.
• Cisco IOS applies internal logic when accepting/processing Access Control List (ACL) statements.
• Access list statements are processed sequentially, so the order in which statements are entered is important.
• Link a configured standard ACL to an interface in interface configuration mode using the command ip access-group {access-list-number | access-list-name} {in | out}
• Remove an ACL from an interface using the command no ip access-group on the interface, then use the global command no access-list to completely remove the ACL.
• Numbered ACLs can be commented by using the remark command
• Configure named standard ACLs using ip access-list {standard | extended} name
• The alphanumeric name cannot begin with a number.
• Standard ACL syntax is access-list access-list-number deny | permit | remark source [source-wildcard] [log]
• Activate named IP ACLs on an interface by using the command ip access-group name {in | out}
• Standard numbered ACLs can be edited using a text editor or using sequence numbers.
• show access-lists command will display line numbers for ACLs

Verifying ACLs

• Use the command show ip interface to verify ACLs
• The command show access-lists displays the ACL information

Extended ACLs

• Filters on source address, destination address, protocol, and port numbers.
• Extended ACLs are used due to the greater degree of control with precise traffic-filtering control.
• Extended ACLs filter on source IP addresses AND destination IP addresses.
• ACL’s can filter on upper-layer protocols (IP, TCP, UDP, ICMP, EIGRP, or source/destination port).

Configuring Extended ACLs

• Configured with access-list access-list-number {deny | permit | remark} protocol source [source-wildcard] [operator operand] [port port-number or name] destination [destination-wildcard] [operator operand] [port port-number or name] [established]
• Apply extended ACLs to interfaces with ip access-group {access-list-number | access-list-name in | out}
• Create named extended ACLs with the command ip access-list extended name
• Similar to standard ACLs, extended ACLs can be edited using a text editor or sequence numbers.