Chapter 4: Access Control Lists (ACLs)

• ACLs can be used to filter network traffic
• Standard and Extended IPv4 ACLs can be compared
• ACLs utilizes wildcard masks
• ACL creation involves following key guidelines
• Guidelines exist for ACL placement
• Standard IPv4 ACLs can be configured to filter network traffic as required
• Sequence numbers can modify standard IPv4 ACLs
• Standard ACLs configure vty access securely
• Extend access control entry includes the structure of ACE
• Extended IPv4 ACLs are configured to filter traffic as required
• ACLs limit debug output
• Routers process packets when an ACL applies
• CLI commands troubleshoot common ACL errors

Purpose of ACLs

• Routers do not filter traffic by default

• When an ACL applies to an interface, it evaluates all network packets and determines if the packet is permitted or denied

• An ACL is a sequential list of permit or deny statements known as access control entries (ACEs) a.k.a, ACL statements

• Routers permit or deny packets based on the criteria in the header that contain:

  • Source and destination IP addresses
  • IP protocols such as ICMP, TCP, UDP, EIGRP
  • TCP/UDP, source/destination ports

• Routers can filter packets when forwarding or denying packets according to filtering rules

• Inbound ACLs filter packets coming into a specific interface before they are routed to the outbound interface

• Outbound ACLs filter packets after being routed regardless of the inbound interface

• The last ACL statement is always an implicit deny, automatically inserted at the end, even if it is not physically present

• The implicit deny blocks all traffic, so an ACL without the permit statement blocks all traffic

Standard versus Extended IPv4 ACLs

• Standard ACLs filter IP packets based on the source address only
• Extended ACLs can filter IP packets with the following attributes:
  • Source and destination IP addresses
  • Source and destination TCP and UDP ports
  • Protocol type or number like, IP, ICP, UDP, TCP

Numbering and Naming ACLs

• Numbered ACLs assign a number based on which protocol is to be filtered
  • (1 to 99) and (1300 to 1999) specifies a Standard IP ACL
  • (100 to 199) and (2000 to 2699) specifies an Extended IP ACL
• Named ACLs assign a name by providing the name of the ACL
  • Names use alphanumeric characters
  • Best practice is to write the name in CAPITAL LETTERS
  • Spaces or punctuation are not valid for named ACLs
  • Entries can be easily added or deleted within the ACL

Wildcard Masks in ACLs

• Wildcard masks and subnet masks match binary 1s and 0s differently
• Wildcard Masks use the following rules to match binary 1s and 0s:
  • Wildcard mask bit 0 - Match the corresponding bit value in the address
  • Wildcard mask bit 1 - Ignore the corresponding bit value in the address
• Wildcard masks are often referred to as an inverse mask
• Subnet masks have a binary 1 equal to a match and a binary 0 as not a match
• In a wildcard mask, the reverse is true

Calculating the Wildcard Mask

• Calculating wildcard masks can be challenging
• A shortcut method is to subtract a provided subnet mask from 255.255.255.255

Wildcard Mask Keywords

• access-list 1 permit 192.168.10.10 0.0.0.0 is the same as access-list 1 permit host 192.168.10.10

• access-list 1 permit 0.0.0.0 255.255.255.255 is the same as access-list 1 permit any

Guidelines for ACL Creation

• Place ACLs in firewall routers positioned between your internal network and an external network like the internet
• Place ACLs on a router positioned between two parts of your network to control traffic entering or exiting a specific part of your internal network
• Configure ACLs on border routers situated at the edges of your networks
• Configure ACLs for each network protocol configured on the border router interfaces

General Guidelines for Creating ACLs

• One ACL per protocol controls traffic flow on an interface
• An ACL must be defined for each protocol enabled on the interface
• One ACL per direction controls traffic in one direction at a time on an interface
• Two separate ACLs must be created to control inbound and outbound traffic
• Utilize one ACL per interface on interfaces such as, GigabitEthernet 0/0

ACL Best Practices

Guidelines for ACL Placement

• Place every ACL where it has the greatest impact on efficiency
• Locate extended ACLs as close as possible to the traffic source that is to be filtered
  • Because standard ACLs do not specify destination addresses, places them as close to the destination as possible
• Placement of the ACL and the type of ACL used may also depend on various factors:
  • The extent of administrator control
  • Bandwidth of the networks involved
  • Ease of configuration

Configuring a Standard ACL Example

• access-list 2 deny host 192.168.10.10

• access-list 2 permit 192.168.10.0 0.0.0.255

• access-list 2 deny 192.168.0.0 0.0.255.255

• access-list 2 permit 192.0.0.0 0.255.255.255

• The full syntax of the standard ACL commands:

  • Router(config)# access-list access-list-number deny | permit | remark source [source-wildcard] [log]

• The global configuration no access-list command removes the ACL

• Use the remark keyword for documentation and create easy to understand access lists

Internal Logic for ACLs

• Cisco IOS applies an internal logic when accepting and processing standard access list statements
• Access list statements are processed sequentially
• Statement order is important

Applying Standard ACLs to Interfaces

• The ip access-group command links an configured standard ACL within interface configuration mode
  • Router(config-if)# ip access-group { access-list-number | access-list-name } { in | out }
• To remove an ACL from an interface:
  • First enter the no ip access-group command on the interface
  • Then enter the global no access-list command to remove the entire ACL

Creating Named Standard ACLs

• The following command activates a named IP ACL on an interface:

  • Router(config)#ip access-list [standard | extended ] name
  • Alphanumeric name must be unique and not begin with a number

• The following command syntax is used:

  • Router(config-std-nacl)# [permit | deny | remark] {source [source- wildcard]} [log]

• The resulting command is:

  • Router(config-if)#ip access-group name[in | out]

Structure of Extended IPv4 ACLs

• Extended ACLs can filter on:

  • Source address
  • Destination address
  • Protocol
  • Port numbers

• Extended ACLs are used more often than standard ACLs because of their greater degree of control

  • Also characterized as "increased granular control"

• Extended ACLS filter on source IP address AND destination IP address

• Additionally, filters can be executed on the upper layer, protocols such as IP, TCP, UDP, ICMP, EIGRP with respective source and destination ports

• The procedural steps for extended ACL configurations are the same as standard ACLs

• After configuring the extended ACL, it must be activated on an interface

  • Configuration syntax and parameters may be more complex because of support for additional extended ACL features

• Syntax example:

  • access-list access-list-number {deny | permit | remark} protocol source [source-wildcard] [operator operand] [port port-number or name] destination [destination-wildcard] [operator operand] [port port-number or name] [established]

Extended IP ACLs

• access-list 101 permit ip any any permits all packets
• access-list 101 deny ip any host 10.1.1.1 denies all packets from any source address going to host 10.1.1.1
• access-list 101 deny ip host 10.1.1.1 any denies all packets from host 10.1.1.1 going to any destination address

Extended TCP ACLs

• Port protocols that come after a destination address refers to the destination port for, access-list 101 deny tep any any eq telnet a.k.a. port 23

  • This denies packets whose destination port is 23 (Telnet) from anywhere to anywhere

• A Prot/protocol after the source address refers to the source port, access-list 101 deny tcp any eq telnet any

• Any TCP packets whose source port is 23 (telnet) are denied access to any destination

Editing Extended ACLs

• Editing an extended ACL uses the same process as editing a standard ACL
• Extended ACLs can be modified by:
  • Text editor
  • Sequence numbers

Verifying ACLs

• The show ip interface command will show the ACL configured on the interface and direction
• The command to verify is, R1#show ip interface g0/0

ACL Statistics

• Use the show access-lists command to show the ACL statistics
• It will show the number of matches for each ACL
• R1#show access-lists