IP ACL Operation

IP ACL Operation

• ACLs filter traffic.
• Standard and extended IPv4 ACLs are different.
• ACLs use wildcard masks.
• There are guidelines for creating and placing ACLs.
• Standard IPv4 ACLs are configured to filter traffic based on networking requirements.
• Standard IPv4 ACLs are modified using sequence numbers.
• Standard ACLs are configured to secure vty access.
• The structure of an extended access control entry (ACE) is explained.
• Extended IPv4 ACLs are configured to filter traffic based on networking requirements.
• ACLs can limit debug output.
• Routers process packets when an ACL is applied.
• Common ACL errors are troubleshooted using CLI commands.
• Routers do not filter traffic by default
• ACLs evaluate network packets
• ACLs determine if a packet is permitted or denied
• Access control entries (ACEs) or ACL statements are sequential lists of permit or deny statements
• ACLs control whether a router permits or denies packets based on criteria in the header
  • Source and destination IP addresses
  • IP Protocols (ICMP, TCP, UDP, EIGRP, etc)
  • TCP/UDP source and destination ports
• Routers act as packet filters by forwarding or denying packets based on filtering rules
• Inbound ACLs filter packets at a specific interface before routing takes place
• Outbound ACLs filter packets, regardless of the inbound interface, after routing takes place
• The last statement in an ACL is an implicit deny that is automatically inserted even if not physically present
• This implicit deny blocks all traffic
• All traffic will be blocked if there is no permit statement

Types of Cisco IPv4 ACLs

• Standard ACLs filter IP Packets based on the source address only
• Extended ACLs filter IP packets based on multiple attributes
  • Source and destination IP addresses
  • Source and destination TCP and UDP Ports
  • Protocol type/ Protocol number (IP, ICP, UDP, TCP, etc)

Numbering and Naming ACLs

• You assign a Numbered ACL based on which protocol you want filtered
• (1 to 99) and (1300 to 1999): Standard IP ACL
• (100 to 199) and (2000 to 2699): Extended IP ACL
• You assign a Named ACL by providing the name of the ACL
  • Names can contain alphanumeric characters
  • Suggest names in CAPITAL LETTERS
  • Names cannot contain spaces or punctuation
  • Entries can be added or deleted

ACL Wildcard Masking

• Wildcard masks and subnet masks differ in the way they match binary 1s and 0s
  • Wildcard mask bit 0 - Match the corresponding bit value in the address
  • Wildcard mask bit 1 - Ignore the corresponding bit value in the address
• Wildcard masks are often "inverse masks"
• Unlike Subnet masks, wildcard mask binary 1 is equal to match, and wildcard bit 0 is no match

Calculating the Wildcard Mask

• To calculate a wildcard mask, subtract the subnet mask from 255.255.255.255

Wildcard Mask Keywords

• To match all address bits, abbreviate this wildcard mask using IP address preceded by the keyword host ( host 192.168.10.10 )
• To ignore all address bits, abbreviate expression with the keyword any

Guidelines for Creating ACLs

• Use ACLs between your internal network and an external network like the Internet
• Use ACLs on a router between two parts of your network to control inbound and outbound traffic
• Configure ACLs on border routers at the edges of networks
• Configure ACLs for each network protocol configured on the border router interface

The Three Ps

• One ACL per protocol: To control traffic flow on an interface, an ACL must be defined for each protocol enabled on the interface.
• One ACL per direction: ACLs control traffic in one direction at a time on an interface. Two separate ACLs must be created to control inbound and outbound traffic.
• One ACL per interface: ACLs control traffic for an interface, for example, GigabitEthernet 0/0

ACL Best Practices

• Base ACLs on the security policy of the organization to implement security guidelines
• Describe what each ACL does to avoid inadvertently creating issues
• Use a text editor to create, edit and save ACLs so you can create a library of them for later
• Test ACLs on a development network before implementing them on a production network since this will help avoid costly errors

Guidelines for ACL Placement

• Every ACL should be placed where it has the greatest impact on efficiency
• Extended ACLs: Locate as close as possible to the source of the traffic to be filtered.
• Standard ACLs: Because standard ACLs do not specify destination addresses, place them as close to the destination as possible.
• Placement of the ACL and therefore the type of ACL used may also depend on: the extent of the network administrator's control, bandwidth of the networks involved, and ease of configuration.

Configure Standard IPv4 ACLs

• To configure Standard IPv4 ACLs
  • Enter global configuration mode, and define statements of what to filter
  • Enter interface configuration mode and identify the ACL and the direction to filter

Configuring a Standard ACL

• The full syntax of the standard ACL command is as follows: Router(config)# access-list access-list-number deny | permit | remark source [ source-wildcard ] [ log ]
• The global configuration no access-listcommand will remove the ACL
• Use the remark keyword for documentation

Applying Standard ACLS to Interfaces

• Link a standard ACL with the ip access-group command in interface configuration: Router(config-if)# ip access-group { access-list-number | access-list-name } { in | out }
• To remove an ACL, use the no ip access-group command on the interface, and then enter the global no access-list command to remove the entire ACL.

Creating Named Standard ACLS

• Use the command Router(config)#ip access-list (standard | extended ) name, the name should be unique, alphanumeric and cannot begin with a number
• To configure, use Router(config-std-nacl) or Router(config-ext-nacl)# (permit | deny | remark} {source [source- wildcard)} [log]
• To activate, use Router(config-if)#ip access-group name [in | out] on an interface

Configuring extended ACLs

• Extended ACLs can filter on
  • Source address
  • Destination address
  • Protocol
  • Port Numbers
• Extended ACLs are used more often than standard ACLs because they provide a greater degree of control and more precise traffic filtering control

Applying Extended ACLs to Interfaces

• Apply extended ACLs on interfaces by permitting a TCP and identifying the source and destination IP addresses, their wildcard numbers and the destination "eq" (Equal) Port number and destination port number
  • For example
    • R1 (config)#access-list 103 permit tcp 192.168.10.0 0.0.0.255 any eq 80
    • R1 (config)#access-list 103 permit tcp 192.168.10.0 0.0.0.255 any eq 443
• To configure the incoming and outgoing on an interface
  • R1(config)#interface g0/0
  • R1 (config-if)#ip access-group 103 in
  • R1 (config-if)#ip access-group 104 out

Editing Extended and Standard ACLs

• Editing an extended or standard ACL involves the same process
• ACLs can be modified using a text editor or sequence numbers