Student Guide Access List

I NTRODUCTION TO S ECURITY Security is a required solution for a company to prevent its network from Various types of attacks and intruders. There are various solution for security like Firewall Software, etc Cisco has implemented a simple and easy to feature for security called As acess-list.

I NTRODUCTION TO A CCESS -L IST An access-list is a list of conditions that controls flow of traffic. Access-list helps for packet filtering, traffic controlling, security, etc. Used to permit or deny packets moving through the router. Permit or deny Telnet (VTY) access to or from a router.

Standard Access List Only source IP address is specified in the condition Extended Access List Conditions can contains Source IP, Destination IP, Protocol Field, Port Number Named Access List Functionally the same as standard and extended access lists but with name tag. T YPES OF A CCESS -L IST

Packets are compared to each line of the assess list in sequential order Packets are compared with lines of the access list only until a match is made Once a match is made & acted upon no further comparisons take place An implicit deny is at the end of each access list If no matches have been made, the packet will be discarded A CCESS - LIST RULES

Inbound Access Lists Packets are processed before being routed to the outbound interface Outbound Access Lists Packets are routed to the outbound interface & then processed through the access list H OW A CCESS -L IST IS APPLIED

One access list per interface, per protocol, or per direction More specific tests at the top of the ACL New lists are placed at the bottom of the ACL Individual lines cannot be removed End ACLs with a permit any command Create ACLs & then apply them to an interface ACLs do not filter traffic originated from the router Put Standard ACLs close to the destination Put Extended ACLs close the the source A CCESS -L IST G UIDELINE

What are they??? Used with access lists to specify a…. Host Network Part of a network W ILDCARDS

Rules: When specifying a range of addresses, choose the closest block size Each block size must start at 0 A 0 in a wildcard means that octet must match exactly A 255 in a wildcard means that octet can be any value The command any is the same thing as writing out the wildcard: B LOCK S IZE

(Remember: specify a range of values in a block size) Requirement: Block access in the range from through = block size 8 Network number = Wildcard = **The wildcard is always one number less than the block size S PECIFYING RANGE OF SUBNET

S TANDARD IP ACCESS - LIST In standard access-list on source address is specified It number ranges from 1 – 99 It is generally applied to destination nearest interface

Creating a standard IP access list: Router(config)#access-list 10 ? deny Specify packets to reject permit Specify packets to forward Permit or deny? Router(config)#access-list 10 deny ? Hostname or A.B.C.D Address to match any any source host host A single host address Using the host command Router(config)#access-list 10 deny host C REATING STANDARD ACCESS - LIST

E XAMPLE - 1 Condition : Sales network cannot access marketing network Others can access marketing network / /8 Router(config)# access-list 15 deny Router(config)#access-list 15 permit any Router(config)#int ethernet2 Router(config-if)#access-group 15 out

E XAMPLE - 2 Condition : Human resource department can only access human resources server located on Lab_B router. Others are not allowed. Lab_b(config)#access-list 11 permit Lab_b(config)#access-list 11 deny any Lab_b(config)#int ethernet0 Lab_b(config-if)#access-group 11 out

E XAMPLE - 3 Internet Conditions Network cannot access internet, others can access internet Host and cannot access network Router(config)# access-list 10 deny Router(config)#access-list 10 permit any Router(config)#int serial 0 Router(config-if)#access-group 10 out Router(config)# access-list 11 deny host Router(config)# access-list 11 deny host Router(config)#access-list 11 permit any Router(config)#int Ethernet 3 Router(config-if)#access-group 11 out

Why?? Without an ACL any user can Telnet into the router via VTY and gain access Controlling access Create a standard IP access list Permitting only the host/hosts authorized to Telnet into the router Apply the ACL to the VTY line with the access-class command VTY (T ELNET ) C ONTROL

Lab_A(config)#access-list 50 permit Lab_A(config)#line vty 0 4 Lab_A(config-line)#access-class 50 in E XAMPLE

Allows you to choose... IP Source Address IP Destination Address Protocol Port number Starts with number E XTENDED IP A CCESS - LIST

#1: Select the access list: RouterA(config)#access-list 110 #2: Decide on deny or permit: RouterA(config)#access-list 110 deny #3: Choose the protocol type: RouterA(config)#access-list 110 deny tcp #4: Choose source IP address of the host or network: RouterA(config)#access-list 110 deny tcp any #5: Choose destination IP address RouterA(config)#access-list 110 deny tcp any host #6: Choose the type of service, port, & logging RouterA(config)#access-list 110 deny tcp any host eq 23 log E XTENDED IP ACCESS - LIST STEPS

RouterA(config)#access-list 110 deny tcp any host eq 23 log RouterA(config)#access-list 110 permit ip any RouterA(config)#ip access-group 110 in or RouterA(config)#ip access-group 110 out C ONTINUE …

E XAMPLE - 1 Condition : Sales network cannot access marketing network Others can access marketing network / /8 Router(config)# access-list 101 deny ip Router(config)#access-list 15 permit ip any any Router(config)#int ethernet2 Router(config-if)#access-group 101 out

E XAMPLE - 2 Condition : Human resource department can only access human resources server located on Lab_B router. Others are not allowed. Lab_b(config)#access-list 110 permit ip Lab_b(config)#access-list 110 ip deny any any Lab_b(config)#int ethernet0 Lab_b(config-if)#access-group 110 out

E XAMPLE - 3 Internet Conditions Network cannot access FTP Service on internet, others can access. Host and cannot access network Router(config)#access-list 110 deny tcp any eq 21 Router(config)#access-list 110 permit tcp any any Router(config)#int serial 0 Router(config-if)#access-group 10 out Router(config)# access-list 111 deny ip host Router(config)# access-list 111 deny ip host Router(config)#access-list 111 permit ip any any Router(config)#int Ethernet 3 Router(config-if)#access-group 111 out

Another way to create standard and extended access lists. Allows the use of descriptive names to ease network management. Syntax changes: Lab_A(config)#ip access-list standard BlockSales Lab_A(config-std-nacl)#deny Lab_A(config-std-nacl)#permit any N AMED A CCESS - LIST

Display all access lists & their parameters show access-list Show only the parameters for the access list 110 show access-list 110 Shows only the IP access lists configured show ip access-list Shows which interfaces have access lists set show ip interface Shows the access lists & which interfaces have access lists set show running-config M ONITORING IP ACCESS - LIST