Access Control Lists Written by Bill Reed 03/11/05

Access Control Lists Written by Bill Reed 03/11/05 During this presentation we will: Discuss the usage for ACLs in our networks Look at the syntax of the ACL commands Examine the application of our ACLs Explore the mechanisms behind the wild card mask Test our understanding with some exercises

Access Control Lists Written by Bill Reed 03/11/05 ACL usage ACLs are used to regulate traffic that can traverse our networks This can be for security reasons such as limiting access to restricted network segments and the systems within them ACLs can also be used to filter routing protocol updates on segments where they are unnecessary or undesirable

Access Control Lists Written by Bill Reed 03/11/05 ACL command syntax Access-list 101 Condition = permit or deny Protocol = IP, ICMP, TCP, UDP Source IP & WCM = Dest IP & WCM = Port / Service = 80 or HTTP, 21 or FTP

Access Control Lists Written by Bill Reed 03/11/05 ACL application rules Access control lists are all about matching Access control lists are applied in the order that they are written Once an ACLs parameters are matched the ACLs condition is applied There is an unseen entry created whenever an ACL is compiled called the explicit deny rule The explicit deny acts as a catch all at the end of the ACL ACLs have restrictions regarding editing

Access Control Lists Written by Bill Reed 03/11/05 Wild Card Masks The basic rules for WCMs are very simple 0 = must match 1 = I don’t care By comparing the individual bits of our WCM with the addresses of the traffic passing through the interface the WCM tries to match the mask with the address

Access Control Lists Written by Bill Reed 03/11/05 Wild Card Masks Address in packet = Address in ACL = Wild card mask = = must match 1 = I don’t care

Access Control Lists Written by Bill Reed 03/11/05 Wild Card Masks WCMs can also specify ranges of addresses and individual addresses Range based WCMs are built on contiguous ones in our binary masks 1, 3, 7, 15, 31, 63 are all acceptable values for our range statements in the WCM The basic rules still apply 0 = Must match, 1 = I don’t care

Access Control Lists Written by Bill Reed 03/11/05 Wild Card Masks Given a mask of = Remember 1 means I don’t care Any combination of values in the least significant 2 bits will match the ACL I.e.: 00 / 01 / 10 / 11 This leads to an octet value of anything between 0 & 3 matching the ACL and the condition being applied

Access Control Lists Written by Bill Reed 03/11/05 Wild Card Masks 7 = values between 0 & 7 will match 15 = values between 0 & 15 will match 31 = values between 0 & 31 will match What will a WCM of match when applied to an address of ?

Access Control Lists Written by Bill Reed 03/11/05 Wild Card Masks Once our ACL is written we only need to apply it to the interface and specify the direction that traffic will be interrogated We use the command ip access-group and the number of the ACL to apply the command to the interface On the end of the ACL command statement we specify the direction with the key word in or out

Access Control Lists Written by Bill Reed 03/11/05 Exercise