CISCO NETWORKING ACADEMY Chabot College ELEC Access Control Lists - Introduction

CISCO NETWORKING ACADEMY ACL Topics Function of ACLs ACL Types & Syntax Wildcard Bitmasks Placement of ACLs Commands

CISCO NETWORKING ACADEMY Typical Functions Security Firewalling

CISCO NETWORKING ACADEMY Types Standard Extended

CISCO NETWORKING ACADEMY Standard ACLs Use rules based only the packet’s source address 1-99

CISCO NETWORKING ACADEMY Extended ACLs Provide more precise (finer tuned) packet selection based on: –Source and destination addresses –Protocols –Port numbers

CISCO NETWORKING ACADEMY Steps to Configure ACLs 1) Create ACL (global config mode) –The list may contain many rules, each on one line. –The list is identified by a number or name. 2) Apply to an interface (interface config mode)

CISCO NETWORKING ACADEMY How do ACLs work? Processing occurs line by line from top to bottom of the list. Each line tests a packet for a “match”. If there is a match, a “permit” or “deny” rule is applied. When a “match” occurs, no further rules are checked. Invisible last line of an ACL is an implicit “deny any.”

CISCO NETWORKING ACADEMY How do ACLs work? ACL example: oak#sh ru oak#... oak#access-list 10 deny oak#access-list 10 permit any oak#access-list 10 deny any (implicit) oak#...

CISCO NETWORKING ACADEMY How does a Standard ACL work? Permits or denies if source IP address is matched: –Permit – packet is allowed –Deny – packet is dropped –Implicit Deny – If a packet’s address does not match an earlier statement, an implicit deny any occurs at the end of every ACL and the packet is dropped.

CISCO NETWORKING ACADEMY Wildcard Masks Are used to specify (by bits) the part of the ip address to be matched. Looks like a subnet mask but it its not! Example: The network address to be matchedThe wildcard bitmask

CISCO NETWORKING ACADEMY Wildcard Masks Specify the part of the ip address to be matched. Use 0s to match,1s to ignore. (Reverse of subnet masks!) In the example below, only the 1 st 2 octets will be examined for a match: Match this part of the addressThis is the wildcard bitmask

CISCO NETWORKING ACADEMY Wildcard Masks Address Wildcard Mask Ignore Check for a match wildcard bitmaskaddress to match

CISCO NETWORKING ACADEMY Wildcard Masks In this example, which octets will be examined for a match?

CISCO NETWORKING ACADEMY Wildcard Masks In this example, which octets will be examined for a match? The first 3: Match this part of the address

CISCO NETWORKING ACADEMY Wildcard Masks In this example, which octets will be examined for a match?

CISCO NETWORKING ACADEMY Wildcard Masks In this example, which octets will be examined for a match? All 4 octets: Match the entire address (permit or deny this specific host)

CISCO NETWORKING ACADEMY Wildcard Masks In Cisco 2, we will work only with wildcard bitmasks that are 0 or 255 for an entire octet. In Cisco 3, you’ll work with masks where the change from 0 to 1 does not fall on an octet boundary: –e.g

CISCO NETWORKING ACADEMY Keyword: “any” Identical statements –access-list 22 permit –access-list 22 permit any

CISCO NETWORKING ACADEMY Keyword: “host” Identical statements –Access-list 23 permit –Access-list 23 permit host

CISCO NETWORKING ACADEMY Standard IP ACL command access-list ACL-number {permit |deny} source-ip-address wildcard-mask ACL number: 1-99 Global Config mode

CISCO NETWORKING ACADEMY Standard ACL Example To permit all packets from the network number access-list 20 permit

CISCO NETWORKING ACADEMY Standard ACL Example To permit traffic from the host only access-list 20 permit OR access-list 20 permit host

CISCO NETWORKING ACADEMY Standard ACL Example To permit traffic from any source address. access-list 20 permit OR access-list 20 permit any

CISCO NETWORKING ACADEMY How does an Extended ACL work? Permits or denies if all conditions match: –Source Address –Destination Address –Protocol –Port No. or Protocol Options

CISCO NETWORKING ACADEMY Extended IP ACL command access-list ACL-number {permit|deny} protocol source-ip-address source-wildcard- mask destination-ip-address destination- wildcard-mask eq port-number ACL number: Global Config mode

CISCO NETWORKING ACADEMY Extended ACL Example To permit traffic from the network to the host only on telnet: access-list 101 permit tcp eq telnet More about extended ACLs later...

CISCO NETWORKING ACADEMY Major differences Standard ACL –Use only source address –Requires fewer CPU cycles. –Place as close to destination as possible. (because they can only check source address) Extended ACL –Uses source, destination, protocol, port –Requires more CPU cycles. –Place as close to source as possible. (This stops undesired traffic early.)

CISCO NETWORKING ACADEMY Command to apply IP ACL ip access-group ACL-number {in |out} Interface Config mode The group of rules in the list is applied to the interface being configured. Use “in” and “out” as if looking at the interface from inside the router.

CISCO NETWORKING ACADEMY Do I place an ACL in? In –Coming into the router. –Requires less CPU processing because every packet bypasses processing before it is routed. –Filtering decision is made prior to the routing table.

CISCO NETWORKING ACADEMY Do I place an ACL out? Out –Going out of the router. –Routing decision has been made and the packet is switched to the proper outbound interface before it is tested against the access list. –ACLs are outbound unless otherwise specified.

CISCO NETWORKING ACADEMY ACL Configuration Example oak(config)#access-list 10 permit oak(config)#access-list 10 permit oak(config)#int e0 oak(config-if)#ip-access group 10 out oak(config-if)#^z fre hayoak E0 S0 S1 S0 S1 What will this list do? E

CISCO NETWORKING ACADEMY ACL Configuration Example oak(config)#access-list 10 permit any oak(config)#access-list 10 deny oak(config)#int e0 oak(config-if)#ip-access group 10 out oak(config-if)#^z fre hayoak E0 S0 S1 S0 S1 What’s the problem here? E

CISCO NETWORKING ACADEMY Commands to show ACLs show access-lists Privileged exec mode Displays the ACLs on the router. show ip interface Privileged exec mode Shows which ACLs are set on that interface.