Tracking Rejected Traffic

 When creating Cisco router access lists, one of the greatest downfalls of the log keyword is that it only records matches to the rule in question.  If the rule is a permit rule, you lose the profoundly important information about which packets are being denied.  To track the traffic that is being filtered by an implicit deny, add a "deny any" ACL with the log keyword to the bottom of the list in question.  Functionally, the deny any log command does the same thing as the assumed implicit deny, but it facilitates the logging of denied traffic.

Tracking Rejected Traffic  One good application of this concept is to track abnormal traffic that is being filtered by the implicit deny at the end of an egress filter access list.  Using this method allows a means to track all outbound traffic that has a source address other than that of your network.  This is a great way to keep a handle on any strange things that might be trying to sneak out of your network! Here is a simple example of how you would tell the router to log blocked traffic: access-list 11 deny any log

Filtering by Port and Destination Address: The Cisco Extended ACL  The Cisco extended ACL offers additional features that allow more control of network traffic flow.  Instead of only being able to filter on source address, we have the additional flexibility of destination address filtering, filtering based on protocol type, filtering on specific layer 4 port number information, flags, and more.  With this additional granularity, the effectiveness of the Cisco router as a packet filter is greatly increased, making it viable for many security concerns. The extended access list syntax is as follows: access-list number or permit|deny protocol sourcesource-mask source-port destination destination-maskdestination port log|log-input options

Friendly Net Revisited  Using a standard ACL to allow access is a problem because the only thing we have control over is which IP address (or range) can access the entire inside network.  This means that not only can the host or range of hosts specified access any station on the inside, but it also can do so on any port number. This is not good.  Extended access lists can at least help tighten up that control. We can specify the destination host (or range) to which the host can connect, as well as the port on which they can communicate. This way, we can allow an outside trusted host to access our web server (only) on port 80 (only). Take a look at this example: access-list 111 permit tcp host gt 1023 host eq 80 log

Filtering TCP and UDP Ports and ICMP Types  Another handy function of the extended access list is the filtering of certain types of traffic.  You can control the types of traffic that leave your network, in effect enforcing your security policy.  You can allow or disallow certain types of traffic that enter your network.  Denying traffic to a list of popular Trojan program ports or to ports that programs use that conflict with your Internet usage or security policies (IRC, Kazaa, instant messaging programs, and so on) can also be an extra layer of defense.  It makes more sense to only allow what you need. A more common use of port filtering is allowing traffic types that can enter or leave your network. For a list of mission-critical ports that any environment should consider defending, see Appendix A of the SANS Top 20 Vulnerabilities, available at Ahttp://

Filtering TCP and UDP Ports and ICMP Types  Another use for this type of filtering is to allow or disallow certain informative ICMP messages entrance to your network.  ICMP is one of the most exploited of the protocols. It is being used for reconnaissance, denial of service attacks (such as smurf), and more.  It is recommended that you block incoming echo requests (ping and Windows traceroute), block any outgoing echo replies, and block time exceeded, for maximum security.  All the ICMP traffic types can be blocked with extended ACLs. The use of any ICMP blocking filters could affect network traffic control.

Filtering TCP and UDP Ports and ICMP Types  ICMP doesn't work like the other protocols. Instead of having port numbers, it uses type and code identifiers.  It is basically set up to send error messages for protocols that can't (such as UDP and IP) and to send informational messages (such as router error messages telling that a host is unreachable).  ICMP is used by popular end-to-end troubleshooting utilities such as ping and traceroute.  ICMP can be controlled by using Cisco access lists with special ICMP keywords or ICMP type numbers, instead of port numbers such as TCP and UDP access lists.

Filtering TCP and UDP Ports and ICMP Types  To block ICMP echo requests, we could use a line in an extended access list such as this: 1.router(config)#access-list 111 deny icmp any any echo-request 2.router(config)#access-list 111 permit icmp any any packet-too-big 3.router(config)#access-list 111 deny icmp any any