© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 1 Version 4.0 Access Control Lists Accessing the WAN – Chapter 5.

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 2 Objectives  Explain how ACLs are used to secure a medium-size Enterprise branch office network.  Configure standard ACLs in a medium-size Enterprise branch office network.  Configure extended ACLs in a medium-size Enterprise branch office network.  Describe complex ACLs in a medium-size Enterprise branch office network.  Implement, verify and troubleshoot ACLs in an enterprise network environment.

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 3 Explain How ACLs are Used to Secure a Medium-Size Enterprise Branch Office Network  Describe the steps that occur in a complete TCP conversation

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 5 Explain How ACLs are Used to Secure a Medium-Size Enterprise Branch Office Network  Describe how ACLs control access to networks Access Control Lists (ACLs) give networkers the ability to control (permit or deny) any type of traffic on their networks.

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 7 Explain How ACLs are Used to Secure a Medium-Size Enterprise Branch Office Network  Use a flow chart to show how ACLs operate When traffic is referred to as inbound or outbound, students need to imagine that they are inside the router observing the traffic. If the packets are getting closer to them, it is inbound. If the packets are getting further from them, it is outbound.

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 8 Explain How ACLs are Used to Secure a Medium-Size Enterprise Branch Office Network When traffic is referred to as inbound or outbound, students need to imagine that they are inside the router observing the traffic. If the packets are getting closer to them, it is inbound. If the packets are getting further from them, it is outbound.

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 10 Explain How ACLs are Used to Secure a Medium-Size Enterprise Branch Office Network  Explain how Cisco ACLs can be identified using standardized numbering or names

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 13 Configure Standard ACLs in a Medium- Size Enterprise Branch Office Network  Explain why the order in which criteria statements are entered into an ACL is important

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 21 Configure Standard ACLs in a Medium- Size Enterprise Branch Office Network  Explain how to create a named ACL Named ACLs can be used as an alternative to numbered ACLs in order to allow line by line editing of statements within the ACL. This is not possible in numbered ACLs. Named ACLs also allow administrators to quickly know the purpose of an ACL via the name used. When using named ACLs, each statement is numbered, which allows administrator to delete and add specific statements wherever they are needed in the ACL.

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 25 Configure Extended ACLs in a Medium- Size Enterprise Branch Office Network  Explain how an extended ACL provides more filtering then a standard ACL Through the use of Access Control Lists, network professionals can control the flow of traffic on their networks. Traffic can be either permitted or denied based upon criteria such as source and destination IP address, port number, and protocol.

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 30 Dynamic ACLs  Lock-and-key is a traffic filtering security feature that uses dynamic ACLs, which are sometimes referred to as lock-and-key ACLs. –Dynamic ACLs are dependent on Telnet connectivity, authentication (local or remote), and extended ACLs. –Dynamic ACL configuration starts with the application of an extended ACL to block traffic through the router. Users who want to traverse the router are blocked by the extended ACL until they use Telnet to connect to the router and are authenticated. –The Telnet connection is then dropped, and a single-entry dynamic ACL is added to the extended ACL that exists. –This permits traffic for a particular period; idle and absolute timeouts are possible.

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 31 Describe Complex ACLs in a Medium-Size Enterprise Branch Office Network  Explain how and when to use dynamic ACLs In the figure the user at PC1 is an administrator that requires a back door access to the 192.168.30.0 /24 network located on router R3. A dynamic ACL has been configured to allow FTP and HTTP on router R3 access but only for a limited time.

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 32 When to Use Dynamic ACLs  When to Use Dynamic ACLs –When you want a specific remote user or group of remote users to access a host within your network, connecting from their remote hosts via the Internet. –When you want a subset of hosts on a local network to access a host on a remote network that is protected by a firewall.  Benefits of Dynamic ACLs –Use of a challenge mechanism to authenticate individual users –Simplified management in large internetworks –In many cases, reduction of the amount of router processing that is required for ACLs –Reduction of the opportunity for network break-ins by network hackers –Creation of dynamic user access through a firewall, without compromising other configured security restrictions

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 33 What are Reflexive ACLs?  Network administrators use reflexive ACLs to allow IP traffic for sessions originating from their network while denying IP traffic for sessions originating outside the network. –The router examines the outbound traffic and when it sees a new connection, it adds an entry to a temporary ACL to allow replies back in. –Reflexive ACLs contain only temporary entries. –These entries are automatically created when a new IP session begins, for example, with an outbound packet, and the entries are automatically removed when the session ends.  Reflexive ACLs can be defined only with extended named IP ACLs. –They cannot be defined with numbered or standard named ACLs or with other protocol ACLs.

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 34 What are Reflexive ACLs?  Reflexive ACLs provide a truer form of session filtering than an extended ACL that uses the established parameter introduced earlier. –Although similar in concept to the established parameter, reflexive ACLs also work for UDP and ICMP, which have no ACK or RST bits. –The established option also does not work with applications that dynamically alter the source port for the session traffic. –The permit established statement only checks ACK and RST bits-not source and destination address.  Benefits of Reflexive ACLs: –Help secure your network against network hackers and can be included in a firewall defense. –Provide a level of security against spoofing and certain DoS attacks. For example, source and destination addresses and port numbers, not just ACK and RST bits, are checked. –Simple to use and, compared to basic ACLs, provide greater control over which packets enter your network.

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 35 Describe Complex ACLs in a Medium-Size Enterprise Branch Office Network  Reflexive ACL Example  The figure shows an example for which the administrator needs a reflexive ACL that permits ICMP outbound and inbound traffic, while it permits only TCP traffic that has been initiated from inside the network.  Assume that all other traffic will be denied.  The reflexive ACL is applied to the outbound interface of R2.  Although the complete configuration for reflexive ACLs is outside the scope of this course, the figure shows an example of the steps that are required to configure a reflexive ACL.

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 36 What are Time-based ACLs?  Time-based ACLs are similar to extended ACLs in function, but they allow for access control based on time. –To implement time-based ACLs, you create a time range that defines specific times of the day and week. –You identify the time range with a name and then refer to it by a function. The time restrictions are imposed on the function itself.  Time-based ACLs have many benefits: –Offers the network administrator more control over permitting or denying access to resources. –Allows network administrators to control logging messages. ACL entries can log traffic at certain times of the day, but not constantly. Therefore, administrators can simply deny access without analyzing the many logs that are generated during peak hours.

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 37 Time-Based ACLs  Time Based ACL Example –Although the complete configuration details for time-based ACLs are outside the scope of this course, the following example shows the steps that are required. –In the example, a Telnet connection is permitted from the inside network to the outside network on Monday, Wednesday, and Friday during business hours. –The time range relies on the router system clock. The feature works best with Network Time Protocol (NTP) synchronization, but the router clock can be used.  Step 1. Define the time range to implement the ACL and give it a name-EVERYOTHERDAY, in this case.  Step 2. Apply the time range to the ACL.  Step 3. Apply the ACL to the interface.

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 39 Implement, Verify and Troubleshoot ACLs in an Enterprise Network Environment  Create, place and verify a standard/ extended ACL and verify its placement.  Verify ACL’s functionality and troubleshoot as needed.

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 44 Summary  An Access List (ACL) is: A series of permit and deny statements that are used to filter traffic  Standard ACL –Identified by numbers 1 - 99 and 1300 - 1999 –Filter traffic based on source IP address  Extended ACL –Identified by number 100 -199 & 2000 - 2699 –Filter traffic based on Source IP address Destination IP address Protocol Port number

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 45 Summary  Named ACL –Used with IOS 11.2 and above –Can be used for either standard or extended ACL  ACL’s use Wildcard Masks (WCM) –Described as the inverse of a subnet mask Reason –0  check the bit –1  ignore the bit

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 46 Summary  Implementing ACLs –1 st create the ACL –2 nd place the ACL on an interface Standard ACL are placed nearest the destination Extended ACL are placed nearest the source  Use the following commands for verifying & troubleshooting an ACL –Show access-list –Show interfaces –Show run

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 1 Version 4.0 Access Control Lists Accessing the WAN – Chapter 5.

Similar presentations

Presentation on theme: "© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 1 Version 4.0 Access Control Lists Accessing the WAN – Chapter 5."— Presentation transcript:

Similar presentations

About project

Feedback

Log in

Auth with social network:

© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 1 Version 4.0 Access Control Lists Accessing the WAN – Chapter 5.

Similar presentations

Presentation on theme: "© 2006 Cisco Systems, Inc. All rights reserved.Cisco Public 1 Version 4.0 Access Control Lists Accessing the WAN – Chapter 5."— Presentation transcript:

Similar presentations

About project

Feedback