1. Chabot College
ELEC 99.08
Access Control Lists - Introduction

2. ACL Topics Function of ACLs ACL Types & Syntax Wildcard Bitmasks
Placement of ACLs
Commands

3. Typical Functions
Security
Firewalling

4. Types
Standard
Extended

5. Standard ACLs
Use rules based only the packet’s source address
1-99

6. Extended ACLs
Provide more precise (finer tuned) packet selection based on:
Source and destination addresses
Protocols
Port numbers

7. Steps to Configure ACLs
1) Create ACL (global config mode)
The list may contain many rules, each on one line.
The list is identified by a number or name.
2) Apply to an interface (interface config mode)

8. How do ACLs work?
Processing occurs line by line from top to bottom of the list.
Each line tests a packet for a “match”.
If there is a match, a “permit” or “deny” rule is applied.
When a “match” occurs, no further rules are checked.
Invisible last line of an ACL is an implicit “deny any.”

9. How do ACLs work? ACL example: oak#sh ru oak#...
oak#access-list 10 deny
oak#access-list 10 permit any
oak#access-list 10 deny any (implicit)

10. How does a Standard ACL work?
Permits or denies if source IP address is matched:
Permit – packet is allowed
Deny – packet is dropped
Implicit Deny – If a packet’s address does not match an earlier statement, an implicit deny any occurs at the end of every ACL and the packet is dropped.

11. The network address to be matched
Wildcard Masks
Are used to specify (by bits) the part of the ip address to be matched.
Looks like a subnet mask but it its not!
Example:
The network address to be matched
The wildcard bitmask

12. Wildcard Masks Specify the part of the ip address to be matched.
Use 0s to match,1s to ignore. (Reverse of subnet masks!)
In the example below, only the 1st 2 octets will be examined for a match:
Match this part of the address
This is the wildcard bitmask

13. Wildcard Masks 172.16.0.0 0.0.255.255 172 16 Address 10101100 00010000
address to match
wildcard bitmask
172 16
Address
Wildcard Mask
255
255
Check for a match
Ignore

14. Wildcard Masks
In this example, which octets will be examined for a match?

15. Match this part of the address
Wildcard Masks
In this example, which octets will be examined for a match?
The first 3:
Match this part of the address

16. Wildcard Masks
In this example, which octets will be examined for a match?

17. Wildcard Masks
In this example, which octets will be examined for a match?
All 4 octets:
Match the entire address (permit or deny this specific host)

18. Wildcard Masks
In Cisco 2, we will work only with wildcard bitmasks that are 0 or 255 for an entire octet.
In Cisco 3, you’ll work with masks where the change from 0 to 1 does not fall on an octet boundary:
e.g

19. Keyword: “any” Identical statements
access-list 22 permit
access-list 22 permit any

20. Keyword: “host” Identical statements
Access-list 23 permit
Access-list 23 permit host

21. Standard IP ACL command
access-list ACL-number {permit |deny} source-ip-address wildcard-mask
ACL number: 1-99
Global Config mode

22. Standard ACL Example
To permit all packets from the network number
access-list 20 permit

23. Standard ACL Example To permit traffic from the host 172.16.1.1 only
access-list 20 permit OR
access-list 20 permit host

24. Standard ACL Example To permit traffic from any source address.
access-list 20 permit OR
access-list 20 permit any

25. How does an Extended ACL work?
Permits or denies if all conditions match:
Source Address
Destination Address
Protocol
Port No. or Protocol Options

26. Extended IP ACL command
access-list ACL-number {permit|deny} protocol source-ip-address source-wildcard-mask destination-ip-address destination-wildcard-mask eq port-number
ACL number:
Global Config mode

27. Extended ACL Example
To permit traffic from the network to the host only on telnet:
access-list 101 permit tcp eq telnet
More about extended ACLs later...

28. Major differences Standard ACL Extended ACL Use only source address
Requires fewer CPU cycles.
Place as close to destination as possible. (because they can only check source address)
Extended ACL
Uses source, destination, protocol, port
Requires more CPU cycles.
Place as close to source as possible. (This stops undesired traffic early.)

29. Command to apply IP ACL ip access-group ACL-number {in |out}
Interface Config mode
The group of rules in the list is applied to the interface being configured.
Use “in” and “out” as if looking at the interface from inside the router.

30. Do I place an ACL in? In Coming into the router.
Requires less CPU processing because every packet bypasses processing before it is routed.
Filtering decision is made prior to the routing table.

31. Do I place an ACL out? Out Going out of the router.
Routing decision has been made and the packet is switched to the proper outbound interface before it is tested against the access list.
ACLs are outbound unless otherwise specified.

32. ACL Configuration Example
What will this list do?
oak(config)#access-list 10 permit
oak(config)#access-list 10 permit
oak(config)#int e0
oak(config-if)#ip-access group 10 out
oak(config-if)#^z S1 S1
fre S0
hay
oak S0 E0 E0 E0

33. ACL Configuration Example
What’s the problem here?
oak(config)#access-list 10 permit any
oak(config)#access-list 10 deny
oak(config)#int e0
oak(config-if)#ip-access group 10 out
oak(config-if)#^z S1 S1
fre S0
hay
oak S0 E0 E0 E0

34. Commands to show ACLs show access-lists show ip interface
Privileged exec mode
Displays the ACLs on the router.
show ip interface
Shows which ACLs are set on that interface.