View
28
Download
2
Category
Tags:
Preview:
DESCRIPTION
Year 2 - Chapter 6/Cisco 3 - Module 6 ACLs. Objectives. Define and describe the purpose and operation of ACLs Explain the processes involved in testing packets with ACLs Describe ACL configuration commands, global statements, and interface commands - PowerPoint PPT Presentation
Citation preview
Year 2 - Chapter 6/Cisco 3 - Module 6
ACLs
Objectives Define and describe the purpose and operation of
ACLs Explain the processes involved in testing packets
with ACLs Describe ACL configuration commands, global
statements, and interface commands Define and explain the function and operation of
wildcard masks bits and the wildcards any and host Describe standard ACLs Describe extended ACLs Describe named ACLs Monitor and verify selected ACL operations on the
router
What Are ACLs?
Lists of instructions you apply to a router's interface. Tell the router what kinds of packets to accept and what
kinds to deny based on criteria defined in the ACL.
Cisco ACLs support all routed network protocols (IP, IPX). Each protocol must have its own ACLs.
Definition Of ACL
ACLs are lists of instructions you apply to a router's interface. These lists tell the router what kinds of packets to accept and what
kinds of packets to deny. Acceptance and denial can be based on certain specifications, such
as source address, destination address, Traffic Direction, and port number.
ACL in then applied to a router interface. Any traffic going through the interface is tested against certain
conditions that are part of the ACL. ACLs must be defined on a per-protocol basis. If your router interface
were configured for IP, AppleTalk, and IPX, you would need to define at least three ACLs.
Key Features of the Cisco Access Lists1. Packets can be filtered as they enter an interface, before
the routing decision.2. Packets can be filtered before they exit an interface, after
the routing decision.3. Deny is the term used in the Cisco IOS software to imply
that the packet will be filtered.4. Permit is the term used in the Cisco IOS software to imply
that the packet will not be filtered.5. The filtering logic is configured in the access list
statements. 6. At the end of every access list is an implied “deny all
traffic” statement. Therefore if a packet does not mach any of your access list statements, it is blocked.
Steps in ACL logic Two major steps: Matching, and Action.
Matching based on a criteria such as source IP address, destination IP address, and application port number.
Action is either permit or deny. Step 1: The matching parameters of the first
access-list statement are compared to the packet.
Step 2: If a match is mad, the action defined in the access-list statement is performed.
If a match is not made in step 2, steps 1, and 2 are repeated using the next sequential access-list statement.
If no match is maid with any entry in the access list, the deny action is performed.
Locations Where ACL logic Can be Applied In The Network
What needs to be filtered?
Which Router?
Which Port?
Which Direction?
Communication between Bob and Server 1:Packets from Bob enter S1.Packets to Bob, exit S1
How an Outbound ACL Works
Testing Packets With ACLs
The order in which you place ACL statements is important. When the router is deciding whether to forward or block a packet, the Cisco Internetwork Operating System (IOS) software tests the packet against each condition statement, in the order in which the statements were created.
After a match is found, no more condition statements are checked. If all the ACL statements are unmatched, an implicit "deny any"
statement is imposed. If you need additional statements, in a standard or extended ACL you
must delete the ACL and re-create it with the new condition statements. You can create an ACL for each protocol you want to filter for each
router interface. For some protocols, you create one ACL to filter inbound traffic, and one ACL to filter outbound traffic. (one ACL per protocol, per port, per direction.)
Flowchart of the ACL Test Matching Process
ACL lines are processed sequentially (top-down).
When a criteria is matched, the packet is permitted or denied and no other testing occurs on that packet.
If no ACL test matches, the packet it is denied by default.
Inbound ACLs VS. Outbound ACLs
Outbound ACLs are generally more efficient than inbound, and are therefore preferred.
A router with an inbound ACL must check every packet to see whether it matches the ACL condition before switching the packet to an outbound interface.
Inbound access lists are dangerous because all the packets coming are examined and could be filtered including IGRP updates. Outbound ACLs are less dangerous because the router will not filter packets originating on that router.
The Purpose and Function of Wilde Card Mask
ACLs use wildcard masking to identify a single or multiple addresses for permit or deny tests.
A wildcard mask is a 32-bit quantity that is divided into four octets, with each octet containing 8 bits. A wildcard mask bit 0 means "check the corresponding bit value" and a wildcard mask bit 1 means "do not check (ignore) that corresponding bit value“
A wildcard mask is paired with an IP address. The numbers one and zero are used to identify how to treat the corresponding IP address bits.
ACLs define the portion of the IP address that should be examined.
Wildcard Mask Bits #1Router#config t Router(config)#access-list 50 deny 192.168.1.0 0.0.0.255Router(config)#access-list 50 permit anyRouter(config)#interface Ethernet0Router(config-if)#ip address 192.168.5.1 255.255.255.0Router(config-if)#ip access-group 50 out
Although maybe not a perfect explanation, it is often easiest to see wildcard masks as being just the opposite of subnet masks. The subnet mask 255.255.255.0 identifies the network, the wildcard mask 0.0.0.255 identifies the hosts.
A subnet mask is a 32-bit value made up of contiguous 1s and then 0s.
A wildcard is a 32-bit value made up of contiguous 0s indicating a “must match” and then 1s.
In the above example, the 0s mean the first 3 octets must match exactly. The 255 means any value from 0 to 255 can be here.
Both actually occur in binary and can often be understood only in binary.
Wildcard Mask Bits #2
Wildcard Masks
Subnet Mask VS. Wilde Card Mask
Subnet Mask = 255.255.240.0 = 11111111.11111111.11110000.00000000 Wildcard Mask = 0.0.15.255 00000000.00000000.00001111.11111111
The first 4 binary bits of the third octet has to match the same value
In this example, the address 172.30.16.0 with the wildcard mask 0.0.15.255 matches subnets 172.30.16.0 to 172.30.31.0. The wildcard mask does not match any other subnets.
WildCard Host
Instead of using this:
Router(config)# access-list 1 permit 172.30.16.29 0.0.0.0
you can use this: Router(config)# access-list 1 permit host 172.30.16.29
Wild Card Any
Permitting any IP address with any subnet mask
Router(config)# access-list 1 permit 0.0.0.0 255.255.255.255
or Router(config)# access-list 1 permit any
Implicit Deny Any Statement
• By default, an interface will allow all traffic in both directions.
• Once an ACL is applied, the default state switches to deny all traffic in the direction of the ACL (in or out).
– Many ACLs end with access-list # permit any to avoid the implied deny any.
Router(config)#access-list 75 deny host 192.168.1.10Router(config)#access-list 75 deny 192.168.17.123Router(config)#access-list 75 permit any
Permit and Deny Statements
Except in special circumstances, every ACL must have at least one permit statement. An ACL made up of only deny statements
combined with the implicit deny any statement will block all traffic in the direction of the ACL.
Criteria is limited to source network address only. Can identify a host, subnet, or network Denies or permits all traffic from the target
address for the protocol Necessary to place close to the destination
Standard ACLs
Standard ACLs Example #1
This one-line ACL will allow into each LAN only packets from the other LAN, not from the cloud.
The implicit deny any blocks any other traffic.
Standard ACLs Example #2
This two-line ACL will deny traffic from a single host A from getting to the X network.
The second line could and should have been access-list 1 permit any.
The implicit deny any is negated by the previous line, which allowed every thing through.
A
Network X
Standard ACLs Example #3
This two-line ACL will deny traffic from the entire 172.16.4.0 network.
The second line allows any traffic from the cloud.
The implicit deny any is negated by the permit any line, which allowed everything else through.
Standard ACLs
You use standard ACLs when you want to block all traffic from a network, allow all traffic from a specific network, or deny protocol suites. Standard ACLs check the source address of packets that could be routed.
The result permits or denies output for an entire protocol suite , based on the network, subnet, and host addresses.
packets coming in E0 are checked for source address and protocol.
Standard ACL Example
The following example of a standard ACL allows access for hosts on a three specified networks and a specific Host:
Step # 1 = Creating The Standard ACL:
access-list 1 permit 192.5.34.0 0.0.0.255 access-list 1 permit 128.88.0.0 0.0.255.255 access-list 1 permit 36.0.0.0 0.255.255.255 access-list 1 permit 202.48.192.3 0.0.0.0 !(Note:all other access implicitly denied)
Applying Standard ACLs to a Router’s Port The ip access-group command groups
an existing ACL to an interface. Remember that only one ACL per port per
protocol per direction is allowed. The format of the command is: Router(config-if)#ip access-group access-list-number {in | out}
ACL Commands
Sam is not allowed access to Bugs and Daffy
Hosts on router S Ethernet are not allowed access to hosts in router Y Ethernet.
Standard ACLs Practice Problems Labs
Recommended