Filtering Traffic Using Access Control Lists

Introducing Routing and Switching in the Enterprise Chapter 8

Version 4.0

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

Objectives
Describe traffic filtering and explain how Access Control Lists (ACLs) can filter traffic at router interfaces. Analyze the use of wildcard masks. Configure and implement ACLs. Create and apply ACLs to control specific types of traffic. Log ACL activity and integrate ACL best practices.

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

Section 8.1 Using Access Control Lists

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

Key Ideas
Traffic filtering Defining Access Control Lists Types and uses of ACLs ACL processing

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

Describe Traffic Filtering

Analyze the contents of a packet Allow or block the packet Based on source IP, destination IP, MAC address, protocol, pp type yp application

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

Describe Traffic Filtering

Devices providing traffic filtering: Firewalls built into integrated routers Dedicated security appliances Servers

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

Describe Traffic Filtering

Uses for ACLs: Specify internal hosts for NAT Classify traffic for QoS Restrict routing updates updates, limit debug outputs outputs, control virtual terminal access

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

Describe Traffic Filtering

Standard ACLs filter based on source IP address Extended ACLs filter on source and destination, as well as protocol and port number Named N d ACL ACLs can be b either ith standard t d d or extended t d d

Activity 8.1.3[2]- Determine Standard, Extended or Name ACL

2006 Cisco Systems, Inc. All rights reserved. Cisco Public

Describe Traffic Filtering

ACLs consist of statements At A least l one statement must b be a permit i statement Final statement is an implicit deny ACL must tb be applied li d t to an i interface t f i in order d t to work k

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

Describe Traffic Filtering

ACL is applied inbound or outbound Direction is from the routers perspective Each interface can have one ACL per direction for each network protocol

Activity 8 8.1.4[3]-Determine 1 4[3] Determine whether packet permitted or deny

2006 Cisco Systems, Inc. All rights reserved. Cisco Public

10

Section 8.2 Using a Wildcard Mask

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

11

Key Ideas
The purpose and structure of an ACL wildcard mask The effects of a wildcard mask

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

12

Analyze the Use of Wildcard Masks

Wildcard mask can block a range of addresses or a whole network with one statement 0s indicate which part of an IP address must match the ACL 1s indicate which part does not have to match specifically

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

13

Analyze the Use of Wildcard Masks

Wildcard mask can block a range of addresses or a whole network with one statement 0s indicate which part of an IP address must match the ACL 1s indicate which part does not have to match specifically

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

14

Analyze the Use of Wildcard Masks

Wildcard mask can block a range of addresses or a whole network with one statement 0s indicate which part of an IP address must match the ACL 1s indicate which hich part does not have ha e to match specifically specificall

Activity 8.2.1[3]-Determine wildcard mask

2006 Cisco Systems, Inc. All rights reserved. Cisco Public

15

Analyze the Use of Wildcard Masks

Use the host parameter in place of a 0.0.0.0 wildcard Use the any parameter in place of a 255.255.255.255 wildcard

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

16

Analyze the Use of Wildcard Masks

Use the host parameter in place of a 0.0.0.0 wildcard Use the any parameter in place of a 255.255.255.255 wildcard

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

17

Analyze the Use of Wildcard Masks

Use the host parameter in place of a 0.0.0.0 wildcard Use the any parameter in place of a 255.255.255.255 wildcard

Activity 8.2.2[4]-Determine whether IP packet permit or deny

2006 Cisco Systems, Inc. All rights reserved. Cisco Public

18

Section 8.3 Configuring Access Control Lists

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

19

Key Ideas
Placing Standard and Extended ACLs Basic ACL configuration process Configuring numbered standard ACLs Configuring numbered extended ACLs Configuring named ACLs Configure router VTY access

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

20

Configure and Implement Access Control Lists

Determine traffic filtering requirements Decide which hich t type pe of ACL to use se Determine the router and interface on which to apply the ACL Determine in which direction to filter traffic

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

21

Configure and Implement Access Control Lists

Determine traffic filtering requirements Decide which hich t type pe of ACL to use se Determine the router and interface on which to apply the ACL Determine in which direction to filter traffic

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

22

Configure and Implement Access Control Lists

Determine traffic filtering requirements Decide which hich t type pe of ACL to use se Determine the router and interface on which to apply the ACL Determine in which direction to filter traffic

Activity 8.3.1[4]-Determine where to put ACL

2006 Cisco Systems, Inc. All rights reserved. Cisco Public

23

Configure and Implement Access Control Lists

ACL Processing and Creating Guidelines

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

24

Configure and Implement Access Control Lists: Numbered Standard ACL

Use access-list command to enter statements Use U th the same number b f for all ll statements t t t Number ranges: 1-99, 1300-1999 Apply as close to the destination as possible

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

25

Configure and Implement Access Control Lists: Numbered Standard ACL

Use access-list command to enter statements Use U th the same number b f for all ll statements t t t Number ranges: 1-99, 1300-1999 Apply as close to the destination as possible

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

26

Configure and Implement Access Control Lists: Numbered Standard ACL

Show ip interface Show Sh access-lists li t Show running-config

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

27

Configure and Implement Access Control Lists: Numbered Standard ACL

Show ip interface Show Sh access-lists li t Show running-config `

Activity 8.3.3[3]-the sequence ACL... Hands-on Lab 8.3.3[4]-Configuring And Verifying Standard ACL
2006 Cisco Systems, Inc. All rights reserved. Cisco Public

28

Configure and Implement Access Control Lists: Numbered Extended ACL

Use access-list command to enter statements Use the same number for all statements Number ranges: 100-199, 2000-2699 Specify a protocol to permit or deny Place as close to the source as possible

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

29

Configure and Implement Access Control Lists: Numbered Extended ACL

Use access-list command to enter statements Use the same number for all statements Number ranges: 100-199, 2000-2699 Specify a protocol to permit or deny Place as close to the source as possible

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

30

Configure and Implement Access Control Lists: Numbered Extended ACL

Use access-list command to enter statements Use the same number for all statements Number ranges:100-199 ranges:100 199,2000 2000-2699 2699 Specify a protocol to permit or deny Place as close to the source as possible p

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

31

Configure and Implement Access Control Lists: Numbered Extended ACL

Use access-list command to enter statements Use the same number for all statements Number ranges: 100-199, 2000-2699 Specify a protocol to permit or deny Place as close to the source as possible

Activity 8 8.3.4[3]-Determine 3 4[3]-Determine the ACL Hands-on Lab 8.3.4[4]-Planning, [ ] g, Configuring, and Verifying Extended ACLs
2006 Cisco Systems, Inc. All rights reserved. Cisco Public

32

Configure and Implement Access Control Lists: Named ACLs

Descriptive name replaces number range Use U ip i access-list li t command dt to enter t initial i iti l statement t t t Start succeeding statements with either permit or deny Apply in the same way as standard or extended ACL

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

33

Configure and Implement Access Control Lists: Named ACLs

Delete, Change, Insert ACL

PT Activity 8.3.5[3]-Configuring and Verifying Standards Named ACLs Hands-on Hands on Lab 8.3.5[4]8 3 5[4] Configuring Config ring and Verifying Verif ing StandardsNamed ACLs
2006 Cisco Systems, Inc. All rights reserved. Cisco Public

34

Configure and Implement Access Control Lists: VTY access

Create the ACL in line configuration mode Use U th the access-class l command dt to initiate i iti t th the ACL Use a numbered ACL Apply identical restrictions to all VTY lines

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

35

Configure and Implement Access Control Lists: VTY access

Create the ACL in line configuration mode Use U th the access-class l command dt to initiate i iti t th the ACL Use a numbered ACL Apply identical restrictions to all VTY lines

Hands-on Lab 8.3.6[3]-Configuring and Verifying VTY R t i ti Restrictions PT 8.3.6[4]-Planning, Configuring, and Verifying Standard, Extended and Named ACLs
2006 Cisco Systems, Inc. All rights reserved. Cisco Public

36

Section 8.4 Permitting and Denying Specific Types of Traffic

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

37

Key Ideas
Configuring ACLs for Application and Port Filtering Configuring ACLs to Support Established Traffic Effects of NAT and PAT on ACL Placement Analyzing Network ACLs and Placement Configuring ACLs with Inter Inter-VLAN VLAN Routing

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

38

Create and Apply ACLs to Control Specific Types of Traffic

Use a specified condition when filtering on port numbers: eq, lt, lt gt t Deny all appropriate ports for multi-port applications like FTP Use U th the range operator t to t filter filt a group of f ports t

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

39

Create and Apply ACLs to Control Specific Types of Traffic

Use a specified condition when filtering on port numbers: eq, lt, lt gt t Deny all appropriate ports for multi-port applications like FTP Use U th the range operator t to t filter filt a group of f ports t

PT Activity A ti it 8.4.1[3]-Configuring 8 4 1[3] C fi i and d Verifying V if i Extended E t d d ACLs to filter on Port Numbers
2006 Cisco Systems, Inc. All rights reserved. Cisco Public

40

Create and Apply ACLs to Control Specific Types of Traffic

Block harmful external traffic while allowing internal users free access Ping: allow echo replies while denying echo requests from outside the network Stateful Packet Inspection

Activity 8.4.2[2]-Determine if the Packet will be allowed

2006 Cisco Systems, Inc. All rights reserved. Cisco Public

41

Create and Apply ACLs to Control Specific Types of Traffic

Account for NAT when creating and applying ACLs to a NAT interface Filter public addresses on a NAT outside interface Filter private addresses on a NAT inside interface

Hands-on Lab 8.4.3[2]-Configuring an ACL with NAT

2006 Cisco Systems, Inc. All rights reserved. Cisco Public

42

Create and Apply ACLs to Control Specific Types of Traffic

Examine every ACL one line at a time to avoid unintended consequences

A ti it 8.4.4[2]-Create Activity 8 4 4[2] C t an extended t d d ACL b based d on th the

2006 Cisco Systems, Inc. All rights reserved. Cisco Public

43

Create and Apply ACLs to Control Specific Types of Traffic

Apply ACLs to VLAN interfaces or subinterfaces just as with physical h i li interfaces t f

Hands-on Lab 8.4.5[2]-Configuring and Verifying ACLs to filter Inter-VLAN Traffic PT Activity 8.4.5[3]-Configuring and Verifying Extended ACLs with a DMZ
2006 Cisco Systems, Inc. All rights reserved. Cisco Public

44

Section 8.5 Filtering Traffic Using Access Control Lists

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

45

Key Ideas
Using logging to verify ACLs Analyzing routing logs ACL best practices

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

46

Log ACL Activity and ACL Best Practices

Logging provides additional details on packets denied or permitted itt d Add the log option to the end of each ACL statement to be tracked

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

47

Log ACL Activity and ACL Best Practices

Logging provides additional details on packets denied or permitted itt d Add the log option to the end of each ACL statement to be tracked

Hands-on Lab 8.5.1[3]-Configuring ACLs and Verifying with Console Logg ing
2006 Cisco Systems, Inc. All rights reserved. Cisco Public

48

Log ACL Activity and ACL Best Practices

Syslog messages: Status of router interfaces ACL messages Bandwidth, Bandwidth protocols in use use, configuration events

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

49

Log ACL Activity and ACL Best Practices

Syslog messages: Status of router interfaces ACL messages Bandwidth, Bandwidth protocols in use use, configuration events

Hands-on Lab 8.5.2[3]-Configuring ACLs and Recording Activity to a Syslog Server

2006 Cisco Systems, Inc. All rights reserved. Cisco Public

50

Log ACL Activity and ACL Best Practices

Always test basic connectivity before applying ACLs Add deny ip any to the end of an ACL when logging Use reload in 30 when testing ACLs on remote routers

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

51

Summary
ACLs enable traffic management and secure access to and from a network and its resources Apply an ACL to filter inbound or outbound traffic ACLs can be standard standard, extended extended, or named Using a wildcard mask provides flexibility There is an implicit deny statement at the end of an ACL Account for NAT when creating and applying ACLs Logging provides additional details on filtered traffic

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

52

 2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

53