2-ch11_ACLintro

7/29/2019 2-ch11_ACLintro

1/34

CISCO NETWORKING ACADEMY

Chabot College

ELEC 99.08

Access Control Lists - Introduction


2/34


ACL Topics

Function of ACLs

ACL Types & Syntax

Wildcard Bitmasks

Placement of ACLs

Commands


3/34


Typical Functions

Security

Firewalling


4/34


Types

Standard

Extended


5/34


Standard ACLs

Use rules based only the packets

source address

1-99


6/34


Extended ACLs

Provide more precise (finer tuned)

packet selection based on:

Source and destination addresses

Protocols

Port numbers

100-199


7/34CISCO NETWORKING ACADEMY

Steps to Configure ACLs

1) Create ACL (global config mode) The list may contain many rules, each on one line.

The list is identified by a number or name.

2) Apply to an interface (interface config mode)



How do ACLs work?

Processing occurs line by line from top to

bottom of the list.

Each line tests a packet for a match. If there is a match, a permit or deny

rule is applied.

When a match occurs, no further rulesare checked.

Invisible last line of an ACL is an implicit

deny any.



How do ACLs work?

ACL example:

oak#sh ru

oak#...

oak#access-list 10 deny 192.168.1.0 0.0.0.255

oak#access-list 10 permit any

oak#access-list 10 deny any (implicit)

oak#...



How does a Standard ACL

work? Permits or denies if source IP address

is matched:

Permit packet is allowed

Deny packet is dropped

Implicit DenyIf a packets address does

not match an earlier statement, an implicitdeny any occurs at the end of every ACLand the packet is dropped.



Wildcard Masks

Are used to specify (by bits) the part of

the ip address to be matched.

Looks like a subnet mask but it its not!

Example:

172.16.0.0 0.0.255.255

The network address to be matched The wildcard bitmask



Wildcard Masks

Specify the part of the ip address to be

matched.

Use 0s to match,1s to ignore.(Reverse of subnet masks!)

In the example below, only the 1st

2 octets will be examined for a match:172.16.0.0 0.0.255.255

Match this part of the address This is the wildcard bitmask



Wildcard Masks

10101100 00010000 00000000 00000000172 16 0 0Address

WildcardMask

11111111

Ignore

1111111100000000

2552550 0

Check fora match

00000000

172.16.0.0 0.0.255.255wildcard bitmaskaddress to match



Wildcard Masks

In this example, which octets will be

examined for a match?

172.16.5.0 0.0.0.255



Wildcard Masks



172.16.5.0 0.0.0.255

The first 3:

172.16.5.0 0.0.0.255

Match this part of the address



Wildcard Masks



172.16.5.2 0.0.0.0



Wildcard Masks



172.16.5.2 0.0.0.0

All 4 octets:

172.16.5.2 0.0.0.0

Match the entire address(permit or deny this specific host)



Wildcard Masks

In Cisco 2, we will work only with

wildcard bitmasks that are 0 or 255 for

an entire octet. In Cisco 3, youll work with masks

where the change from 0 to 1 does not

fall on an octet boundary: e.g. 0.0.15.255



Keyword: any

Identical statements

access-list 22 permit 0.0.0.0 255.255.255.255

access-list 22 permit any



Keyword: host

Identical statements

Access-list 23 permit 172.16.1.1 0.0.0.0

Access-list 23 permit host 172.16.1.1



Standard IP ACL command

access-listACL-number{permit |deny}source-ip-addresswildcard-mask

ACL number: 1-99 Global Config mode



Standard ACL Example

To permit all packets from the network

number 172.16.0.0



23/34



To permit traffic from the host

172.16.1.1 only

access-list 20 permit 172.16.1.1 0.0.0.0OR

access-list 20 permit host 172.16.1.1


24/34



To permit traffic from any source address.


OR

access-list 20 permit any


25/34


How does an Extended ACL

work? Permits or denies if all conditions match:

Source Address

Destination Address

Protocol

Port No. or Protocol Options


26/34


Extended IP ACL command

access-listACL-number{permit|deny}protocol source-ip-address source-wildcard-

mask destination-ip-addressdestination-wildcard-maskeqport-number

ACL number: 100-199

Global Config mode


27/34


Extended ACL Example

To permit traffic from the network 192.168.1.0 to

the host 192.168.3.10 only on telnet:

access-list 101 permit tcp 192.168.1.0 0.0.0.255

192.168.3.10 0.0.0.0 eq telnet

More about extended ACLs later...


28/34


Major differences

Standard ACL

Use only source address

Requires fewer CPU cycles. Place as close to destination as possible.

(because they can only check source address)

Extended ACL

Uses source, destination, protocol, port

Requires more CPU cycles.

Place as close to source as possible.

(This stops undesired traffic early.)


29/34


Command to apply IP ACL

ip access-groupACL-number{in |out}

Interface Config mode

The group of rules in the list is applied to theinterface being configured.

Use in and out as if looking at the interface

from inside the router.


30/34


Do I place an ACL in?

In

Coming into the router.

Requires less CPU processing becauseevery packet bypasses processing before

it is routed.

Filtering decision is made prior to therouting table.


31/34


Do I place an ACL out?

Out

Going out of the router.

Routing decision has been made and thepacket is switched to the proper outbound

interface before it is tested against theaccess list.

ACLs are outbound unless otherwise

specified.


32/34


ACL Configuration Example

oak(config)#access-list 10 permit 192.168.1.0 0.0.0.255

oak(config)#access-list 10 permit 192.168.2.10 0.0.0.0

oak(config)#int e0oak(config-if)#ip-access group 10 out

oak(config-if)#^z

fre

hay

oak

192.168.3.0

E0

S0

S1S0

S1

What will this list do?

E0E0

192.168.2.0

192.168.1.0

192.168.1.10 192.168.2.10 192.168.3.10


33/34


ACL Configuration Example

oak(config)#access-list 10 permit any

oak(config)#access-list 10 deny 192.168.2.10 0.0.0.0

oak(config)#int e0oak(config-if)#ip-access group 10 out

oak(config-if)#^z

fre

hay

oak

192.168.3.0

E0

S0

S1S0

S1

Whats the problem here?

E0E0

192.168.2.0

192.168.1.0

192.168.1.10 192.168.2.10 192.168.3.10


34/34

Commands to show ACLs

show access-lists

Privileged exec mode

Displays the ACLs on the router.show ip interface

Privileged exec mode

Shows which ACLs are set on that interface.

Date post:	04-Apr-2018
Category:	Documents
Upload:	florea-dan-mihai
View:	215 times
Download:	0 times

2-ch11_ACLintro

Documents