Chapter 13: Implementing Access Control Lists

Whenever the need arises to interconnect two or more networks, a router is always the preferred choice, simply because the primary function of a router is to forward packets between networks. However, the Cisco IOS router has many more features aside from simply forwarding. One major feature is to filter traffic based on its source and destination. This feature simply enables the Cisco IOS router to perform packet filtering in a similar fashion to a firewall appliance on the network.

Throughout this chapter, you will learn how Access Control Lists (ACLs) can be applied to a Cisco IOS router to filter both inbound and outbound traffic. Furthermore, you will discover the various types of ACLs and how they can be used in various situations to allow or deny traffic between networks.

In this chapter, we will cover the following topics:

• What are ACLs?
• ACL operation
• ACL wildcard masks
• Working with standard ACLs
• Working...

Technical requirements

To follow along with the exercises in this chapter, please ensure that you have met the following hardware and software requirement:

• Cisco Packet Tracer

The code files for this chapter are available at https://github.com/PacktPublishing/Implementing-and-Administering-Cisco-Solutions/tree/master/Chapter%2013.

Check out the following video to see the Code in Action:https://bit.ly/3cqh8JX

What are ACLs?

As you have learned so far, routers are used to forward traffic between different networks. As a packet enters an inbound interface of a router, the operating system has to read the Layer 3 header information, such as the source and destination IP addresses, and check the routing table for a suitable route. Once a route has been found, the router forwards the packet through an outbound interface to its destination. Ensuring that all users are able to send and receive messages is excellent in terms of connectivity, but what do security and the restriction of traffic flow between certain networks mean?

The Cisco IOS router has many amazing features and can perform a variety of roles on a network. One such feature is to perform traffic filtering between networks. This is done using a very special method that firewall appliances use to filter traffic, known as an ACL.

Important note

Firewall appliances use a variety of methods to filter inbound and outbound traffic...

ACL operation

ACLs are rules created by a network professional on the router or firewall appliance to filter traffic either entering or leaving the device. ACLs are a list of security rules, with each ACL containing either a permit or deny statement. Each statement within an ACL is referred to as an Access Control Entry (ACE). These ACEs are the real workers that allow and block packets between networks. When a router receives packets on an interface, the router checks each ACE, starting with the first entry at the top of the list and moving down until a match is found. Once a matching ACE is found, the router stops searching and executes the rule on the ACE, either permitting or denying the traffic. This process is known as packet filtering.

Important note

If no matches are found in the ACLs, the packet is discarded by the router. The last ACE within all ACLs is an implicit deny statement. An implicit deny statement simply states that if no matches are found in the previous...

ACL wildcard masks

When creating an ACE, you may need to specify a network ID and the subnet mask. However, within ACLs and ACEs, you cannot use a subnet mask as Cisco IOS on the router was not built or designed to accept subnet masks as part of an ACE. ACLs use a wildcard mask, which is a 32-bit binary string used by the Cisco IOS router to determine which bits within the address to match and which bits to ignore.

As with a subnet mask, ones and zeroes are used to indicate the network and host portions of an IP address. For example, the ones within a subnet mask are used to identify the network portion of an address, while the zeroes are used to identify the host portion. Within a wildcard mask, these bits are used for a different purpose. Here, the ones and zeroes are used to filter either a group of addresses or a single IP address to decide whether to permit or deny access to a network resource.

In a wildcard mask, the zeroes are used to match the corresponding bit value...

Working with standard ACLs

When creating a numbered standard ACL on a Cisco IOS router, the ACL must first be created on the device and then applied to an interface to filter traffic. Numbered standard ACLs use the following range of numbers:

• 1 to 99
• 1300 to 1999

To create a numbered standard ACL on a Cisco IOS router, use the global configuration command followed by a number within the range of 1 to 99 or 1300 to 1999 on the device. Therefore, with this range of numbers, there can be up to 798 unique standard ACLs on a single router.

Creating a numbered standard ACL

The following is the full syntax used to create a numbered standard ACL:

Router(config)# access-list access-list-number [ deny | permit | remark ] source [ source-wildcard ][ log ]

The remark command will allow you to insert a description for the ACL and the log command will generate a Syslog message when matches are found. Additionally, there can be more than one ACE within an ACL.

The...

Working with extended ACLs

Extended ACLs are sometimes the preferred choice as they allow you to filter specific traffic types compared to standard ACLs. Extended ACLs use the following range of numbers:

• 100 to 199
• 2000 to 2699

To create a numbered extended ACL on a Cisco IOS router, use the global configuration access-lists command, followed by a number within the range of 100 to 199 or 2000 to 2699 on the device.

Creating a numbered extended ACL

The following is the full syntax used to create a numbered extended ACL:

Router(config)# access-list access-list-number [ deny | permit | remark ] protocol [source source-wildcard] [operator port] [port-number or name] [destination destination-wildcard] [operator port] [port-number or name]

The following is a description of the new syntax used within an extended ACL:

• protocol: Specifies the protocol type, such as IP, ICMP, TCP, and UDP.
• operator: Used to compare the source or destination ports....

Summary

Throughout this chapter, we've discussed the roles and functions that ACLs play on an enterprise network. We also dived into discussing the operations of ACLs on a Cisco IOS router and how they are applied to an interface. Lastly, we covered both standard and extended ACLs and how they can be used in various situations.

Having completed this chapter, you have learned how to configure both standard and extended ACLs on a Cisco router. Furthermore, you have learned how ACLs function and filter traffic based on their ACEs.

I hope this chapter has been informative for you and that it will prove helpful in your journey toward learning how to implement and administrate Cisco solutions and prepare for the CCNA 200-301 certification. In the next chapter, Chapter 14, Implementing Layer 2 and Wireless Security, you will learn about various Layer 2 attacks and how to implement mitigation techniques and countermeasures.

Questions

The following is a short list of review questions to help reinforce your learning and help you identify areas that may require some improvement:

1. Which type of ACL allows you to filter Telnet traffic?

   A. Inbound

   B. Outbound

   C. Standard

   D. Extended

2. Which type of ACL allows you to filter traffic based on its origin?

   A. Outbound

   B. Standard

   C. Inbound

   D. Extended

3. If a packet does not match any ACEs within an ACL, what will the router do?

   A. Allow the packet.

   B. Return the packet to the sender.

   C. Drop the packet.

   D. Do nothing.

4. An inbound ACL has which of the following characteristics?

   A. It filters traffic as it enters a router.

   B. It filters traffic before it leaves a router.

   C. It stops a router from performing a route lookup.

   D. It filters traffic after it leaves a router.

5. Which command can be used to verify the direction in which an ACL is filtering traffic?

   A. show access-lists

   B. show access control lists

   C. show interface

   D. show ip interface

6. Which of the following...

Further reading

The following links are recommended for additional reading:

• Configuring IP access lists: https://www.cisco.com/c/en/us/support/docs/security/ios-firewall/23602-confaccesslists.html
• Commonly used IP ACLs: https://www.cisco.com/c/en/us/support/docs/ip/access-lists/26448-ACLsamples.html
• Access list commands: https://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/asr9k_r4-0/addr_serv/command/reference/ir40asrbook_chapter1.html