CISCO NETWORKING ACADEMY Chabot College ELEC 99.08 Access Control Lists - Introduction.
-
Upload
cameron-matthews -
Category
Documents
-
view
222 -
download
1
Transcript of CISCO NETWORKING ACADEMY Chabot College ELEC 99.08 Access Control Lists - Introduction.
CISCO NETWORKING ACADEMYCISCO NETWORKING ACADEMY
Chabot CollegeChabot College
ELEC 99.08ELEC 99.08Access Control Lists - IntroductionAccess Control Lists - Introduction
CISCO NETWORKING ACADEMYCISCO NETWORKING ACADEMY
ACL TopicsACL Topics
• Function of ACLs
• ACL Types & Syntax
• Wildcard Bitmasks
• Placement of ACLs
• Commands
CISCO NETWORKING ACADEMYCISCO NETWORKING ACADEMY
Typical FunctionsTypical Functions
• Security
• Firewalling
CISCO NETWORKING ACADEMYCISCO NETWORKING ACADEMY
Standard ACLsStandard ACLs
• Use rules based only the packet’s source address
• 1-99
CISCO NETWORKING ACADEMYCISCO NETWORKING ACADEMY
Extended ACLsExtended ACLs
• Provide more precise (finer tuned) packet selection based on:– Source and destination addresses– Protocols– Port numbers
• 100-199
CISCO NETWORKING ACADEMYCISCO NETWORKING ACADEMY
Steps to Configure ACLsSteps to Configure ACLs
1) Create ACL (global config mode)– The list may contain many rules, each on one line.– The list is identified by a number or name.
2) Apply to an interface (interface config mode)
CISCO NETWORKING ACADEMYCISCO NETWORKING ACADEMY
How do ACLs work?How do ACLs work?
• Processing occurs line by line from top to bottom of the list.
• Each line tests a packet for a “match”.• If there is a match, a “permit” or “deny” rule is
applied.• When a “match” occurs, no further rules are
checked.• Invisible last line of an ACL is an implicit “deny
any.”
CISCO NETWORKING ACADEMYCISCO NETWORKING ACADEMY
How do ACLs work?How do ACLs work?
• ACL example:
oak#sh ruoak#... oak#access-list 10 deny 192.168.1.0 0.0.0.255 oak#access-list 10 permit any oak#access-list 10 deny any (implicit)oak#...
CISCO NETWORKING ACADEMYCISCO NETWORKING ACADEMY
How does a Standard ACL How does a Standard ACL work?work?• Permits or denies if source IP address
is matched:– Permit – packet is allowed – Deny – packet is dropped– Implicit Deny – If a packet’s address does
not match an earlier statement, an implicit deny any occurs at the end of every ACL and the packet is dropped.
CISCO NETWORKING ACADEMYCISCO NETWORKING ACADEMY
Wildcard MasksWildcard Masks
• Are used to specify (by bits) the part of the ip address to be matched.
• Looks like a subnet mask but it its not!
• Example:172.16.0.0 0.0.255.255
The network address to be matched The wildcard bitmask
CISCO NETWORKING ACADEMYCISCO NETWORKING ACADEMY
Wildcard MasksWildcard Masks
• Specify the part of the ip address to be matched.
• Use 0s to match,1s to ignore. (Reverse of subnet masks!)
• In the example below, only the 1st 2 octets will be examined for a match:172.16.0.0 0.0.255.255
Match this part of the address This is the wildcard bitmask
CISCO NETWORKING ACADEMYCISCO NETWORKING ACADEMY
Wildcard MasksWildcard Masks
10101100 00010000 00000000 00000000
172 16 0 0Address
Wildcard Mask
11111111
Ignore
1111111100000000
2552550 0
Check for a match
00000000
172.16.0.0 0.0.255.255wildcard bitmaskaddress to match
CISCO NETWORKING ACADEMYCISCO NETWORKING ACADEMY
Wildcard MasksWildcard Masks
• In this example, which octets will be examined for a match?172.16.5.0 0.0.0.255
CISCO NETWORKING ACADEMYCISCO NETWORKING ACADEMY
Wildcard MasksWildcard Masks
• In this example, which octets will be examined for a match?172.16.5.0 0.0.0.255
• The first 3:172.16.5.0 0.0.0.255
Match this part of the address
CISCO NETWORKING ACADEMYCISCO NETWORKING ACADEMY
Wildcard MasksWildcard Masks
• In this example, which octets will be examined for a match?172.16.5.2 0.0.0.0
CISCO NETWORKING ACADEMYCISCO NETWORKING ACADEMY
Wildcard MasksWildcard Masks
• In this example, which octets will be examined for a match?172.16.5.2 0.0.0.0
• All 4 octets:172.16.5.2 0.0.0.0
Match the entire address (permit or deny this specific host)
CISCO NETWORKING ACADEMYCISCO NETWORKING ACADEMY
Wildcard MasksWildcard Masks
• In Cisco 2, we will work only with wildcard bitmasks that are 0 or 255 for an entire octet.
• In Cisco 3, you’ll work with masks where the change from 0 to 1 does not fall on an octet boundary: – e.g. 0.0.15.255
CISCO NETWORKING ACADEMYCISCO NETWORKING ACADEMY
Keyword: “any”Keyword: “any”
• Identical statements – access-list 22 permit 0.0.0.0 255.255.255.255– access-list 22 permit any
CISCO NETWORKING ACADEMYCISCO NETWORKING ACADEMY
Keyword: “host”Keyword: “host”
• Identical statements– Access-list 23 permit 172.16.1.1 0.0.0.0– Access-list 23 permit host 172.16.1.1
CISCO NETWORKING ACADEMYCISCO NETWORKING ACADEMY
Standard IP ACL commandStandard IP ACL command
access-list ACL-number {permit |deny} source-ip-address wildcard-mask
• ACL number: 1-99• Global Config mode
CISCO NETWORKING ACADEMYCISCO NETWORKING ACADEMY
Standard ACL ExampleStandard ACL Example
• To permit all packets from the network number 172.16.0.0access-list 20 permit 172.16.0.0 0.0.255.255
CISCO NETWORKING ACADEMYCISCO NETWORKING ACADEMY
Standard ACL ExampleStandard ACL Example
• To permit traffic from the host 172.16.1.1 onlyaccess-list 20 permit 172.16.1.1 0.0.0.0
OR
access-list 20 permit host 172.16.1.1
CISCO NETWORKING ACADEMYCISCO NETWORKING ACADEMY
Standard ACL ExampleStandard ACL Example
• To permit traffic from any source address.access-list 20 permit 0.0.0.0 255.255.255.255
OR
access-list 20 permit any
CISCO NETWORKING ACADEMYCISCO NETWORKING ACADEMY
How does an Extended ACL How does an Extended ACL work?work?• Permits or denies if all conditions match:
– Source Address– Destination Address– Protocol– Port No. or Protocol Options
CISCO NETWORKING ACADEMYCISCO NETWORKING ACADEMY
Extended IP ACL commandExtended IP ACL command
access-list ACL-number {permit|deny} protocol source-ip-address source-wildcard-mask destination-ip-address destination-wildcard-mask eq port-number
• ACL number: 100-199• Global Config mode
CISCO NETWORKING ACADEMYCISCO NETWORKING ACADEMY
Extended ACL ExampleExtended ACL Example
• To permit traffic from the network 192.168.1.0 to the host 192.168.3.10 only on telnet:
access-list 101 permit tcp 192.168.1.0 0.0.0.255 192.168.3.10 0.0.0.0 eq telnet
• More about extended ACLs later...
CISCO NETWORKING ACADEMYCISCO NETWORKING ACADEMY
Major differencesMajor differences
• Standard ACL– Use only source address– Requires fewer CPU cycles.– Place as close to destination as possible.
(because they can only check source address)
• Extended ACL– Uses source, destination, protocol, port– Requires more CPU cycles.– Place as close to source as possible.
(This stops undesired traffic early.)
CISCO NETWORKING ACADEMYCISCO NETWORKING ACADEMY
Command to apply IP ACLCommand to apply IP ACL
ip access-group ACL-number {in |out}• Interface Config mode• The group of rules in the list is applied to the
interface being configured.• Use “in” and “out” as if looking at the interface
from inside the router.
CISCO NETWORKING ACADEMYCISCO NETWORKING ACADEMY
Do I place an ACL in?Do I place an ACL in?
• In – Coming into the router.– Requires less CPU processing because
every packet bypasses processing before it is routed.
– Filtering decision is made prior to the routing table.
CISCO NETWORKING ACADEMYCISCO NETWORKING ACADEMY
Do I place an ACL out?Do I place an ACL out?
• Out – Going out of the router.– Routing decision has been made and the
packet is switched to the proper outbound interface before it is tested against the access list.
– ACLs are outbound unless otherwise specified.
CISCO NETWORKING ACADEMYCISCO NETWORKING ACADEMY
ACL Configuration ExampleACL Configuration Example
oak(config)#access-list 10 permit 192.168.1.0 0.0.0.255oak(config)#access-list 10 permit 192.168.2.10 0.0.0.0oak(config)#int e0oak(config-if)#ip-access group 10 outoak(config-if)#^z
fre hay oak
192.168.3.0
E0S0
S1S0S1
What will this list do?
E0E0
192.168.2.0
192.168.1.0
192.168.1.10 192.168.2.10 192.168.3.10
CISCO NETWORKING ACADEMYCISCO NETWORKING ACADEMY
ACL Configuration ExampleACL Configuration Example
oak(config)#access-list 10 permit anyoak(config)#access-list 10 deny 192.168.2.10 0.0.0.0oak(config)#int e0oak(config-if)#ip-access group 10 outoak(config-if)#^z
fre hay oak
192.168.3.0
E0S0
S1S0S1
What’s the problem here?
E0E0
192.168.2.0
192.168.1.0
192.168.1.10 192.168.2.10 192.168.3.10