Access control lists

Access control lists

1. An ACL is a series of IOS commands that control whether a router forwards or discards packets based on the information in the packet header.

2. ACL Operation

   • ACLs perform the following tasks
     • Limit network traffic to increase network performance
     • Provide traffic flow control
     • Provide a basic level of security for network access
     • Filter traffic based on traffic type
     • Screen hosts to permit or deny access to network services
   • Packet Filtering
     • ACL is a sequential list
       • permit
         • statements
       • deny
   • ACL Operation
     • Inbound ACLs
       • Incoming packets are processed before they are routed to the outbound interface.
     • Outbound ACLs
       • Incoming packets are routed to the outbound interface, and then they are processed through the outbound AC

3. Standard IPv4 ACLs

   • Configure standard IPv4 ACLs
     • Numbered Standard IPv4 ACL Syntax
       • Router(config)# access-list access-list-number { deny | permit | remark } source [ source-wildcard ][ log ]
       • To use numbered standard ACLs on a Cisco router, you must first create the standard ACL and then activate the ACL on an interface.
     • Applying Standard IPv4 ACLs to Interfaces
   • Modify IPv4 ACLs
     • Method 1 - Use a Text Editor
     • Method 2 - Use Sequence Numbers
     • Editing Standard Named ACLs
     • Verifying ACLs
     • ACL Statistics
       • After an ACL has been applied to an interface and some testing has occurred, the show access-lists command will show statistics for each statement that has been matched.
   • Security VTY ports with a standard IPv4 ACL
     • The access-class Command
       • The access-class command configured in line configuration mode restricts incoming and outgoing connections between a particular VTY (into a Cisco device) and the addresses in an access list.
     • Verifying the VTY Port is Secured
       • After the ACL to restrict access to the VTY lines is configured, it is important to verify that it is working as expected.

4. Troubleshoot ACLs

   • Processing packets with ACLs
     • The Implicit Deny Any
       • A single-entry ACL with only one deny entry has the effect of denying all traffic. At least one permit ACE must be configured in an ACL or all traffic is blocked.
     • The Order of ACEs in an ACL
       • Cisco IOS applies an internal logic when accepting and processing standard ACEs
     • Cisco IOS Reorders Standard ACLs
       • The order in which standard ACEs are entered may not be the order that they are stored, displayed, or processed by the router.
     • Routing Processes and ACLs
       • The figure shows the logic of routing and ACL processes.
   • Common IPv4 standard ACL error
     • Using the show commands described earlier reveals most of the more common ACL errors.

Bilder und Dateien der Mindmap