ACCES CONTROL LISTS

ACCES CONTROL LISTS

1. ACL OPERATIONS

   • PURPOSE OF ACLs
     • What is an ACL?
       • ACLs are among the most commonly used features of Cisco IOS software. When configured, ACLs perform the following tasks: -Limit network traffic to increase network performance. - Provide traffic flow control. - Provide a basic level of security for network access. - Filter traffic based on traffic type. - Screen hosts to permit or deny access to network services
     • Packet Filtering
       • An ACL is a sequential list of permit or deny statements, known as access control entries (ACEs). ACEs are also commonly called ACL statements.
     • ACL Operation
   • WILDCARD MASKS IN ACLS
     • Introducing ACL Wildcard Masking
       • Wildcard Masking IPv4 ACEs include the use of wildcard masks. A wildcard mask is a string of 32 binary digits used by the router to determine which bits of the address to examine for a match.
     • Wildcard Mask Examples
     • Calculating the Wildcard Mask
     • Wildcard Mask Keywords
       • Working with decimal representations of binary wildcard mask bits can be tedious. To simplify this task, the keywords host and any help identify the most common uses of wildcard masking.
   • GUIDELINES FOR ACL CREATIONS
     • General Guidelines for Creating ACLs
       • Writing ACLs can be a complex task. For every interface there may be multiple policies needed to manage the type of traffic allowed to enter or exit that interface. The router in the figure has two interfaces configured for IPv4 and IPv6
     • ACL Best Practices
   • GUIDELINE FOR ACL PLACEMENT
     • Where to Place ACLs
     • Standard ACL Placement
       • The topology in the figure is used to demonstration how a standard ACL can be placed. The administrator wants to prevent traffic originating in the 192.168.10.0/24 network from reaching the 192.168.30.0/24 network.

2. STANDARD IPV4 ACLs

   • CONFIGURE STANDARD IPV4 ACLs
     • Numbered Standard IPv4 ACL Syntax
     • Applying Standard IPv4 ACLs to Interfaces
       • After a standard IPv4 ACL is configured, it is linked to an interface using the ip access-group command in interface configuration mode: Router(config-if)# ip access-group { access-list-number | access-list-name } { in | out }
     • Numbered Standard IPv4 ACL Examples
     • Named Standard IPv4 ACL Syntax
       • Naming an ACL makes it easier to understand its function. When you identify your ACL with a name instead of with a number, the configuration mode and command syntax are slightly different.
   • MODIFY IPV4 ACLs
     • Method 1 - Use a Text Editor
     • Method 2 - Use Sequence Numbers
     • Editing Standard Named ACLs
       • In a previous example, sequence numbers were used to edit a standard numbered IPv4 ACL. By referring to the statement sequence numbers, individual statements can easily be inserted or deleted. This method can also be used to edit standard named ACLs.
     • Verifying ACLs
       • The show ip interface command is used to verify the ACL on the interface. The output from this command includes the number or name of the access list and the direction in which the ACL was applied.
     • ACL Statistics
       • ACL Statistics After an ACL has been applied to an interface and some testing has occurred, the show access-lists command will show statistics for each statement that has been matched.
   • SECURITY VTY PORTS WITH STANDARD IPV4 ACLs
     • The access-class Command
       • The command syntax of the access-class command is: Router(config-line)# access-class access-list-number { in [ vrf-also ] | out }
     • Verifying the VTY Port is Secured
       • After the ACL to restrict access to the VTY lines is configured, it is important to verify that it is working as expected.

3. TROUBLESHOOT ACLs

   • PROCESSING PACKETS WITH ACLs
     • The Implicit Deny Any
       • A single-entry ACL with only one deny entry has the effect of denying all traffic. At least one permit ACE must be configured in an ACL or all traffic is blocked.
     • The Order of ACEs in an ACL
       • Cisco IOS applies an internal logic when accepting and processing standard ACEs. As discussed previously, ACEs are processed sequentially; therefore, the order in which ACEs are entered is important.
     • Cisco IOS Reorders Standard ACLs
       • The order in which standard ACEs are entered may not be the order that they are stored, displayed, or processed by the router.
     • Routing Processes and ACLs
       • The figure shows the logic of routing and ACL processes. When a packet arrives at a router interface, the router process is the same, whether ACLs are used or not.
   • COMMON IPV4 STANDARD ACL ERRORS
     • Troubleshooting Standard IPv4 ACLs - Example 1
       • Using the show commands described earlier reveals most of the more common ACL errors. The most common errors are entering ACEs in the wrong order and not specifying adequate ACL rules.
     • Troubleshooting Standard IPv4 ACLs - Example 2
       • Security Policy: The 192.168.11.0/24 network should not be able to access the 192.168.10.0/24 network.

Imágenes y archivos del mapa