ACLs

ACLs

1. Standard numbered (1-99, 1300-1999)

   • Standard ACLs match: -Source IP 
   • Standard numbered IP ACLs use the following global command: access-list {1-99 | 1300-1999} {permit | deny} matching-parameters Each standard numbered ACL has one or more access-list commands with the same number.

2. Extended numbered (100-199, 2000-2699)

   • Extended ACLs match: -Source & Dest. IP -Source & Dest. Port -Others
   • Extended IP Access List Configuration Commands: access-list access-list-number {deny | permit} protocol source source-wildcard destination destination-wildcard [log | log-input] access-list access-list-number {deny | permit} {tcp | udp} source source-wildcard [operator [port]] destination destination-wildcard [operator [port]] [established] [log]

3. Named ACLs

4. IPv6 ACLs

   • Similarities between IPv4 and IPv6: -Both match on the source address or the destination address in the protocol header. -Both match individual host addresses or subnets/prefixes. -Both can be applied directionally (inbound and outbound) to a router's interface. -Both can match on transport layer protocol information such as TCP or UDP source or destination port numbers. -Both can match on specific ICMP message types and codes. -Both have an implicit deny statement at the end of the ACL, that matches all remaining packets. -Both support time ranges for time-based ACLs.
   • Differences between IPv4 and IPv6: -IPv4 ACLs can only match IPv4 packets and IPv6 ACLs can only match IPv6 packets. -IPv4 ACLs can be identified by number or name, while IPv6 ACLs use names only. -IPv4 ACLs identify that an ACL is either standard or extended based on the ACL number range or by using the standard or extended keyword. IPv6 ACLs have a similar standard and extended ACL concept, but do not differentiate the styles with a different configuration keyword. -IPv4 ACLs can match on specific values unique to an IPv4 header (e.g., option, precedence, ToS, TTL, fragments). -IPv6 ACLs can match on specific values unique to an IPv6 header (e.g., flow label, DSCP) as well as extension and option header values. -IPv6 ACLs have some implicit permit statements at the end of each ACL, just before the implicit deny all at the end of the ACL, while IPv4 ACLs do not have implicit permit statements.
   • Implicit IPv6 ACL commands deny ipv6 any any
   • The following mentions some values that IPv6 ACLs on IOS routers can match in an IPv6 packet: -Traffic class (e.g., DSCP, 0 to 63) -Flow label (0 to 1048575) -IPv6 Next Header field indicating extension header type/number -Source and destination 128-bit IPv6 addresses. -Upper-layer header details: TCP or UDP port numbers, TCP flags SYN, ACK, FIN, PUSH, URG, RST. -ICMPv6  type and code -IPv6 extension header value and type (hop-by-hop headers, routing headers, fragmentation headers, IPsec, destination options, among others)
   • ipv6 access-list name To apply an ACL to an interface use the ipv6 traffic-filter name in|out interface subcommand