Access Control Lists-Network+

Access control lists (ACLs) are mechanisms available on different network devices (e.g., routers, switches, firewalls, servers, etc.) and are used to restrict access based on a series of parameters:

Source MAC address
Destination MAC address
Source IP address
Destination IP address
Port numbers or services
Time of day

ACLs allow you to assign permissions to a particular object in order to restrict access on the network or within a specific network area. One common way of restricting network access in wireless environments is based on the MAC address (this is also known as MAC filtering). One downside to this approach is that the devices you want to restrict access to must be on your local subnet; otherwise, the Layer 2 addresses will be irrelevant (i.e., they are unknown).

ACLs on Cisco Devices

Cisco devices are commonly used in modern networks so we will analyze the way ACLs are implemented in these solutions and also provide a few examples. Although we are presenting a few things that are particular to Cisco IOS, the general concepts are valid for all network equipment providers.

The three main types of ACLs available in Cisco IOS are as follows:

Standard numbered
Extended numbered
Standard or extended named

Standard numbered ACLs are the most basic form of ACL you can apply to a router. While they are the easiest to configure, they have the most limited range of filters available. They can only filter based on the source IP address or network. The way to recognize a standard ACL is by the number that precedes the configuration lines, which will be from 1 to 99 (there is an expanded range of 1300 to 1999).

Extended numbered ACLs allow far more granularity but they can be trickier to configure and troubleshoot. They can filter a destination or source IP address or network, a protocol type, and a port number. The numbers you can use to configure extended ACLs are 100 to 199, inclusive (there is an expanded range of 2000 to 2699).

Named ACLs allow you to associate a list of filters with a name rather than a number. This makes them easier to identify in router configurations. Named ACLs can actually be either extended or standard; you choose which at the initial configuration line of the ACL.

The most important ACL rules include the following:

Use only one ACL per interface per direction
The lines are processed top-down
There is an implicit “deny all” at the bottom of every ACL
The router cannot filter self-generated traffic
You can reuse the same ACL on multiple interfaces

Wildcard masks are essential to understand when configuring ACLs because they are used as part of the command line configuration in ACLs. They exist because there has to be a way to tell the router which parts of an IP address or network address you want to match.

This matching is performed at the binary level, but you can easily configure wildcard masks using the same notation you use for subnet masks. A binary 1 tells the router to ignore the digit and a 0 means to match the digit.

The easy way to perform wildcard masking is simply to ensure that you add a number to the subnet mask that will give you a total of 255. For example, if your subnet mask in one octet was 192, you would add 63 for a total of 255. If it was 255, you would add 0. Take a look at the examples below:

Subnet	255	255	255	192
Wildcard	0	0	0	63
Equals	255	255	255	255

Subnet	255	255	224	0
Wildcard	0	0	31	255
Equals	255	255	255	255

Subnet	255	128	0	0
Wildcard	0	127	255	255
Equals	255	255	255	255

You need to enter a wildcard mask if you want your ACL to match a subnet or an entire network. For example, if you wanted to match 172.20.1.0 255.255.224.0, you would enter the following:

Router(config)#access-list 1 permit 172.20.1.0 0.0.31.255

Matching subnet 192.200.1.0 255.255.255.192 would require the following:

Router(config)#access-list 1 permit 192.200.1.0 0.0.0.63

The same principle applies when you have a network with two host bits, as you will need to enter an ACL to match these. For example, matching subnet 192.168.1.0 255.255.255.252 or /30, you will need to enter the following:

Router(config)#access-list 1 permit 192.168.1.0 0.0.0.3

This will match hosts 1 and 2 on the 192.168.1.0 network. If you wanted to match hosts 5 and 6 on the 192.168.1.4/30 network, you would enter the following:

Router(config)#access-list 1 permit 192.168.1.4 0.0.0.3

Standard ACLs

Standard numbered ACLs are the easiest to configure, so this is the best place to start. Standard ACLs can only filter based on a source network or IP address. The ACL would permit or deny this source address:

Router(config)#access-list 1 permit host 172.16.1.1

Router(config)#access-list 1 permit host 192.168.1.1

Router(config)#access-list 1 permit 10.1.0.0 0.0.255.255

The ACL above (numbered 1) will permit traffic coming from two hosts (172.16.1.1 and 192.168.1.1), as well as traffic coming from the 10.1.0.0/16 network. Remember that there will be an implicit “deny all” at the end of this list, so all other traffic will be blocked.

Extended ACLs

Far more granularity is built into extended numbered ACLs; however, this makes them trickier to configure. You can filter source or destination networks, ports, protocols, and services. Generally, you can look at the configuration syntax for extended ACLs, as follows:

access list # permit/deny {service/protocol} {source network/IP} {source port#}{destination network/IP} {destination port#}

An extended ACL example, featuring e-mail, file servers, and Web, would be as follows:

access-list 100 permit tcp host 172.16.1.1 host 172.20.1.1 eq smtp

access-list 100 permit tcp 10.1.0.0 0.0.255.255 host 172.30.1.1 eq ftp

access-list 100 permit tcp host 192.168.1.1 host 172.40.1.1 eq www

ACL 100 above permits SMTP traffic going from 172.16.1.1 to 172.20.1.1, FTP traffic going from 10.1.0.0/16 to 172.30.1.1, and Web traffic going from 192.168.1.1 to 172.40.1.1.

Or, it could be as follows:

access-list 102 permit tcp any host 172.30.1.1 eq ftp established

The [established] keyword tells the router only to permit the traffic if it was originated by hosts on the inside. The three-way handshake flags (ACK or RST bit) will indicate this.

Named ACLs

Unlike numbered ACLs, named ACLs can be easily identified based on their descriptive name, and this is useful especially in large configurations. These ACLs were introduced to add flexibility and ease of management. Named ACLs can be considered more of a configuration enhancement, as they do not modify the core ACL structure (they just modify the way we refer to an ACL).

The syntax is similar to the numbered ACLs case, with the major difference of using names instead of numbers to identify ACLs. Just like in the case with numbered ACLs, you can configure standard or extended named ACLs.

Another difference when configuring named ACLs is that you always have to use the ip access-list command, unlike the case with numbered ACLs, where you could also use the simple access-list command.

Router(config)#access-list ?

<1-99> IP standard access list

<100-199> IP extended access list

<1100-1199> Extended 48-bit MAC address access list

<1300-1999> IP standard access list (expanded range)

<200-299> Protocol type-code access list

<2000-2699> IP extended access list (expanded range)

<700-799> 48-bit MAC address access list

dynamic-extended Extend the dynamic ACL absolute timer

rate-limit Simple rate-limit specific access list

Router(config)#ip access-list ?

extended Extended Access List

log-update Control access list log updates

logging Control access list logging

resequence Resequence Access List

standard Standard Access List

R1(config)#ip access-list standard ?

<1-99> Standard IP access-list number

<1300-1999> Standard IP access-list number (expanded range)

WORD Access-list name

R1(config)#ip access-list extended ?

<100-199> Extended IP access-list number

<2000-2699> Extended IP access-list number (expanded range)

WORD Access-list name

Named ACLs have a slightly different syntax than the other types of ACLs do (i.e., standard numbered and extended numbered). You can also edit live named ACLs (and numbered in the latest IOS releases), which is a useful feature. You simply need to tell the router that you want to configure a named ACL, and whether you want it to be standard or extended.

When creating a named ACL using the ip access-list command, Cisco IOS will place you in the ACL configuration mode where you can enter or remove ACL entries (i.e., denied or permitted access conditions).

Router(config)#ip access-list extended BlockWEB

Router(config-ext-nacl)#?

Ext Access List configuration commands:

<1-2147483647> Sequence Number

default Set a command to its defaults

deny Specify packets to reject

dynamic Specify a DYNAMIC list of PERMITs or DENYs

evaluate Evaluate an access list

exit Exit from access-list configuration mode

no Negate a command or set its defaults

permit Specify packets to forward

remark Access list entry comment

Router(config-ext-nacl)#deny tcp any any eq 80

Router(config-ext-nacl)#permit ip any any

Named ACL verification can be performed using the following commands:

show ip access-lists: shows all ACLs created on the device
show ip access-lists <acl_name>: shows a particular named ACL

Router(config)#do show ip access-lists

Standard IP access list test

30 permit 10.1.1.1

20 permit 192.168.1.1

15 permit 172.20.1.1

10 permit 172.16.1.1

Applying ACLs

To come into effect, you must apply your ACL to an interface either in the incoming (in) or outgoing (out) direction. This is performed using the ip access-group command.

Router(config)#int fast0/0

Router(config-if)#ip access-group 101 in

Router(config-if)#ip access-group 102 out

ACL Sequence Numbers

With IOS 12.4 onward, you can see that Cisco IOS adds sequence numbers to each ACL entry. Now you can create an ACL and then remove a line from it.

Router(config)#ip access-list standard test

Router(config-std-nacl)#permit 172.16.1.1

Router(config-std-nacl)#permit 192.168.1.1

Router(config-std-nacl)#permit 10.1.1.1

Router(config-std-nacl)#

Router(config-std-nacl)#exit

Router(config)#exit

Router#

*Jun 6 07:38:14.155: %SYS-5-CONFIG_I: Configured from console by consolep access

Router#show ip access-lists