Learn Computer Networking PNETLab - Network Security with Access Control List (ACL)

#Introduction

A network already running with routing and redundancy still needs one thing: control over who is allowed to talk to whom. Episode 15 discusses the most basic and most frequently used control tool in Cisco IOS: the Access Control List (ACL).

An ACL is a list of rules that permit or deny packets based on specific fields. Although simple, ACLs are the foundation of the NAT in episode 16 and of enterprise firewalls. You will understand how ACL evaluation works, its two main types, and build an extended named ACL applied directly in PNETLab.

#The Packet Filtering Concept with ACLs

#Top-Down Evaluation and Implicit Deny

An ACL is evaluated line by line from the top. A packet is checked against each rule in turn; the first matching rule is executed immediately, and the following rules are no longer considered. At the end of every ACL there is a hidden implicit deny any: if no rule matches, the packet is automatically denied.

Two important consequences of this behavior: rule order strongly determines the result, and any ACL that permits something must end with a permit ip any any so other traffic can still pass.

#ACL Classification in Cisco IOS

#Standard ACL vs Extended ACL

• Standard ACL (numbers 1-99 or 1300-1999): only checks the source IP address. Because it cannot see the destination, its best placement is close to the destination so it does not block unnecessary traffic.
• Extended ACL (numbers 100-199 or 2000-2699): checks source IP, destination IP, protocol (TCP, UDP, ICMP), and port number. Because it is more specific, its best placement is close to the source so denied packets do not waste bandwidth along the way.

#Extended Named ACL Configuration

#Blocking Web Access

Lab scenario: the department in VLAN 10 must not open the internal web server 10.0.0.50. Build a named extended ACL on router R1:

configure terminal
ip access-list extended BLOCK_WEB
 deny tcp 192.168.10.0 0.0.0.255 host 10.0.0.50 eq 80
 deny tcp 192.168.10.0 0.0.0.255 host 10.0.0.50 eq 443
 permit ip any any
exit

deny tcp 192.168.10.0 0.0.0.255 host 10.0.0.50 eq 80 denies TCP traffic from the VLAN 10 subnet toward host 10.0.0.50 with destination port 80, and the second line denies port 443 (HTTPS). The permit ip any any line ensures other traffic keeps flowing.

#Applying an ACL on Interfaces and VTY Lines

#ip access-group on an Interface

An ACL is not active until it is applied to an interface with the in or out direction:

configure terminal
interface g0/0
 ip access-group BLOCK_WEB in
exit

ip access-group BLOCK_WEB in applies the ACL to traffic entering interface g0/0. The in direction checks packets before the router processes them, while out checks packets about to leave the interface.

#access-class on a VTY Line

An ACL can also restrict who is allowed to log in over SSH. Create an ACL to allow only one subnet to manage the router:

configure terminal
ip access-list standard MANAGE
 permit 10.0.0.0 0.0.0.255
exit
line vty 0 4
 access-class MANAGE in
exit

access-class MANAGE in on the vty line ensures that only sources from 10.0.0.0/24 can open a remote session to the router.

#Verifying and Testing the ACL

#Viewing the Hit Count

After applying the ACL, check whether the rules are really executed:

R1# show access-lists BLOCK_WEB
Extended IP access list BLOCK_WEB
    deny tcp 192.168.10.0 0.0.0.255 host 10.0.0.50 eq www (6 matches)
    deny tcp 192.168.10.0 0.0.0.255 host 10.0.0.50 eq 443 (2 matches)
    permit ip any any (124 matches)

show access-lists displays the hit count of each rule. From a PC console in VLAN 10, try opening http://10.0.0.50 — the request is denied, while ping keeps working because of the permit ip any any line.

#Common ACL Mistakes

The two most frequent mistakes: putting permit ip any any at the beginning of the ACL so all packets are permitted before reaching the deny rules, and forgetting that the interface direction determines which side of a packet is checked. Always remember the top-down order, and always verify with show access-lists before drawing conclusions.

#Closing

Key takeaways:

• ACLs are evaluated top-down with an implicit deny any at the end of the list.
• A standard ACL only sees the source; an extended ACL sees protocol and port.
• Standard ACLs close to the destination; extended ACLs close to the source.
• An extended named ACL uses deny tcp <source> host <dest> eq <port>.
• ip access-group on interfaces; access-class on vty lines.
• show access-lists displays hit counts for verification.

In the next episode, episode 16, we discuss Network Address Translation (NAT): the need to conserve public IPs, the difference between static NAT, dynamic NAT, and PAT overload, configuring NAT overload on a Cisco Router for internet access, and verifying with show ip nat translations and statistics.