Please enable JavaScript.

Coggle requires JavaScript to display documents.

Module 4: ACL Concepts - Coggle Diagram

- - - - Limit Network traffic to increase network performance
      - Provide traffic flow control
      - Provide a basic level of security for network access
      - Filter traffic based on traffic type
      - Screens hosts to permit or deny access to network services
      - Provide priority to certain classes of network traffic
  - - - Cisco routers support two types of ACLs
        
        Standard ACLs
        
        ACLs only filter at Layer 3 using the source IPv4 address only
        
        Extended ACLs
        
        ACLs filter at Layer 3 using the source and / or destination IPv4 address. They can also filter at Layer 4 using TCP, UDP ports, and optional protocol type information for finer control.
  - - - ACLs can be configured to apply to both incoming and outgoing traffic
        
        operational steps used when traffic has entered a router interface with a configured standard IPv4 inbound ACL:
        
        The router extracts the source IPv4 address from the packet header.
        
        The router starts at the top of the ACL and compares the source IPv4 address with each ACE (Access Control Entry) in sequential order
        
        When a match is found, the router executes the instruction, either permitting or denying the packet, and the remaining ACEs in the ACL, if any, are not analyzed.
        
        If the source IPv4 address does not match any ACE in the ACL, the packet is discarded because there is an implicit deny ACE applied automatically to all ACLs.
        
        The last ACE statement of an ACL is always an implicit deny that blocks all traffic. By default, this instruction is automatically implied at the end of an ACL, although it is hidden and not shown in the configuration
        
        An ACL must have at least one permit statement; otherwise, all traffic will be denied due to the implicit deny ACE statement.
- - - - Wildcard to Match a Host
        
        n this example, the wildcard mask is used to match a specific host IPv4 address. Assume ACL 10 needs an ACE that only permits the host with IPv4 address 192.168.1.1. Recall that “0” equals a match and “1” equals ignore. To match a specific host IPv4 address, a wildcard mask consisting of all zeroes (i.e., 0.0.0.0) is required.
      - Wildcard Mask to Match an IPv4 Subnet
        
        In this example, ACL 10 needs an ACE that permits all hosts in the 192.168.1.0/24 network. The wildcard mask 0.0.0.255 stipulates that the very first three octets must match exactly but the fourth octet does not.
      - Wildcard Mask to Match an IPv4 Address Range
        
        In this example, ACL 10 needs an ACE that permits all hosts in the 192.168.16.0/24, 192.168.17.0/24, …, 192.168.31.0/24 networks. The wildcard mask 0.0.15.255 would correctly filter that range of addresses.
  - - - any - This keyword substitutes for the 255.255.255.255 mask. This mask says to ignore the entire IPv4 address or to accept any addresses.
      - host - This keyword substitutes for the 0.0.0.0 mask. This mask states that all IPv4 address bits must match to filter just one host address.
- - - - one outbound IPv4 ACL
      - one inbound IPv4 ACL
      - one inbound IPv6 ACL
      - one outbound IPv6 ACL
  - - - Base ACLs on the organizational security policies.
      - Write out what you want the ACL to do
      - Use a text editor to create, edit, and save all of your ACLs
      - Document the ACLs using the remark command
      - Test the ACLs on a development network before implementing them on a production network
- - - - Standard ACLs - These permit or deny packets based only on the source IPv4 address.
      - Extended ACLs - These permit or deny packets based on the source IPv4 address and destination IPv4 address, protocol type, source and destination TCP or UDP ports and more.
  - - - Extended ACLs should be located as close as possible to the source of the traffic to be filtered. This way, undesirable traffic is denied close to the source network without crossing the network infrastructure.
      - Standard ACLs should be located as close to the destination as possible. If a standard ACL was placed at the source of the traffic, the "permit" or "deny" will occur based on the given source address no matter where the traffic is destined.
      - Placement of the ACL and therefore, the type of ACL used, may also depend on a variety of factors as listed in the table.