Please enable JavaScript.

Coggle requires JavaScript to display documents.

8. Access Control Lists, ACLs can be configured to apply to inbound…

- - - - When an ACL is applied to an interface, the router performs the additional task of evaluating all network packets as they pass through the interface to determine if the packet can be forwarded.
    - - Limit network traffic to increase network performance
      - Provide traffic flow control
      - Provide a basic level of security for network access
      - Filter traffic based on traffic type
      - Screen hosts to permit or deny access to network services
      - Provide priority to certain classes of network traffic
  - - - Standard ACLs
        
        Only filter at Layer 3 using the source IPv4 address only
      - Extended ACLs
        
        Filter at Layer 3 using the source and/or destination IPv4 address. They can also filter at Layer 4 using TCP, UDP ports, and optional protocol type information for finer control
  - - - ACLs number 1 to 99, or 1300 to 1999 are standard ACLs while number 100 to 199, or 2000 to 2699 are extended ACLs
    - - Is the preferred method to use when configuring ACLs. Specifically, standard and extended ACLs can be named to provide information about the purpose of the ACL
        
        The ip access-list global configuration command is used to create a named ACL
        
        The rules to follow for named ACLs
        
        Assign a name to identify the purpose of the ACL
        
        Names can contain alphanumeric characters
        
        Names cannot contain spaces or punctuation
        
        It is suggested that the name be written in CAPITAL LETTERS
        
        Entries can be added or deleted within the ACL
  - - - The router extracts the source IPv4 address from the packet header.
      - The router starts at the top of the ACL and compares the source IPv4 address to each ACE in a sequential order.
      - When a match is made, the router carries out the instruction, either permitting or denying the packet, and the remaining ACEs in the ACL, if any, are not analyzed.
      - If the source IPv4 address does not match any ACEs in the ACL, the packet is discarded because there is an implicit deny ACE automatically applied to all ACLs.
- - - - A wildcard mask is similar to a subnet mask in that it uses the ANDing process to identify which bits in an IPv4 address to match.
        
        However, they differ in the way they match binary 1s and 0s.
        
        Wildcard mask bit 0 - Math the corresponding bit value in the address
        
        Wildcard mask bit 1 - Ignore the corresponding bit value in the address
  - - - Is used to match a specific host IPv4 address.
      - To match a specific host IPv4 address, a wildcard mask consisting of all zeroes (i.e., 0.0.0.0) is required.
      - The 0.0.0.0 wildcard mask stipulates that every bit must match exactly.
    - - The wildcard mask stipules that the very first three octes must match exactly but the fourth octet does not
    - - The wildcard mask would correctly filter the range of address specifed
      - The highlighted wildcard mask bits identify which bits of the IPv4 address must match.
  - - - host
        
        This keyword substitutes for the 0.0.0.0 mask. This mask states that all IPv4 address bits must match to filter just one host address.
      - any
        
        This keyword substitutes for the 255.255.255.255 mask. This mask says to ignore the entire IPv4 address or to accept any addresses.
- - - - Use a text editor and write out the specifics of the policy to be implemented
      - Add the IOS configuration commands to accomplish those tasks
      - Include remarks to document the ACL
      - Copy and paste the commands onto the device
      - Always thoroughly test an ACL to ensure that it correctly applies the desired policy
    - - Router(config)# access-list access-list-number {deny | permit | remark text} source [source-wildcard] [log]
        
        access-list-number
        
        This is the decimal number of the ACL
        
        Standard ACL number range is 1 to 99 or 1300 to 1999
        
        deny
        
        This denies access if the condition is matched
        
        permit
        
        This permit access if the condition is matched
        
        remark text
        
        This adds a text entry for documentation purposes
        
        Use the any keyword to specify all networks
        
        Use the host ip-address keyword or simply enter an aip-address (without the host keyword) to identify a specific IP address
        
        source
        
        This identifies the source network or host address to filter
        
        Use the any keyword to specify all networks
        
        Use the host ip-address keyword or simply enter an ip-address (without the host keyword) to identify a specific IP address
        
        source-wildcard
        
        This is a 32-bit wildcard mask that is applied to the source. If omitted, a default 0.0.0.0 mask is assumed
        
        log
        
        This keyword generates an informational message whenever the ACE is matched
        
        Message includes ACL number, matched condition, source address, and number of packets
        
        This message is generated for the first matched packet
        
        Unfortunately, ACL logging can be CPU intensive and can negatively affect other functions therefore it should only be implemented for troubleshooting or security reasons
      - Use the no access-list access-list-number global configuration command to remove a numbered standard ACL
    - - Router(config)# ip access-list standard access-list-name
        
        ACL names are alphanumeric, case sensitive, and must be unique
      - Use the no ip access-list standard access-list-name global configuration command to remove a named standard IPv4 ACL
    - - Router(config-if)# ip access-group {access-list-number | access-list-name} {in | out}
        
        protocol
        
        Name or number of an internet protocol
        
        Common keywords include ip, tcp, udp, and icmp
        
        The ip keyword matches all IP protocols
      - Use the no access-list access-list-number global configuration command to remove an extended ACL
      - To remove an ACL from an interface, first enter the no ip access-group interface configuration command.
      - To remove the ACL from the router, use the no access-list global configuration command.
    - - Protocol options
        
        The four highlighted protocols are the most popular options
        
        icmp, ip, tcp, udp
      - Port Keyword options
        
        Selecting a protocol influences port options. For instance, selecting the:
        
        tcp protcol would provide TCP related ports options
        
        udp protocol would provide UDP specific ports options
        
        icmp protocol would provide ICMP related ports options
    - - TCP can also perform basic stateful firewall services using the TCP established keyword. The keyword enables inside traffic to exit the inside private network and permits the returning reply traffic to enter the inside private network
      - However, TCP traffic generated by an outside host and attempting to communicate with an inside host is denied.
        The established keyword can be used to permit only the return HTTP traffic from requested websites, while denying all other traffic.
    - - Router(config)# ip access-list extended access-list-name