Cisco Lvl4=>Chap5 [ACL(1+2)]

what are the 2 main tasks in applying ACLs

1. Create an ACL # or name and specify access conditions 2. Group (or assign) the ACL to interfaces or vty lines

how do you verify ACLs

#show startup-config #show access-lists [ <number> | <NAME> ]

An ACL is a ...... list of permit / deny statements

- An ACL is a sequential list of permit or deny statements

what are some ACL best practices

- Base ACLs on security policy - Write a description of ACL's function (pseudocode) - Use a text editor to create, edit and save the ACL - Test the ACL on a development network first

define packet filtering

- Controls access by analyzing packets and passing/stopping based on some rules

what are the two rules that apply when considering placement of ACLs

- Extended ACLs as close as possible to the source o Undesirable traffic is filtered before crossing network - Standard ACLs as close to the destination as possible o Because they do not specify a destination address

what is the ACL syntax

- Fig)# access-list {num} deny | permit {IPnum [wildcard] } o E. G. fig)# access-list 10 permit 192.168.10.1

what happens when a packet and an ACL statement match / does not match

- If a packet and an ACL statement match, the rest of the list is skipped and the packet is permitted or denied - If the packet does not match and ACL statement, a final implied statement covers all conditions

what are 3 things that ACLs do

- Limit network traffic to increase network performance (ie. policy blocking video traffic) - Provide traffic flow control - Provide a basic level of security for network access

where should you place most frequently used entries

- Most frequently used entries should be at the top of the list

what are the "3 Ps"

- Only one ACL per protocol, per direction, per interface - A router with 2 interfaces and running c4 & v6 could possibly require 8 separate ACLs

what is the Standard ACL # range and Extended ACL # range

- Standard ACLs use numbers: 1 - 99 & 1300 - 1999 - Extended ACLs use numbers 100 - 199 & 2000 - 2699

what is the final implied statement

- This final condition matches all packets and results in an "implicit deny any" or "deny all traffic" statement - An ACL without at least 1 permit will block all traffic!

how do you remove an ACL

- To remove the ACL --> fig)# no access-list {num}

what are some ACL guidelines on placement and configuration

- Use ACLs in firewall/border routers and between internal networks and the outside - Use ACLs between areas to control traffic entering/exiting - Configure ACLs for each network protocol (IPv4, v6, etc) and in each direction (in/out)

how do you block all incoming traffic, except for established connections; and where is this ACL placed

...... permit tcp any host x.x.x.x eq 80 est o Only HTTP (TCP) packets w/ ACK or RST are permitted o Placed inbound from Internet

how do you apply Extended ACLs

> Apply extended ACL to block traffic through the router > Users who want access are blocked until they Telnet or SSH to the router and are authenticated > The SSH conn is then dropped and a single-entry dynamic ACL is added to the extended ACL

what happens when a packet passes an interface with an ACL

> As packets pass an interface with an ACL, the ACL is checked top to bottom, 1 line at a time, looking for a match

ACLs are configured for either ......... or ........ traffic

ACLs are configured for either inbound or outbound traffic

what attributes can Extended ACLs check for

ACLs first filter on source IP, port and protocol and then on the destination IP, port and protocol and then check for permit/deny

what is ACL and some characteristics of it

Access Control Lists > Are lists of instructions that permit or deny specific packets > Enforce security policies by controlling traffic into or out of a network > They can be based on IPs, ports, or a variety of protocols

what is the extended ACL syntax

Access-list # permit | deny prot src wldC [op #] dest wldC op #

how do you create a named ACL

Fig)# ip access-list standard | extended <NAME>

characteristics of extended ACLs

Filter based on protocol type, source and destination IP, source and destination ports and other parameters

when are inbound packets processed

Inbound packets processed before they are routed --> saves overhead of routing lookups

where are new ACL statements added (in the list)

New ACL statements are always added to the end > You cannot selectively insert or delete lines

how are outbound packets processed

Outbound - Incoming packets are routed to the outbound interface and then processed through the ACL

what are the two main types of Cisco ACLs

Standard ACLs, Extended ACLs

when would you use the remark keyword while placing ACLs

The remark keyword is used for documentation Fig)# access-list {num} remark {comments} (≤ 100 characters)

what protocol should you use when trying to allow/disallow all traffic

To permit or deny all traffic use ip (not

what are the keywords for ping and ping reply

deny icmp any host 10.93.105.1 echo-reply (type code 0) ---> deny icmp any host 10.93.105.1 0 o echo request = type code 8 = "echo"

what are the logical operators

eq, neq, gt & lt

what are the possible protocol codes

ip, tcp, udp, icmp, etc.

how do you apply an ACL to an interface (syntax)

o -if)# ip access-group {ACL-num} | {ACL-name} in | out [log]

what is the syntax and best practice while applying ACLs to vty lines (Telnet SSH)

o -line)# access-class <num> in | out o Best practice for vty ACLs = standard ACLs - IN only

what are the two mask keywords and what do they stand for

o 0.0.0.0 (to match one host IP address exactly) --- HOST o 255.255.255.255 (to accept and IP address at all) --- ANY

what are the tree categories of complex ACLs and purposes of each

o Dynamic - Lock and key - uses Telnet authentication o Reflexive - Allow outbound traffic, and inbound only in response to outbound o Time-based - Allows access based on the time of day/week

characteristics of Standard ACLs

o Permit of deny traffic from source IP addresses ONLY! o The destination IP and ports involved are NOT checked

what are some different ways to write deny tcp any host 10.93.105.1 eq 23

o deny tcp quad0 quad255 host 10.93.105.1 eq 23 o deny tcp any 10.93.105.1 0.0.0.0 eq 23 o deny tcp any host 10.93.105.1 eq telnet