Revision as of 07:35, 15 February 2017

Cisco Access-list acl for IPv4 for IPv6 See Access-list IPv6 Cisco IOS

Placement of Access-lists

• The general rule is to put the extended ACLs as close as possible to the source of the traffic denied.
• Standard ACLs do not specify destination addresses, so they should be placed as close to the destination as possible.

Standard IP access lists

Standard IP Access lists are access lists from 1 to 99 and from 1300 to 1999. Standard access list only checks the source IP address. Example:

interface fastethernet0/0 
 ip address 10.1.1.1 255.255.255.0 
 ip access-group 1 in
!
access-list 1 permit 10.1.1.0 0.0.0.255

Extended IP access lists

Extended IP Access lists are access lists from 101 to 199 and 2000 to 2699. Extende access list can check source and destination IP address and protocol specific information. (IP, TCP, UDP, ICMP) Example:

interface Ethernet0/1 
 ip address 172.16.1.2 255.255.255.0 
 ip access-group 101 in 
!
access-list 101 deny icmp any 10.1.1.0 0.0.0.255 echo 
access-list 101 permit ip any 10.1.1.0 0.0.0.255

IP named access lists

IP named access lists you can give standard and extended access lists names instead of numbers. Example:

interface Ethernet0/0 
 ip address 10.1.1.1 255.255.255.0 
 ip access-group TELNET-IN in
!
ip access-list extended TELNET-IN 
permit tcp host 10.1.1.2 host 172.16.1.1 eq telnet

Protecting telnet management

To protect unauthorized users from accessing the Router you can use a access list.

access-list 100 permit tcp 10.10.10.0 0.0.0.255 any eq telnet
!
line vty 0 4
 access-class 100 in
 password cisco
 login

Reflexive access lists

Reflexive access lists allow IP packets to be filtered based on upper layer Session information. They are often used to allow outbound traffic and to limit inbound traffic in response to sessions.

The following example example permits ICMP traffic to the Router while TCP traffic is only allowed if the Session was started from within.

ip reflexive-list timeout 120 
!    
interface Ethernet0/1
 ip address 172.16.1.2 255.255.255.0
 ip access-group TRAFFIC-IN in
 ip access-group TRAFFIC-OUT out 

ip access-list extended TRAFFIC-IN
permit icmp 172.16.1.0 0.0.0.255 10.1.1.0 0.0.0.255
evaluate FILTERNAVN 
!
ip access-list extended TRAFFIC-OUT
permit icmp 10.1.1.0 0.0.0.255 172.16.1.0 0.0.0.255 
permit tcp 10.1.1.0 0.0.0.255 172.16.1.0 0.0.0.255 reflect FILTERNAVN

Timebased Access Lists

Timebased access lists specifies when a access list is activated. In the following example telnet is allowed monday, wednesday and friday from 08:00 to 17:00.

interface Ethernet0/0 
 ip address 10.1.1.1 255.255.255.0 
 ip access-group 101 in      
!
access-list 101 permit tcp 10.1.1.0 0.0.0.255 172.16.1.0 0.0.0.255 eq telnet time-range TELNET-OK  
!
time-range TELNET-OK 
periodic Monday Wednesday Friday 8:00 to 17:00

Commenting access lists

Sometimes its nice to comment your access list.

interface Ethernet0/0 
 ip address 10.1.1.1 255.255.255.0 
 ip access-group 101 in
!
access-list 101 remark permit_telnet 
access-list 101 permit tcp host 10.1.1.2 host 172.16.1.1 eq telnet

CBAC - Context Based Access Control

CBAC requires that the IOS Firewall feature is installed. CBAC inspects traffic that travels through the firewall in order to discover and manage state information for TCP and UDP sessions. This state information is used in order to create temporary openings in the access lists of the firewall.

Configure ip inspect lists in the direction of the flow of traffic initiation in order to allow return traffic and additional data connections for permissible session, sessions that originated from within the protected internal network, in order to do this.

This is an example of the use of CBAC in order to inspect outbound traffic. Extended ACL 111 normally block the return traffic other than ICMP without CBAC opening holes for the return traffic.

ip inspect name MYFW ftp timeout 3600 
ip inspect name MYFW http timeout 3600 
ip inspect name MYFW tcp timeout 3600 
ip inspect name MYFW udp timeout 3600 
ip inspect name MYFW tftp timeout 3600      
interface Ethernet0/1 
 ip address 172.16.1.2 255.255.255.0 
 ip access-group 111 in 
 ip inspect MYFW out      
access-list 111 deny icmp any 10.1.1.0 0.0.0.255 echo 
access-list 111 permit icmp any 10.1.1.0 0.0.0.255

ip inspect is obsolete^[1], use Zone-Based Firewall instead.

VACL - VLAN based ACL Lists

VACL access lists are implemented on layer 3 three switches. Fx. Cisco 3560 layer 3 switch.

vlan access-map DROPPRIVATEIP 10
  match ip address 7
  action drop
vlan access-map DROPPRIVATEIP 20
  action forward
!
vlan filter DROPPRIVATEIP vlan-list 1-300
!
access-list 7 permit 10.0.0.0 0.255.255.255
access-list 7 permit 172.16.0.0 0.15.255.255
access-list 7 permit 192.168.0.0 0.0.255.255

Using MAC based ACL

mac access-list extend MY-MAC-ACL
 permit host 0000.01ee.23b5 any
!
ip access-list extended MY-IP-ACL
 permit ip host 192.168.1.7 any
!
vlan access-map MY-VLAN-MAP
 match mac address MY-MAC-ACL
 match ip address MY-IP-ACL
 action forward
!
vlan filter MY-VLAN-MAP vlan-list 2-10

Links

Cisco ACL or as pdf Cisco ACL

References