ACCESS CONTROL LIST

1.   ACL is a sequential list having permit and deny statements with an implicit “deny all” statement at the end.

2.   ACL can be really helpful, when there is a need to exercise control over network traffic.

3.   Access lists is basically filtering unwanted packets when implementing security policies.

4.   Implementing access lists is really a lot like programming. If certain given condition is met, then a given action is taken. If the specific condition isn’t met, nothing happens and the next statement is evaluated.

5.   You can apply Access List to either inbound or outbound traffic on any interface.

6.   Access List is first created and the applied.

7.   Standard Access List:

·     Standard Access List filter network traffic by examining source IP Address of a packet only.

·     We create Standard Access List by using the Access List numbers 1-99 and 1300-1999 (extended Range).

·     It does not distinguish between IP traffic such as WEB, TELNET, UDP and so on.

·     Standard Access List is applied as near as possible to the destination and in the outbound direction.

8.   Extended Access List:

·     Extended access lists can evaluate many of the other fields in the layer 3 and layer 4 headers of an IP packet. They can evaluate source and destination IP addresses, the protocol field in the Network layer header, and the port number at the Transport layer header. This gives extended access lists the ability to make much more granular decisions when controlling traffic.

·     Specific service or protocol can be denied with the help of Extended Access List.

·     Extended Access List can be created by using the Access List numbers 100-199 and 2000-2699 (extended Range).

·     It is recommended to apply the Extended Access List closest to source.

9.   General rules for Access Control lists:

·     You will first make an ACL and then apply as per your requirement.

·     You can assign only one access list per interface per direction. This means you can have only one inbound and one outbound access list per interface.

·     Organize your access lists so that the more specific entries are at the top of the access list. Try to minimize the size of your ACLs.

·     Every time a new entry is added to the access list, it will be placed at the bottom of the list.

·     You cannot remove one entry from an access list. If you try to do this, you will end up deleting the entire list.

·     There is an implicit “deny all” statement running at the bottom of every ACL.

·     Configure & apply Standard ACLs nearest to the destination and in outbound direction.

·     Configure & apply Extended ACLs nearest to the source and in inbound direction.

10.                 Numbered Standard Access List:

·     Creating Access list:

Router(config)# access-list (1-99) deny/permit host 1.0.0.1(deny a single host), or

Router(config)# access-list 1 deny/permit 1.0.0.0 0.255.255.255 (deny entire n/w)

Router(config)# access-list 1 permit any

·     Implementing ACL:

Router(config)#interface fastEthernet0/1

Router(config-if)#ip access-group 1(acl no) in/out(direction)

·     Editing ACL:

Router(config)#ip  access-list standard 1

Router(config-std-nacl)#no 10(seq-no) deny 1.0.0.0 0.255.255.255

11.                 Named Standard Access List:

·     Creating Access list:

Router(config)# ip access- list standard ccna(name)

Router(config-std-nacl)#deny host 1.0.0.2(deny a single host), or

Router(config-std-nacl)#deny 1.0.0.0 0.255.255.255

Router(config-std-nacl)#permit any

·     Implementing ACL:

Router(config)#interafce fastethernet0/0

Router(config-if)#ip access-group ccna in/out(direction)

·     Editing ACL:

Router(config)#ip access-list standard ccna

Router(config-std-nacl)#no 10 deny host 1.0.0.2

12.                 Numbered Extended Access List:

·     Creating Access list:

Router(config)#access-list (100-199) deny/permit tcp(service) host 1.0.0.2(s-add) host 2.0.0.2(d-add) eq 80(port no)

Router(config)#access-list (100-199) permit tcp any any

·     Implementing ACL:

Router(config)#ip access-group (100-199) in/out(diection)

·     Editing ACL:

Router(config)#ip access-list extended (100-199)

Router(config-ext-nacl)#no 10(seq no) deny tcp host 1.0.0.1 host 2.0.0.1 eq 80

13.                 Named Extended Access List:

·     Creating Access list:

Router(config)#ip access-list extended ccna

Router(config-ext-nacl)#deny/permit tcp(service) host 1.0.0.1 host 2.0.0.1 eq 80(port no)

Router(config-ext-nacl)#permit tcp any any

·     Implementing ACL:

Router(config)# interface fastethernet0/0

Router(config-if)# ip access-group ccna in/out(direction)

·     Editing ACL:

Router(config)#ip access-list extended ccna

Router(config-ext-nacl)#no 10(seq no) deny/permit tcp host 1.0.0.1 host 2.0.0.1 eq 80