Lesson 48 - Standard ACL Examples

By

Lesson 48 - Standard ACL Examples

Pic. 1 - Topology.
Icons designed by: Andrzej Szoblik - http://www.newo.pl

Task 1
Configure an IP standard ACL that denies packets coming from 172.31.3.16/28 going towards 192.168.4.0/24. All other traffic should be allowed.

Task 2
Configure an IP standard ACL that denies packets coming from the host 172.31.123.3 going towards 192.168.5.0/24. Traffic from other sources should be allowed. 

Let's get 'em tiger!

When it comes to configuring ACLs my work flow goes like this:
  1. Which ACL is going to accomplish my goal: Standard or Extended?
  2. Which router and interface should I apply the ACL on?
  3. Which direction should I use: in or out?
Dig this! 
Since as of this moment we talk about standard ACL, the answer to the first question is obvious: standard ACL must be used. In real life examples, the goals you try to accomplish will impose the criteria. If you must filter out some specific TCP traffic (e.g. going towards port 80), an extended ACL must be used as the standard one cannot filter on TCP (source IP only).

The guidelines specify that standard ACL must be placed as close to the destination as possible. Think about it. If I applied the ACL in Task 1 on R3F1/0 out, the packet with the source 172.31.3.32/28 could not go anywhere out that interface. We're supposed to filter this source going towards Branch 1 (R4) and not anywhere else. R4 is going to be the router I'm going to apply the ACL on.

As for the last question about the direction, I could use R4's S0/2 inbound or F1/0 outbound. Since there are only two interfaces, I can apply this on s0/2 inbound and it won't make much difference except that the packet will be rejected on the inbound interface. This way, R4 won't have to do layer 3 lookup and waste it resources. If there were more interfaces I would use it on F1/0 interface outbound since the traffic should not be sent to the specific network (192.168.4.0).

Task 1
Configure an IP standard ACL that denies packets coming from 172.31.3.16/28 going towards 192.168.4.0/24. All other traffic should be allowed.

Pic. 2 - Communication Before Applying ACL.
Notice!
I pinged from the subnet in question (172.31.3.16/28).

R4 Configuration:
!
! Step 1 - Create an ACL statement in the global config 
R4(config)#access-list 1 deny 172.31.3.16 0.0.0.15
R4(config)#access-list 1 permit any              
R4(config)#
!
! Step 2 - Apply the ACL on the interface
R4(config)#int s0/2
R4(config-if)#ip access-group 1 in
R4(config-if)#
!

Verification:
Pic. 3 - Communication After Applying ACL.
Notice!
Only packets sourced from the 172.31.3.16/24 are being blocked on R4. The packets from 172.31.3.0/28 are getting through.

Pic. 4 - R4's ACL counters.

I owe you an explanation here.
!
R4(config)#access-list 1 deny 172.31.3.16 0.0.0.15
!

access-list 1 - the number 1 implies the standard ACL (1-99)
deny - the packets meeting the criterion that follows will be denied (dropped)
172.31.3.16 - the source IP criterion
0.0.0.15 - the wildcard mask which is the subnet's inversed network mask

The subnet's network mask is: 255.255.255.240. In the binary it looks like:
11111111.11111111.11111111.11110000

If we inverse this network mask we get:
00000000.00000000.00000000.00001111

That, converted to decimal is: 0.0.0.15 

Easy right?
!
R4(config)#access-list 1 permit any
! 
permit any - this permits all other source IP. The word 'any' is the alias for:

0.0.0.0 255.255.255.255
Try to write an ACL according to the Task 2 description on your own. I will show you the solution in the next post.

In my next post: solution to the Task 2 and extended ACLs. 

Stop by and see what magic they can do! Meanwhile, happy studying!

Comments

Post a Comment

Popular posts from this blog

Lesson 27 - IPv4 Address Dissected - Part 1

By
Image
Lesson 27 - IPv4 Address Dissected - Part 1 If you already feel comfortable with binary-to-decimal and decimal-to-binary conversions you're up to this post's challenge: learning more about IP version 4 address (IPv4). If you need to brush upon the numeral conversions, check my  previous post . In one of the earlier posts on  TCP/IP traffic flow , I briefly described the importance of the addresses. In order for devices to communicate they must be uniquely identified in the network after all. There are typically three such identifiers we use to distinguish between devices: Names  - These are used by humans. Applications use addresses not names. Hence, DNS services out there (DNS service is used to resolve names-to-ip, and ip-to-names).  Layer 3 addresses  -  logical  and  hierarchical  unique identifiers of devices in the network. All layer 3 protocols such as IPX, Apple-Talk, IP etc. use different forms of layer 3 addresses.  Layer 2 addresses  -  flat  and most ofte
Read more

Lesson 21 - Spanning-Tree Protocol in Practice

By
Image
Lesson 21 - Spanning-Tree Protocol in Practice Previous post was designed to present in a nutshell the STP operation. However, without some practice it's just academic knowledge. I think it is a good idea to look at the same concepts using real equipment. Here goes... The below topology (pic. 1) uses redundant links which create the loops. Pic. 1 - Network Topology Icons designed by: Andrzej Szoblik -   http://www.newo.pl If there's one thing the administrator should do with such design, that would be configuring the root bridge. Typically, the most powerful switch in the center of the network plays that role. You do not want some access switch to be transmitting the frames between other switches. Access switches are designed to connect your computers to the network, and not to handle the majority of the traffic between the switches which root bridge must deal with. If you do not configure root bridge yourself, the switch with the lowest MAC address becomes th
Read more

Lesson 4 - Introduction to TCP/IP Layers

By
Image
Lesson 4 - Introduction to TCP/IP Layers In this lesson we take a sneak peek at the fundamentals regarding TCP/IP. This is one of the most important aspects to understand in order to follow the upcoming lessons. It is not my ambition to explain everything here as this would turn into a hefty book to read. You can find a lot of them on the market anyway. Instead, I will try to focus on some basic aspects of TCP/IP. They will constitute the minimum knowledge to help us understand how computers communicate. If you feel the urge to learn more on TCP/IP right now please visit the following site:  http://www.tcpipguide.com/free/t_toc.htm NOTICE! Familiarize yourself with ALL terms in red. They will be used throughout the classes. Introduction Computer communication follows some well defined rules and guidelines which we call  protocols . In order for the computers to exchange data they have to agree on using the same rules, otherwise they become incompatible. That was the case in t
Read more