Lesson 49 - Packet Filtering with Extended ACLs

By

Lesson 49 - Packet Filtering with Extended ACLs

This post I start with presenting solution to the Task 2 I left unanswered in the lesson 49.

Task 2
Configure an IP standard ACL that denies packets coming from the host 172.31.123.3 going towards 192.168.5.0/24. Traffic from other sources should be allowed. 

Again, we use the standard IP ACL here, which is going to be applied on R5. Here goes:

R5 Configuration:
!
! In the global config 
!
access-list 1 deny host 172.31.123.3
access-list 1 permit any
!
! Enter the the incoming interface and apply the access-list
!
interface serial0/2
 ip access-group 1 in
!

Notice!
  • access-list 1 - ACL numbers 1-99 are IP standard ACLs (check source of the packets only.
  • host 172.31.123.3 - this keyword is an alias for: 172.16.123.3 0.0.0.0. It is a source address of the packets being inspected.
  • any - this keyword is an alias for: 0.0.0.0 255.255.255.255 - any source here.
I hope your answers were correct. Now is the time to learn Extended ACLs.

First, look at the syntax you see in Cisco documentation:

Pic. 1 - Extended ACL Syntax.

If you go like: 'OMG!' do not worry because you do not have to use all these keywords.

The options we are going to use can be presented as follows:

Pic. 2 - Extended ACL Common Syntax.
It looks a bit more convoluted but do not worry because in time you will feel quite confident with it. Your best friend is help '?' which is going to show you what options and arguments are required.

The best way to explain the syntax you need to get familiar with is to use an example and try to de-construct it. So, let's look at our topology one more time and create the following filter:

Task 1
Deny telnet sessions coming from 192.168.4.0/24 destined to 172.31.3.0/28 and 172.31.3.16/28. All other traffic should be allowed.

Pic. 3 - Topology.
Icons designed by: Andrzej Szoblik - http://www.newo.pl

Which ACL type should we use?
Since, we are very specific in terms of which protocols we want to deny, we must use Extended ACL. The standard ACL can only match on the source IP address, permitting or denying all protocols the packet is carrying.

Which router/interface should we apply the ACL on?
Our topology clearly shows that R3 has three different interfaces with three different addresses. So, we have two options here:
  • We can configure an Extended ACL on R4 FastEthernet 1/0 interface in the inbound direction (close to the source as per ACL guideline)
  • We can configure an Extended ACL on R4 Serial0/2 in the outbound direction.
  • Alternatively, we can apply an Extended ACL on R3FastEthernet1/0 (inbound).
I'm going to chose the option suggested by the ACL guide lines: as close to the source as possible.

Let's read the task again:


Task 1
Deny telnet sessions coming from 192.168.4.0/24 destined to 172.31.3.0/28 and 172.31.3.16/28. All other traffic should be allowed.

Here's one way to configure this:

R4 Configuration:
!
! In the global 'config' mode the statements are:
!
access-list 100 deny tcp 192.168.4.0 0.0.0.255 172.31.3.0 0.0.0.15 eq 23
access-list 100 deny tcp 192.168.4.0 0.0.0.255 172.31.3.16 0.0.0.15 eq 23
access-list 100 permit ip any any
!
! Apply the ACL on the interface
! 
interface Serial0/2
  ip access-group 100 out
!

Three lines that 'deny' traffic are similar. Let's dissect its syntax:

access-list 100 deny tcp 192.168.4.0 0.0.0.255 172.31.3.0 0.0.0.15 eq 23

  • access-list 100 - The extended ACL (numbers 100-199)
  • deny - condition (either 'deny' or 'permit' are allowed)
  • tcp - layer 3 or 4 protocol (such as: ip, icmp, tcp, udp, rip, eigrpetc.)
  • 192.168.4.0 - source IP address
  • 0.0.0.255 - source wildcard mask (inversed mask)
  • 172.31.3.0 - destination IP address
  • 0.0.0.15 - destination wildcard mask (inversed mask)
  • eq - operator: eq (equal), lt (less than), gt (greater than), range
  • 23 - destination port (telnet)
Notice!
After source wildcard there is no source port. This means that the source port is not inspected at all (disregarded).

In the next post I'm going to show you few examples of extended ACL which should reinforce your study (today I have a friend over from UK so no time to do it ;))

Comments

Post a Comment

Popular posts from this blog

Lesson 27 - IPv4 Address Dissected - Part 1

By
Image
Lesson 27 - IPv4 Address Dissected - Part 1 If you already feel comfortable with binary-to-decimal and decimal-to-binary conversions you're up to this post's challenge: learning more about IP version 4 address (IPv4). If you need to brush upon the numeral conversions, check my  previous post . In one of the earlier posts on  TCP/IP traffic flow , I briefly described the importance of the addresses. In order for devices to communicate they must be uniquely identified in the network after all. There are typically three such identifiers we use to distinguish between devices: Names  - These are used by humans. Applications use addresses not names. Hence, DNS services out there (DNS service is used to resolve names-to-ip, and ip-to-names).  Layer 3 addresses  -  logical  and  hierarchical  unique identifiers of devices in the network. All layer 3 protocols such as IPX, Apple-Talk, IP etc. use different forms of layer 3 addresses.  Layer 2 addresses  -  flat  and most ofte
Read more

Lesson 21 - Spanning-Tree Protocol in Practice

By
Image
Lesson 21 - Spanning-Tree Protocol in Practice Previous post was designed to present in a nutshell the STP operation. However, without some practice it's just academic knowledge. I think it is a good idea to look at the same concepts using real equipment. Here goes... The below topology (pic. 1) uses redundant links which create the loops. Pic. 1 - Network Topology Icons designed by: Andrzej Szoblik -   http://www.newo.pl If there's one thing the administrator should do with such design, that would be configuring the root bridge. Typically, the most powerful switch in the center of the network plays that role. You do not want some access switch to be transmitting the frames between other switches. Access switches are designed to connect your computers to the network, and not to handle the majority of the traffic between the switches which root bridge must deal with. If you do not configure root bridge yourself, the switch with the lowest MAC address becomes th
Read more

Lesson 4 - Introduction to TCP/IP Layers

By
Image
Lesson 4 - Introduction to TCP/IP Layers In this lesson we take a sneak peek at the fundamentals regarding TCP/IP. This is one of the most important aspects to understand in order to follow the upcoming lessons. It is not my ambition to explain everything here as this would turn into a hefty book to read. You can find a lot of them on the market anyway. Instead, I will try to focus on some basic aspects of TCP/IP. They will constitute the minimum knowledge to help us understand how computers communicate. If you feel the urge to learn more on TCP/IP right now please visit the following site:  http://www.tcpipguide.com/free/t_toc.htm NOTICE! Familiarize yourself with ALL terms in red. They will be used throughout the classes. Introduction Computer communication follows some well defined rules and guidelines which we call  protocols . In order for the computers to exchange data they have to agree on using the same rules, otherwise they become incompatible. That was the case in t
Read more