Add Book to My BookshelfPurchase This Book Online

Chapter 16 - IP Access Lists

Cisco & IP Addressing
Louis D. Rossi, Louis R. Rossi and Thomas Rossi
  Copyright © 1999 The McGraw-Hill Companies, Inc.

Chapter 16: IP Access Lists
Objective
  Describe access lists.
  Describe and configure IP standard access lists.
  Describe and configure IP extended access lists.
Access Lists
Access lists can be used to control and/or manage traffic in or out of router interfaces. They can permit or deny traffic based on certain parameters. Access lists can be part of a firewall scheme.
Access lists can be used to:
  Define interesting traffic for dial up links
  Control routing updates
  Define certain traffic for use with Cisco’s queuing features.
In the world of IP, access lists can be defined either as standard or extended.
IP Standard Access Lists
  Tip A standard list can only key on the source IP address.
Consider the Figure 16.1 topology, Table 16.1, and the following scenario.
We wish to block all IP traffic that originates from Host B from getting to Host C, at the same time permitting Host B to communicate with all other hosts.
In another words Host B will not be allowed to communicate with Host C but will be allowed to communicate with everyone else.
Table 16.1  Addresses of  Figure 16.1
S0
S1
S2
E0
Router_A
172.16.0.10
N/A
N/A
10.10.1.1/24
Router_B
172.16.0.9
172.16.0.13
172.16.0.5
N/A
Router_C
172.16.0.14
N/A
N/A
10.10.3.33/28
Router_D
172.16.0.6
N/A
N/A
10.10.3.17/28
Host A
10.10.1.2/24
Host B
10.10.3.18/28
Host C
10.10.3.34/28
Mask
255.255.255.252
255.255.255.252
255.255.255.252
Figure 16.1  Standard Access List Placement
The scenario dictates that we identify the source address of 10.10.3.18. If we use a standard list we cannot identify the destination address as part of the access list; as a result we are not concerned with the actual IP address of the destination. What we need to look at is the location of Host C.
It seems likely that our access list must deny traffic with a source address of 10.10.3.18 and permit traffic with any other source address.
Where should the standard access list be placed?
If we place the list on interface E0 inbound of Router_D we would keep all traffic from Host B from going anywhere. As a result Host B would only be able to communicate with other hosts that share the same network.
If we place the list on the E0 outbound of Router_C, Host B would still be able to communicate with Host A.
Possibly we could place the access list on the outbound interface S1 of Router_B, but that would also deny Host B IP access to Router_C, which may or may not be a bad thing.
In general, a standard access list will be placed close to the destination so as not to block traffic that will go to another location.
Suppose we were to add other hosts on the network along with Host C; would Host B be able to communicate with those hosts? We will take a look at that scenario later in this chapter.
Consider what is actually going to happen when Host B attempts to communicate with Host C. The packets will travel through Router D where processing will occur, then across the serial link to Router_B, where bandwidth will be used, then again Router_B will have to process the packet, then across another serial link where more bandwidth will be burned, then to Router_C where more processing will be used only to be denied when the packet is switched to interface E0 of Router_C.
This is like traveling five miles down a street only to find out it is a dead end! Why not put the dead end sign at the beginning of the street so we do not have to waste time traveling the five-mile course?
In the case of standard access lists, since we cannot specify the destination, we do not know where the packet is headed, therefore we have no choice but to allow it to travel through our network.
Configuration of a Standard Access List
It takes two steps to activate an access list:
  Configure the list
  Place the list on an interface
If either step is performed without the other there will be no effect. If we configure a list and do not apply it to an interface, it will not affect traffic. If we place an access list on an interface and do not have an access list created, it will have no effect.
Every access list will be associated with a number. I have included router output in Figure 16.2, which displays the number with the associated protocol. In our case we will use a number between 1 and 99; it makes no difference what number we pick.
An access list is processed from the top down. Each line is read by the router. If the packet in question matches the parameters set in the access list, that packet will either be permitted or denied. The next packet will then be examined and the process again starts from the first line of the access list. The order in which lines are placed in the access list is of utmost importance.
To illustrate this point let us assume we have a two-line access list as follows:
Permit any
Deny host 10.10.3.18
Host 10.10.3.18 would never be denied because this address matches the first address of “any” and therefore will be permitted. As a matter of fact, the last line of this access list will NEVER be read.
It is also important to remember that the last line of every access list will deny all traffic. This is called an implicit statement because we DO NOT have to configure this line. The line is appended to the end of an access list as soon as we create the list. This will be an important consideration in our scenario because we want to deny only Host B. No other traffic will be denied and therefore we must explicitly permit other traffic.
An analogy to the above concepts might be a guard at a gate of a residential community. A car pulls up to the gate and must stop. The driver then will identify him or herself. The guard will begin processing the list to find the name; as the guard works down the list of names the car is still stopped; finally the name is matched as someone who may go into this community.
Now let us assume that the name is not matched on the list either as someone who is allowed access or someone who is not allowed access. Does this person get to go in? Of course not; there is always an implicit deny at the end of the guard’s list.
An access list will affect performance. Just as that car must sit and wait for the guard to check the list, so a packet must wait as the router processes the list; the longer the list very possibly the longer the wait. That will depend on whether or not the packet is matched on a line toward the top or the bottom of the list. We will look at a feature of an extended access list that may help us define the list in a more efficient manner.
Router_C#config t
Enter configuration commands, one per line.  End with CNTL/Z.
Router_C(config)#access-list ?
  <1-99>       IP standard access list
  <100-199>    IP extended access list
  <1000-1099>  IPX SAP access list
  <1100-1199>  Extended 48-bit MAC address access list
  <1200-1299>  IPX summary address access list
  <200-299>    Protocol type-code access list
  <300-399>    DECnet access list
  <400-499>    XNS standard access list
  <500-599>    XNS extended access list
  <600-699>    Appletalk access list
  <700-799>    48-bit MAC address access list
  <800-899>    IPX standard access list
  <900-999>    IPX extended access list
Router_C(config)#access-list 50 ?
  deny    Specify packets to reject
  permit  Specify packets to forward
Router_C(config)#access-list 50 permit ?
  Hostname or A.B.C.D  Address to match
  any                  Any source host
  host                 A single host address
Router_C(config)#access-list 50 deny 10.10.3.18 0.0.0.0
Router_C(config)#access-list 50 permit any
Figure 16.2  Configuring a Standard Access List
In Figure 16.2 I have shown the wild card mask of 0.0.0.0 which, as we have already discussed in previous chapters, means to match all 32 bits of the preceding address. This command can be shortened by using the key word host as shown below:
Router_C(config)#access-list 50 deny host 10.10.3.18
If we wanted to identify all host addresses of the subnet 10.10.3.16/28 our command would be as follows:
Router_C(config)#access-list 50 deny 10.10.3.16 0.0.0.15
This is a review of material already covered. I show it here so you can understand the importance of the inverse mask. This method certainly beats having to identify each of the possible 15 hosts with a separate line.
Verifying Access List Configuration
Router_C#show access-list 50
Standard IP access list 50
  deny   10.10.3.18
  permit any
Figure 16.3  Displaying the Configured List
The next step after the access list is configured is to place it on the appropriate interface. The list can be applied to either the inbound or the outbound direction. If we do not specify the direction, it will be applied to the outbound. I have included the key word “out” in Figure 16.4 for clarity purposes.
Router_C(config)#int e0
Router_C(config-if)#ip access-group 50 out
Figure 16.4  Activating an Access List
Verify the Access List has been Applied to an Interface
Router_C#sh ip int e0
Ethernet0 is up, line protocol is up
  Internet address is 10.10.3.33/28
  Broadcast address is 255.255.255.255
  Address determined by setup command
  MTU is 1500 bytes
  Helper address is not set
  Directed broadcast forwarding is enabled
  Outgoing access list is 50
  Inbound  access list is not set
  Proxy ARP is enabled
  Security level is default
  Split horizon is enabled
  ICMP redirects are always sent
  ICMP unreachables are always sent
  ICMP mask replies are never sent
  IP fast switching is enabled
  IP fast switching on the same interface is disabled
  IP multicast fast switching is enabled
  Router Discovery is disabled
  IP output packet accounting is disabled
  IP access violation accounting is disabled
  TCP/IP header compression is disabled
  Probe proxy name replies are disabled
  Gateway Discovery is disabled
  Policy routing is disabled
  Network address translation is disabled
Figure 16.5  Verifying Placement and Direction with the “show interface” command
Router_c#sh run
Building configuration...
Current configuration:
!
version 11.2
no service password-encryption
no service udp-small-servers
no service tcp-small-servers
!
hostname Router_C
!
appletalk routing eigrp 300
appletalk route-redistribution
ipx routing 0060.09c3.df60
!
interface Ethernet0
  ip address 10.10.3.33 255.255.255.240
  ip access-group 50 out
  appletalk cable-range 500-510 508.156
  appletalk zone right
  ipx network DAD
!
interface Ethernet1
  no ip address
  shutdown
!
interface Serial0
  ip address 172.16.0.14 255.255.255.252
  appletalk cable-range 200-200 200.216
  appletalk zone two
  appletalk protocol eigrp
  ipx network 2
  no fair-queue
!
interface Serial1
  no ip address
  shutdown
!
no ip classless
access-list 50 deny   10.10.3.18
access-list 50 permit any
!
ipx router eigrp 100
  network 2
  network DAD
!
line con 0
  exec-timeout 0 0
line aux 0
line vty 0 4
  login
end
Figure 16.6  Verifying Activation with the “show run” Command
IP Extended Access Lists
In our example from Figure 16.1 we denied Host B from communicating not only with Host C but with any other host that might be on the same network with Host C. In Figure 16.7 we have changed the scenario somewhat and have added another Host, C2. We still wish to block communication from Host B to Host C, but only to Host C, not Host C2.
Figure 16.7  Extended Access List Topology
An extended IP access list has the ability to key on the following:
  Protocol
  IP source address
  IP destination address
  Port number.
Because we can now identify both source and destination addresses we can write an access list that will deny Host B from communicating with Host C only (Figure 16.8).
Router_C#config t
Enter configuration commands, one per line.  End with CNTL/Z.
Router_C(config)#access-list ?
  <1-99>           IP standard access list
  <100-199>    IP extended access list
  <1000-1099>  IPX SAP access list
  <1100-1199>  Extended 48-bit MAC address access list
  <1200-1299>  IPX summary address access list
  <200-299>    Protocol type-code access list
  <300-399>    DECnet access list
  <400-499>    XNS standard access list
  <500-599>    XNS extended access list
  <600-699>    Appletalk access list
  <700-799>    48-bit MAC address access list
  <800-899>    IPX standard access list
  <900-999>    IPX extended access list
Router_C(config)#access-list 150 deny ip host 10.10.3.18 host 10.10.3.34
Router_C(config)#access-list 150 permit ip  any any
Figure 16.8  Configuring an Extended  Access List
Notice the different syntax between a standard and an extended list. Now a number between 100 and 199 must be used. We must also identify a protocol, in this case IP, and a destination address, which is the IP address of Host C. Just as in the case of a standard list, the second line of the access list is needed due to the “implicit deny all” at the end of each list.
Verifying Access List Configuration
Extended IP access list 150
  deny   ip host 10.10.3.18 host 10.10.3.34 (16 matches)
  permit ip any any (1245 matches
Figure 16.9  Displaying the Configured List
One of the nice features of the extended access list is the fact that we can see how many times an access list line has matched a packet.
Figure 16.9 shows that 16 times Host B has attempted to communicate with Host C and 1245 times a packet matched the permit statement.
This can be very useful, especially when we have a long access list. Earlier we said that an access list will affect router performance. We would like our permit traffic to be toward the top of the list if possible. We do not really care about the traffic we are going to deny, let it wait, keep it toward the bottom of the list.
If we have several permit statements all toward the top, the fact that we can see the matches of each statement will allow us to fine tune the access list so the permit lines with the most matches can be moved higher in the list.
If a lot matches occur on deny statements they may be a policy or security problem.
Where should the extended access list be placed?
Because we can now specify the destination address, we can move the access list closer to the source address. This provides us with the benefits of reducing the processing of Router_B and Router_C. Bandwidth will also not be wasted for traffic that will ultimately be denied.
The access list should be placed on interface E0 inbound of Router_D.
Router_D(config)#int e0
Router_D(config-if)#ip access-group 150 in
Figure 16.10  Activating an Access List
Verify the Access List has been Applied to an Interface
Router_D#sh ip int e0
Ethernet0 is up, line protocol is up
  Internet address is 10.10.3.17/28
  Broadcast address is 255.255.255.255
   Address determined by setup command
  MTU is 1500 bytes
   Helper address is not set
   Directed broadcast forwarding is enabled
  Outgoing access list is not set
  Inbound  access list is 150
  Proxy ARP is enabled
  Security level is default
  Split horizon is enabled
  ICMP redirects are always sent
  ICMP unreachables are always sent
  ICMP mask replies are never sent
  IP fast switching is enabled
   IP fast switching on the same interface is disabled
  IP multicast fast switching is enabled
  Router Discovery is disabled
  IP output packet accounting is disabled
  IP access violation accounting is disabled
  TCP/IP header compression is disabled
  Probe proxy name replies are disabled
  Gateway Discovery is disabled
  Policy routing is disabled
  Network address translation is disabled
Figure 16.11  Verifying Placement and Direction with the “show interface” Command
Let us change our scenario once again; this time we will deny Host B from using the telnet application with Host C. Host B is allowed the use of other IP applications and protocols, we just want to deny telnet only.
Since an extended access list allows us to specify port numbers, we should be able to do this with no problem (Figure 16.12).
Router_C(config)#access-list 150 deny ?
  <0-255>  An IP protocol number
  eigrp   Cisco’s EIGRP routing protocol
  gre     Cisco’s GRE tunneling
  icmp    Internet Control Message Protocol
  igmp    Internet Gateway Message Protocol
  igrp    Cisco’s IGRP routing protocol
  ip      Any Internet Protocol
  ipinip  IP in IP tunneling
  nos     KA9Q NOS compatible IP over IP tunneling
  ospf    OSPF routing protocol
  tcp     Transmission Control Protocol
  udp     User Datagram Protocol
Router_C(config)#access-list 150 deny tcp host 10.10.3.18 host 10.10.3.34 ?
  eq           Match only packets on a given port number
  established  Match established connections
  gt           Match only packets with a greater port number
  log          Log matches against this entry
  log-input    Log matches against this entry, including input interface
  lt           Match only packets with a lower port number
  neq          Match only packets not on a given port number
  precedence   Match packets with given precedence value
  range        Match only packets in the range of port numbers
  tos          Match packets with given TOS value
  <cr>
Router_C(config)#access-list 150 deny tcp host 10.10.3.18 host 10.10.3.34 eq ?
  <0-65535>  Port number
  bgp          Border Gateway Protocol (179)
  chargen      Character generator (19)
  cmd          Remote commands (rcmd, 514)
  daytime      Daytime (13)
  discard      Discard (9)
  domain       Domain Name Service (53)
  echo         Echo (7)
  exec         Exec (rsh, 512)
  finger       Finger (79)
  ftp          File Transfer Protocol (21)
  ftp-data     FTP data connections (used infrequently, 20)
  gopher       Gopher (70)
  hostname     NIC hostname server (101)
  ident        Ident Protocol (113)
  irc          Internet Relay Chat (194)
  klogin       Kerberos login (543)
  kshell       Kerberos shell (544)
  login        Login (rlogin, 513)
  lpd          Printer service (515)
  nntp         Network News Transport Protocol (119)
  pop2         Post Office Protocol v2 (109)
  pop3         Post Office Protocol v3 (110)
  smtp         Simple Mail Transport Protocol (25)
  sunrpc       Sun Remote Procedure Call (111)
  syslog       Syslog (514)
  tacacs       TAC Access Control System (49)
  talk         Talk (517)
  telnet       Telnet (23)
  time         Time (37)
  uucp         Unix-to-Unix Copy Program (540)
  whois        Nicname (43)
  www          World Wide Web (HTTP, 80)
Router_C(config)#Access-list 150 deny tcp host 10.10.3.18 host 10.10.3.34 eq telnet
Router_C(config)#Access-list 150 deny tcp host 10.10.3.18 host 10.10.3.34 eq 23
Figure 16.12  Configuring an Extended Access List with a Port Number
Reviewing Figure 16.12, we see that we now identify TCP, not IP as the protocol, because telnet is a TCP protocol. Appended to the end of the line, we will identify the port number for telnet, which is 23, or use the name telnet. I have included both ways for clarity. Both ways are not required.
Other port names and numbers can be viewed by using the “?” as shown in Figure 16.12.
We are not finished yet; remember that we want Host B to be able to use other IP protocols in communication with Host C. So we need to add one more line to our access list:
Router_C(config)#access-list 150 permit ip any any
Notice we denied TCP but we are going to permit IP; if we were to permit TCP only, that would deny all IP protocol packets due to the implicit “deny all” statement at the end of the access list.
A few years ago I had a student in New York who performed a lab similar to this; as his last line he permitted TCP, not IP; he got upset when all his IP RIP routes disappeared.
Since the RIP updates use the IP protocol, they were all denied and therefore the routing table was lost.
Router_C#sh access-list 150
Extended IP access list 150
deny   tcp host 10.10.3.18 host 10.10.3.34 eq telnet
permit ip any any
Figure 16.13  Viewing the Access List

 


 
Books24x7.com, Inc © 2000 –  Feedback