5.0 Security Fundamentals

5.6 Access Control Lists (ACLs)

Access Control Lists (ACLs) in Cisco IOS are a set of rules used to define which network traffic is allowed or denied based on various criteria, such as source IP address, destination IP address, source port number, and destination port number.

ACLs are implemented on routers and switches and are used to control the flow of traffic in and out of a network. They can be used for a variety of purposes, including security, traffic filtering, and quality of service (QoS) management.

Cisco IOS supports two types of ACLs: standard ACLs and extended ACLs. Standard ACLs are used to filter traffic based on the source IP address, while extended ACLs allow for more complex filtering based on a wider range of criteria, such as the destination IP address and port number.

ACLs are defined and applied to interfaces on a router or switch. When a packet arrives at an interface, it is compared to the ACL rules, and the first matching rule determines whether the packet is permitted or denied.

The configuration of ACLs in Cisco IOS is done using the command line interface (CLI). The specific configuration will depend on the specific requirements of the organization, such as the criteria to be used for filtering traffic and the desired behavior for permitting or denying traffic.

Example : Configurations using Cisco IOS

Standard ACL:

access-list 10 permit 192.168.1.0 0.0.0.255
access-list 10 deny any

This standard ACL allows all traffic from the 192.168.1.0/24 network and denies all other traffic.

Extended ACL:

pythonCopy code
access-list 100 deny tcp any host 10.1.1.1 eq 80
access-list 100 permit ip any any

This extended ACL denies all TCP traffic from any source to the host at IP address 10.1.1.1 on port 80 and permits all other IP traffic.

In these examples, access-list is the command to create an ACL, followed by a unique number (10 for the standard ACL and 100 for the extended ACL) to identify the ACL. The permit and deny keywords are used to specify the desired behavior for matching traffic, and the specific criteria for matching traffic (such as source and destination IP address and port number) are specified using the any keyword for any IP address and various other keywords and values.

Note that these are just examples and can be adapted to meet the specific needs of the organization. The configuration of ACLs in Cisco IOS is done using the command line interface (CLI). The specific configuration will depend on the specific requirements of the organization, such as the criteria to be used for filtering traffic and the desired behavior for permitting or denying traffic.

Named access control lists (ACLs) are a way of organizing and managing access control lists in Cisco IOS. Named ACLs are similar to standard and extended ACLs, but instead of being identified by a numerical identifier, they are identified by a unique name.

Named ACLs provide a more human-readable way of organizing and identifying ACLs, which can make it easier to manage and maintain the ACLs in a large or complex network. Named ACLs also allow for more advanced configuration options, such as the ability to include comments and reference other named ACLs in the configuration.

Here is an example of a named ACL:

ip access-list standard named_acl
 permit 192.168.1.0 0.0.0.255
 deny any

In this example, ip access-list standard is the command to create a standard named ACL, followed by the name of the ACL (named_acl). The rest of the configuration is similar to a standard ACL, with the permit and deny keywords being used to specify the desired behavior for matching traffic, and the specific criteria for matching traffic (such as source IP address) being specified.

Note that named ACLs can be used in place of standard and extended ACLs in the same way, and can be applied to interfaces on a router or switch in the same way as well. The specific configuration of named ACLs will depend on the specific requirements of the organization, such as the criteria to be used for filtering traffic and the desired behavior for permitting or denying traffic.

Verification of ACLs

To verify access control lists (ACLs) on a Cisco IOS device, you can use the following commands:

show access-lists - This command displays a list of all ACLs that are configured on the device, including both standard and extended ACLs.
show access-lists [acl-number | acl-name] - This command displays the details of a specific ACL, either by number (for standard and extended ACLs) or by name (for named ACLs). The output of this command shows the rules of the ACL and the counters for the number of packets that have matched each rule.
show ip interface [interface-name] - This command displays information about an interface, including the IP address, subnet mask, and any ACLs that are applied to the interface. This can be useful for verifying that the correct ACL is applied to an interface and that it is functioning as expected.

These commands can be used to verify that the ACLs are configured correctly and are functioning as expected. It is important to regularly check the ACLs and their statistics to ensure that they are providing the desired level of security and that they are not blocking legitimate traffic.

Note that the specific commands and output will depend on the version of Cisco IOS that is running on the device. The examples provided here are based on a common set of commands, but there may be some variations depending on the specific device and IOS version.