Objectives by using Access control lists using:
1. limit network traffic and improve performance of network. For example, queue technology, not only limits the network traffic, and reduce the congestion.
2. to provide control means for communication flow. For example, can control a network flow which get through the router.
3. to provide a basic security means for visiting network. For example, in companies, access the staff of the financial department to computer servers of financial department but refuse the visit from other departments.
4. on the router interface, to decide whether transmit a certain flows or not. For example, you can allow to tranmit FTP communication flow, but refuse to transmit TELNET communication flow.
Working principles:
ACL provides two operations, all applications are working around these two operations: Access、deny
Note: ACL is a procedure in CISCO IOS and it has its own orders to implement teh command from administrators, its orders for implementation is from top to bottom, and as soon as it found the matching procedure, it will stop to search, if not yet found teh matching one, then implement a hidden code - discarded DENY. Therefore, you must pay attention to the sequencing in writing ACL.
For example: To deny flow from 172.16.1.0/24, write ACL form as following:
Access 172.16.0.0/18
Deny 172.16.1.0/24
Access 192.168.1.1/24
Deny 172.16.3.0/24
Well, the results will be contrary to the expectation, Lets check what will be happened after exchange the place of Table I and Table II:
Deny 172.16.1.0/24
Access 172.16.0.0/18
Access 192.168.1.1/24
Deny 172.16.3.0/24
We found 172.16.3.0/24 just the same as before, this table is still inactive, because the implementation found the matching when it reached Table 2, so routers will access it, and is completely contrary to our requiement, then we need to move Table 4 to the front,
At last, it will be:
Deny 172.16.1.0/24
Deny 172.16.3.0/24
Access 172.16.0.0/18
Access 192.168.1.1/24
One can see that the ACL in the configuration of a rule: the more precise Table will be put to more forward, and the more general items on the table will be put later.
ACL is a collection of judgment statements, it is mainly used to control the following data:
1, inport data;
2, export data;
3, transmitted data by the routers.
Working Process:
1. regardless of whether the router has ACL or not, it’s the same method to deal with the received packet: When data enters to an entry, the router will check it first to decide whether it could be routing, if not then discard it, on the contrary, to get the detailed routing Information by checking the routing table–including AD, METRIC…… and the corresponding interface;
2. then, we can assume that the data can be routing, and has successfully completed the first step, found the interface to send it out, at this time, the router will check whether this exit is assigned to ACL, if in the absence of ACL, then send it from this exit directly.
If the interface is in the ACL, then will be more trouble.The first case –the router will match this data to the ACL from top to bottom one by one, when found it matches one of the ACL, then process it according to the specified ACL operation (access or deny), and stop the searching; if still didnt find the matching till the end of the ACL, then discard this data packet using the hidden statement–deny any which is at the end of ACL.
For ACL, from the working principle point of view, it can be divided into two types:
1. entry ACL
2. exit ACL
The above interpretation for the working process is for the exit ACL. It is the match operation after the data packet routers entered the routing interface and made the routing selecting and found out the exit; while entry ACL refers to the match operation when the data enters the router interface, it reduced the table look-up process.
We can not say entry routing table is better than exit table becuase it omitted the routing process, it should be in accordance with the actual situation:
As the exhibit shows, adopted the basic ACL–Access Control aimed at the source.
Requirements are as follows:
1、Deny1.1.1.2Access3.1.1.2but permit5.1.1.2
2、Deny3.1.1.2Access1.1.1.2but permit5.1.1.2
Adopt the Basic ACL to control it
R1(config)#access-list 1 deny 1.1.1.2 0.0.0.255R1(config)#access-list 1 permit anyR1(config)#int e0R1(config-if)#access-group 1 inR2(config)#access-list 1 deny 3.1.1.2 0.0.0.255R2(config)#access-list 1 permit anyR2(config)#int e0R2(config-if)#access-group 1 in
From a command perspective, the distribution seems to be able to meet the conditions.
Assuming that there are data packets from 1.1.1.2 to 3.1.1.2 after entered the router interface E0, here adopts the entry table, then it needs not to check the routing table but match the ACL directly, if found expression access-list 1 deny 1. 1.1.2 0.0.0.255 reject the data packets, and discarded it; assuming that data packets from 3.1.1.2 to 1.1.1.2, ibid.
When 1.1.1.2 want to communicate with 5.1.1.2, the data packet will also be refused.
When 3.1.1.2 want to communicate with 5.1.1.2, the data packet will be refused too.
The ACL will only control the source, so no matter where it is, as long as meet the matching source, then take the operation.
How to solve this problem?
1. Put the source into the nearest position to the target, and adopt exit control.
2. Make ACL to control the target address.
The first solution will be well understood, because the standard ACL will only control the source, if you put it into the nearest position to the source, then it will cause unnecessary loss of data packets, usually we put the standard ACL into the nearest position to the target!
The second solution, it is necessary to control target addresses. Because standard ACL only against the source, so here, we can not adopt the standard ACL, but adopt the extended ACL. But it also has its disadvantages, it has o search for many data items, although the control is very precise, but the speed has been relatively slow down.
Simple Comparison of the following standard and expansion ACLs:
Standard ACL only controls the source;
Expansion ACL can control some kind of agreement, the source, target and the port number.
Can be seen from the command line:
Standard ACL：Router(config)#access-list list-number Expansion ACL：Router(config)#access-list list-number protocol source {source-mask destination destination-mask} [operator operand] [established] [log]
Protocol-an agreement to designate types, such as IP, TCP, UDP, ICMP and IGRP, etc.
Source and destination-source and purpose were used to label the source address and destination addresses
Source-mask and destination-mask-source and purpose of the wildcard mask
Operator operand-It, gt, eq, neq (were less than, greater than, equal to, not equal to) and a port number
Established - If the data packet has been constructed to a provide link (for example, with ACK Section), access the TCP information.
In order to avoid too many look-up table, so generally put the expansion ACL into the nearest position to the source.
After reading the above, then we can look at the following examples about CISCO Access Control Lists:
1、What are two reasons that a network administrator would use access lists? (Choose two.)
A:to control vty access into a router
B:to control broadcast traffic through a router
C:to filter traffic as it passes through a router
D:to filter traffic that originates from the routerE:to replace passwords as a line of defense against security incursions
Answers: A, C
Note: The question mainly reviews the Cisco candidates on the understanding of ACL functions: the two reasons for network administrators to use ACL in the network?
Choice A pionts out a usage of CISCO visit List: by VTY line to visit the Router of Access Control.
ACL can not effectively control the broadcasting flow which goes through the router.
Choice C also pointed out one of ACL functions, to filter the flow through the router.
Here we should pay attention to that only the “go through” flow from the router can be controled by ACL, but the flows of the router itself, such as update text of the routing, ACL will have not any role effect on it: because ACL will not filter the flow of the router itself, so D is also wrong;
2、For security reasons, the network administrator needs to prevent pings into the corporate networks from hosts outside the internetwork. Which protocol should be blocked with access control lists?
A: IP
B: ICMP
C: TCP
D: UDP
Answers: B
Security reasons, network administrators want to prevent the external host to PING internal corporate networks from the Internet, which agreement must be blocked from the visit list? PING uses the ICMP agreement, in ACL, we need to define to allow or reject the flow of a certain agreements by ourselves. The correct answer is B.
3、Refer to the exhibit. The access list has been configured on the S0/0 interface of router RTB in the outbound direction. Which two packets, if routed to the interface, will be denied? (Choose two.)
access-list 101 deny tcp 192.168.15.32 0.0.0.15 any eq telnet
access-list 101 permit ip any any
A:source ip address: 192.168.15.5; destination port: 21
B:source ip address:, 192.168.15.37 destination port: 21
C:source ip address:, 192.168.15.41 destination port: 21
D:source ip address:, 192.168.15.36 destination port: 23E:source ip address: 192.168.15.46; destination port: 23
Correct Answers: B, E
As the exhibit shows, configurate the visit list on RTB, to control the telnet flow launched by the 192.168.15.32/29 from the S0 / 0 away to the outside of the network, allowing other traffic through. Telnet uses the 23rd port, thus exclude the three choices A、B and C. The correct answers are D, E.
Robin Lee :: Jun.25.2008 ::
Articles And Tutorials ::
No Comments »