Packet filtering helps control packet movement through the network.
|
Such control can help limit network traffic and restrict network use by certain users or devices.
|
You use access lists to permit or deny packets from crossing specified interfaces.
|
An access list is a sequential collection of permit and deny conditions that apply to IP addresses.
|
The Cisco IOS tests addresses against the conditions in an access list one by one.
|
The first match determines whether the Cisco IOS accepts or rejects the address.
|
Because the Cisco IOS stops testing conditions after the first match, the order of the conditions is critical.
|
If no conditions match, the Cisco IOS rejects the address.
|
You can use access lists in several ways:

• to control the transmission 
  of packets on an interface
|
• to control virtual terminal 
  line access
|
• to restrict contents of 
  routing updates
@@
After you create an access list, you can apply it to one or more interfaces.
|
You can apply access lists on either inbound or outbound traffic on interfaces.
|
When you define an inbound access list, and the router receives a packet, the router checks the source address of the packet against the access list.
|
If the access list permits the address, the router continues to process the packet.
|
If the access list denies the address, the router discards the packet.
|
The router then returns an ICMP Host Unreachable message.
|
When you define outbound access lists, the incoming packet is routed to a controlled interface.
|
The router then checks the source address of the packet against the access list.
|
If the access list permits the address, the router transmits the packet.
|
If the access list rejects the address, the router discards the packet.
|
And then returns an ICMP Host Unreachable message.
@@
You define a standard access list using the Access-List command in global configuration mode.
|
The syntax of the command is

  access-list £Baccess-list-number£b  {permit|deny}       {source[£Bsource-wildcard£b]|any}
|
The £Baccess-list-number£b identifies the list to which the entry belongs.
|
It can be any number from 1 to 99.
|
In the example shown here, it is 3.
|
Specifying the permit or deny keywords indicates whether this entry allows or blocks traffic from the specified address.
|
The £Bsource£b identifies the traffic source's IP address.
|
Of course, source could represent a range of IP addresses if a subnet address is specified.
|
<F>The £Bsource-wildcard£b identifies which bits in the address field are matched.
|
Specifying the keyword "any" means that the address 0.0.0.0 is used with the mask 255.255.255.255 and matches any address.
|
In this example, traffic from 172.16.128.3 is permitted.
|
So host B can reach the host A.
|
But host C cannot reach host A.
|
The 0.0.0.255 mask implies that traffic from all other hosts on the 172.16.128.0 subnet is denied.
|
Traffic from other subnets on the 172.16.0.0 network is permitted.
|
So host D can reach host A.
|
It is a good idea to organize an access list so that more specific references in a network or subnet appear before more general ones.

You should also place frequently occurring conditions before less frequent conditions.
@@
If you omit the mask from an associated IP host address access list specification, 0.0.0.0 is assumed to be the mask.
|
In this example, the 0.0.0.0 mask is implicit.
|
This reduces the typing required for large numbers of individual addresses.
|
When you create an access list, by default the end of the list contains an implicit deny statement.
|
So any addresses not accounted for in the list are denied.
|
So in the example shown here, all other access, such as from hosts on a different network (192.168.0.0), is denied.
|
Once you create an access list, you cannot selectively add or remove access list command lines from the list.
|
Any subsequent additions that you make are placed at the end of the list.
|
If you attempt to apply an access list that has not yet been defined, the software will act as though there is no access list.
|
This situation is equivalent to a "permit any" statement and all packets will be accepted.
|
Once you have defined the conditions in the access list, you then need to associate it with a router interface.
|
You use the IP Access-Group command in interface configuration mode to link an existing access list to an interface.
|
Only one access list per port per protocol is allowed.
|
The syntax of the command is

  ip access-group £Baccess-list-number£b {in|out}
|
The £Baccess-list-number£b indicates the number of the access list to be linked to the interface.
|
Specifying the keyword "in" defines processing of packets arriving on the interface.
|
Using the keyword "out" defines processing of packets leaving the interface.
|
The policy goal is to filter traffic reaching host A.
|
So in the example shown here, the previously defined access list number two is applied to incoming traffic on the Dublin router's E0 interface.
|
Configuring the access list for inbound traffic saves some processing time.
@@
You can define access lists to restrict virtual terminal access.
|
To restrict incoming and outgoing connections between a particular virtual terminal line (into a device) and the address in an access list you use the Access-Class command in line configuration mode.
|
The syntax of the Access-Class command is

  access-class £Baccess-list-number£b {in|out}
|
The £Baccess-list-number£b indicates the number of the access list to be linked to this terminal line.
|
Using the keyword "in" applies the access list to inbound connections.
|
Using the keyword "out" applies it to outbound connections.
|
In the example shown here, only hosts in subnet 172.16.192.0 are included in the access list.
|
This access list is then applied to the SanFran router's virtual terminal lines.
|
So only those hosts can establish connections with the router's terminal ports.
|
The implicit deny statement still applies in this case, restricting access to any addresses not explicitly mentioned in the access list.
|
In this example an access list permitting access to network 10.0.0.0.0 is defined.
|
It is then applied to the router's terminal lines, but this time to outbound connections.
|
So outbound terminal line connections to networks other than 10.0.0.0.0 are denied.
@@
Let's look at an example of configuring standard access lists on a Cisco router.
|
Network 172.16.0.0 is a class B network that has been subnetted; the third octet is now the subnet identifier (subnet mask 255.255.255.0).
|
The purpose of the access list here is to restrict traffic from the 172.16.128.0 subnet.
|
The goal is to allow traffic from the server only (IP address 172.16.128.3), and restrict all other traffic from that subnet.
|
So here, for example, any traffic from the workstation (IP address 172.16.128.4) will be denied by the router.
|
Assume now that you are logged in to the SanFran router and that you have entered privileged mode.
|
You enter £Rconfig term£r to access global configuration mode.
|
Say that this is access list number 3.
|
To allow traffic from the server you enter £Raccess-list 3 permit 172.16.128.3£r.
|
To prevent traffic from the rest of the subnet you enter £Raccess-list 3 deny 172.16.128.0 0.0.0.255£r.
|
Next you specify an interface for access list number 3.
|
In this case the access list will be applied to incoming traffic on the SanFran router's E0 interface.
|
You enter interface configuration mode by entering £Rinterface ethernet 0£r.
|
Then you enter £Rip access-group 3 in£r.
|
You press £UCtrl+Z£u to leave configuration mode.
|
And you can save the new configuration in NVRAM by entering £Rcopy run start£r.
@@
Let's look at the effect the access list configuration has.
|
Of course, this assumes that no unforeseen events have affected connectivity with the host addresses.
|
The access list is applied to incoming traffic on the SanFran router's E0 interface.
|
So to test the effects of access list operation, you first log on to another router, in this case, the Dublin router.
|
From the Dublin router you attempt to reach the server by entering £Rping 172.16.128.3£r.
|
As you can see the attempt is successful.
|
Now you can attempt to reach a workstation on the server's LAN by entering £Rping 172.16.128.4£r.
|
Here, the test fails.
|
The access list prevents contact from being made.
@@
Here you'll configure a standard access list on a Cisco router.
|
The goal of this access list is to filter traffic coming from an office LAN linked to the Sydney router.
|
You need to allow traffic from the LAN server (IP address 172.16.32.5), but deny traffic from the rest of the 172.16.32.0 subnet.
|
Assume that you are logged in to the SanFran router, and that you have entered privileged mode.
|
You enter £Rconfig term£r to access global configuration mode.
|
You enter £Raccess-list 2 permit 172.16.32.5£r to define access list number 2 allowing traffic from the server.
|
To deny access to all other traffic on the server's subnet you enter £Raccess-list 2 deny 172.16.32.0 0.0.0.255£r.
|
Next you need to link the access list to an interface, in this case the Sydney router's E0 interface (IP address 172.16.32.5).
|
You enter £Rinterface ethernet 0£r to access interface configuration mode.
|
You enter £Rip access-group 2 in£r to apply access list number 2 to incoming traffic on the Sydney router's E0 interface.
|
Then you press £UCtrl+Z£u to leave configuration mode.
@@
Now you can test your newly defined access list.
|
First you log on to another router, in this case the London router.
|
You enter £Rtelnet 172.16.66.1£r to access the London router.
|
You can confirm that the access list allows traffic from the server by entering £Rping 172.16.32.5£r.
|
You enter £Rping 172.16.32.6£r to try to reach a workstation on the server's subnet.
|
The workstation cannot be reached, indicating that this access list configuration is successful.
@@
