Cisco CCNA – Packet Filtering & ACLs

• Filtering traffic entering and existing an interface
• Controlling access to VTY lines
• Route update filtering
• As a traffic classification tool when used with QoS
• Dial-on-demand routing (DDR) with ISDN
• Restricting output of debug commands

This tutorial however, concentrates only the packet filtering using ACLs.

What is an ACL?

An ACL is sequence of command(s) called the Access Control Entry (ACE) that are entered in specific sequence. The specifics of sequence determine how ACL will behave, so it recommended to include the most relevant ACE in the beginning of the ACL.

When ACL is used as packet filter, these ACEs are called packet filtering rules or conditions. Condition look for matches on the content of the packet including:

• Source and destination address
• Layer-2 protocol information such as Ethernet frame type
• Layer-3 protocol including IP, IPX, etc….
• Layer-3 protocol information such as ICMP, OSPF, EIGRP
• Layer-4 protocol and information such TCP or UDP and port numbers

Direction of ACL

An access list can be applied in one direction per interface. For example: you have created an internet filtering ACL to drop ICMP traffic. This ACL can only be applied on internet facing interface in inbound direction not both. If bi-directional filtering is required, a separate ACL in reverse direction can be configured.

The IMPLICIT DENY Condition

At the end of every ACL, there exists an IMPLICIT DENY. It means that for any traffic not permitted explicitly, will be denied. We will look at an example later when configuring an example of standard ACL.

The Wildcard Mask

Also known as the reverse mask. The logic is based on logical AND operation. If there is binary zero, check the corresponding bit and it must match. If a binary one, ignore the corresponding bit value, they don’t need to match. Example: We have a network with 192.168.1.0 with a subnet mask of 255.255.255.0 (or simply 192.168.1.0/24). The wild card mask is created by subtracting from mask: 255.255.255.255. In this case:

255.255.255.255 – 255.255.255.0 = 0.0.0.255.

It means that for the ACE condition to be true or false, the three octets must be 192, 168 and 1. Consider Table-1 for more examples.

TABLE-1: Wildcard Mask

Types of ACLs

There are two types of ACLS.

1. Standard Access List

Standard Access List allows filtering based on the source address of an entity. Since the standard access list test the source addresses, they are efficient at blocking traffic close to destination. There are two expectations to when an address in a standard access list is not the source:

2. One outbound VTY, access list, the address is the destination address rather than source address.

3. When route filtering, network being advertised to you rather than the source address.

The standard access list can either named or numbered. Numbered ACL ranges from: 01-to-99 and 1300-to-1999. Named ACLs allows to ACL to be created using (meaning full) names rather than number. Also human are good in remembering names than numbers.

Configuration

Numbered Standard ACL:

Step-1: configure terminal

Step-2: access-list