Security On Router

Security On Router

Security On Router Access control lists (ACLs)

Access Control Lists (ACL) are used for security feature of Cisco IOS. By using Access Control Lists (ACL), we can permit or deny access to the network services.
It is a layer 3 security which control the flow of traffic from one router to another.
It is a powerful tool to control network traffic.
Is used to manage the IP traffic as an network grown.
It is used to manage permit or denied packet traffic through the router.
Access list is used to filter the unwanted packet while implementing security policy ,is also called packet Firewall filtering.

Types of ACL :

Standard Access Lists
Extended Access Lists
Named Access Lists

Terminology used in Access control list

Deny : blocking a network/host , subnet, services
Permit : Allowing a network/host , subnet, services
Source Add : address of the PC from where the request start
Destination Add : the address of the PC where the request end.
Inbound : traffic coming into the interface
Outbound : traffic going out of the interface
Protocol : IP, TCP, UDP, ICMP

Access Control Lists (ACL) Type Access Control Lists (ACL) Numbers
IP Standard 1–99, 1300–1999
IP Extended 100–199, 2000–2699

 Number between 1–99 or 1300–1999 is used for creating Standard Access Control List (ACL).

Number between 100–199 or 2000–2699 is used for creating extended IP Access Control List (ACL) .

Access Control Lists

Standard ACL

This list number lies between 1 to 99
Can block a network , host or subnet
Two way communication is stopped
All service are blocked
Implemented closest to the router.

Standard IP Access List

Standard IP lists (1-99) only check source addresses of all IP packets.

Configuration Syntax
access-list access-list-number [permit | deny] source [source-mask]

Apply ACL to an interface
ip access-group access-list-number [in | out]

Example of Standard IP Access List

Configuration:

Below example will only allow network 10.0.0.0/8 to access server

Define which source is allowed to pass:

Apply this ACL to an interface:

Now it will deny all other traffic and only allow from 10.0.0.0/8.

The “0.255.255.255” is the wildcard mask part of network “10.0.0.0”.

Extended ACL

This list number lies between 100 to 199
Can block a network, host, subnet and services
One way communication is stopped
Selected service can be blocked
Implemented closest to the source.

Extended IP Access List

Configuration Syntax
access-list access-list-number [permit | deny] protocol source [source-mask] destination [destination-mask] [eq destination-port]

Example of Extended IP Access List

below example will deny FTP traffic from network 10.0.0.0/8 but allow other traffic .

Define which protocol, source, destination and port are denied:

Apply this ACL to an interface:

 

Operator Description
lt Less than
gt Greater than
neq Not equal to
eq Equal to range Range of port numbers

Named IP Access List

This allows standard and extended ACLs to be given names instead of numbers

Named IP Access List Configuration Syntax
ip access-list [standard | extended] [name | number]

Example of Named IP Access List

Define the ACL:

Apply this ACL to an interface:

Common TCP Port Names used in ACL

Port Name Keyword
FTP Data (TCP port number 20) ftp-data
FTP Control (TCP port number 21 ) ftp
Telnet (TCP port number 23) telnet
SMTP (TCP port number 25) smtp
HTTP (TCP port number 80) www

Common UDP Port Names Port Name

Keyword
DNS (UDP port number 53) dns
TFTP (UDP port number 69) tftp
SNMP (UDP port number 161) snmp
IP RIP (UDP port number 520) rip