Cisco Systems



Chapter 27: Access Control Lists (ACL)

Access Control Lists (ACL)

Commandes principales


Il existe 3 principales commandes
  • deny : pour bloquer un traffic
  • Permit : pour autoriser un traffic
  • remark : Comment the list

Types of ACL

  • Standard ACL
  • Extended ACL
  • Named ACL


Paramètres d’analyse

  • Source IP address
  • Destination IP address
  • Source port
  • Destination port
  • Protocol

Configuration Steps

  1. Establish rules list
  2. Apply list on Router interface
NB:
■ N'inversez pas les étapes. Vous risquez de bloquer tout les autres traffics juste après la première règle
■ L'exécution des règles de la liste est chronologique la 1ère règle est prioritaire
■ Annuler une règle vous amène à annuler toute la liste et recommencer
■ Tenir compte de tous les traffics possibles

List Establishing

LAB-R2(config)#access-list ?
<1-99> IP standard access list
<100-199> IP extended access list

LAB-R2(config)#access-list 100 ?
deny Specify packets to reject
permit Specify packets to forward
remark Access list entry comment

LAB-R2(config)#access-list 100 remark MA LISTE POUR SECURISER

LAB-R2(config)#access-list 100 permit ?
ahp Authentication Header Protocol
eigrp Cisco's EIGRP routing protocol
esp Encapsulation Security Payload
gre Cisco's GRE tunneling
icmp Internet Control Message Protocol
ip Any Internet Protocol
ospf OSPF routing protocol
tcp Transmission Control Protocol
udp User Datagram Protocol

Source and Destination
Network: Network-IP wildcard-mask
Host: host host-IP

NB: "any" term used for any host or network

Interfaces Configuration

in : Paquets arrivant sur l'interface
out : Paquets recus par transfert d'une autre interface et quittant l'interface pour un Hôte

ip access-group : Interfaces (Physical, vlan, loopback)
ip access-class : line VTY

Commands

R2>sh access-lists

Types Of ACL

Corp(config)#access-list ?
<1-99> IP standard access list
<100-199> IP extended access list
<1000-1099> IPX SAP access list
<1100-1199> Extended 48-bit MAC address access list
<1200-1299> IPX summary address access list
<1300-1999> IP standard access list (expanded range)
<200-299> Protocol type-code access list
<2000-2699> IP extended access list (expanded range)
<2700-2799> MPLS access list
<300-399> DECnet access list
<700-799> 48-bit MAC address access list
<800-899> IPX standard access list
<900-999> IPX extended access list
dynamic-extended Extend the dynamic ACL absolute timer
rate-limit Simple rate-limit specific access list

Standard ACL

Syntax

LAB-R2(config)#access-list n instruction Source


 n value between [1-99]

access-list n deny host PC IP
access-list n deny net IP wild-card mask
access list n permit any
int interface
ip access-group n out

Controlling VTY (Telnet/SSH) Access

You need to do these two things to make this happen:

1. Create a standard IP access list that permits only the host or hosts you want to be able to telnet into the routers.

2. Apply the access list to the VTY line with the access-class in command. Here, I’m allowing only host 172.16.10.3 to telnet into a router:

Lab_A(config)#access-list 50 permit host 172.16.10.3
Lab_A(config)#line vty 0 4
Lab_A(config-line)#access-class 50 in

Extended ACL

Syntax

LAB-R2(config)#access-list n instruction Protocol source Source-Port destination Destination-Port

n: between 100 and 199
Instruction: deny or permit
Transport Protocol: UDP, TCP or IP (for no specification)
Source: host IP (for Hosts), IP Wild-card mask (for Networks)

Examples
LAB-R2(config)#access-list n deny ip host sourceIP host destination IP
LAB-R2(config)#access-list n permit ip host sourceIP host destination IP
LAB-R2(config)#access-list n permit ip host sourceIP destination net IP wild-card mask
LAB-R2(config)#access-list n deny tcp host sourceIP host webserver IP eq 80
LAB-R2(config)#access-list n deny tcp host sourceIP host mailserver IP eq 25
LAB-R2(config)#access-list n deny udp host sourceIP host dnsserver IP eq 53
LAB-R2(config)#access-list n deny udp host dnsserver IP eq 53 host destinationIP
LAB-R2(config)#access-list n permit ip any any

int interface
ip access-group n in

Established Setting

Le paramètre established est ajouté à une règle d'autorisation pour autoriser uniquement que les réponses aux requêtes de la source à revenir à la source.

Dans ce cas la destination ne peut pas initier une communication avec la source mais peut répondre aux requêtes recues de la source

LAB-R2(config)#access-list n permit Protocol source Source-Port destination Destination-Port established

Named ACL


Named Standard ACL

LAB-R2(config)#ip access-list standard name
ip access-group name out

  Example
LAB-R2(config)#ip access-list standard MA-LISTE
LAB-R2(config-std-nacl)#permit host 10.0.0.1
LAB-R2(config-std-nacl)#deny 10.0.0.0 0.0.0.255
LAB-R2(config-std-nacl)#permit any

LAB-R2(config-std-nacl)#int f0/0
LAB-R2(config-if)#ip access-group MA-LISTE in

Named Extended ACL

LAB-R2(config)#ip access-list extended name
LAB-R2(config-ext-nacl)#instruction protocol source Destination

ip access-group name in


Example
LAB-R2(config)#ip access-list extended MA-LISTE-ETENDUE
LAB-R2(config-ext-nacl)#permit ip host 10.0.0.1 host 192.168.1.1
LAB-R2(config-ext-nacl)#deny ip 10.0.0.0 0.0.0.255 host 192.168.1.1
LAB-R2(config-ext-nacl)#permit ip any any

LAB-R2(config-ext-nacl)#int f0/1
LAB-R2(config-if)#ip access-group MA-LISTE-ETENDUE in
Eninam BAGNABANA     |         |     bagnadavid@outlook.fr     |