1
CCNA 2 Chapter 11
Access Control Lists (ACLs)
Network administrators face a dilemma: They must figure out how to deny unwanted
access while allowing appropriate access. Although security tools such as passwords,
callback equipment, and physical security devices are helpful, they often lack the
flexibility of basic traffic filtering and the specific controls that most administrators
prefer. For example, a network administrator might want to allow users on the LAN to go
out to the Internet through the LAN but not want the users outside the LAN to use the
Internet to telnet into the LAN.
Routers provide basic traffic-filtering capabilities such as blocking Internet traffic with
access control lists (ACLs). In this chapter, you learn about using standard and extended
ACLs as a means to control network traffic and how ACLs are used as part of a security
solution. An ACL is a sequential collection of permit or deny statements that apply to
addresses or upper-layer protocols.
This chapter focuses on standard, extended, and named ACLs. In addition, this chapter
includes tips, considerations, recommendations, and general guidelines for how to use
ACLs and the commands and configurations that are needed to create ACLs. Finally, this
chapter provides examples of standard and extended ACLs and how to apply ACLs to
router interfaces.
Concept Questions
Demonstrate your knowledge of these concepts by answering the following questions in
the space that is provided.
1.
Each school needs two networks: one for curriculum and one for
administration. Draw the LAN design for each of these networks including
separate Ethernet ports on the router.
Sketch should include a router with two Ethernet segments and at least one WAN
interface. Each LAN interface should be connected to a separate switch.
2.
Devise an ACL for the router that denies users from the curriculum LAN
segment assess to the administrative LAN, yet gives the administrative LAN
users complete access to the curriculum LAN segment. Describe how you
would proceed.
Answers will vary depending on addressing scheme used by group.
151x CCNA 2 EJW Ch 11 Answers
2
3.
How would you accommodate e-mail traffic and maintain security?
Answers will vary depending on addressing scheme used by group. Students
should include a statement in the ACL that is allows for e-mail traffic that is
destined for the mail server.
Access-list 101 permit tcp 10.1.1.0
LAN] host 10.1.2.13 [Mail server on
(Outgoing mail – SMTP)
Access-list 101 permit tcp 10.1.1.0
LAN] host 10.1.2.13 [Mail server on
(Incoming mail – POP3)
0.0.0.255 [student
Admin LAN] eq 25
0.0.0.255 [student
Admin LAN] eq 110
Access-list 101 permit tcp 10.1.1.0 0.0.0.255 [student
LAN] host 10.1.2.13 [Mail server on Admin LAN] eq 143
(Incoming mail – IMAP)
4.
How would you develop a firewall for the two systems?
Determine where each of the servers will be placed, either on the Admin or
Curriculum LAN segment. Also decide which VLAN will be supporting the
server farm for that segment. Also determine which group of users should have
access to each server. Where do these requests come from?
5.
Develop the outline for the user ID and password policy.
Answers will vary. Suggest a model that requires a minimum of five
alphanumeric characters in the password. Implement routine password-changing
policies. Security should consider an Windows Active Directory or NDS
structure.
6.
How would you ensure that all computers on the network have Internet
access and still maintain the level of security that is required?
All traffic should pass through one central location. This should be the exit point
on the network. This interface should be secured with an ACL, filtering both
incoming and outgoing packets. Consider using an established ACL.
7.
Outline, in detail, the security needs of this network.
Answers will vary between groups.
8.
What is the purpose of ACLs?
There are many reasons to create ACLs. For example, ACLs can be used to do the
following:
•
Limit network traffic and increase network performance. For
example, ACLs can designate certain packets to be processed by a
router before other traffic, on the basis of a protocol. This is
referred to as queuing, which ensures that routers will not process
151x CCNA 2 EJW Ch 11 Answers
3
packets that are not needed. As a result, queuing limits network
traffic and reduces network congestion.
9.
•
Provide traffic flow control. For example, ACLs can restrict or
reduce the contents of routing updates. These restrictions are used
to limit information about specific networks from propagating
through the network.
•
Provide a basic level of security for network access. For example,
ACLs can allow one host to access a part of your network and
prevent another host from accessing the same area. In Figure 6-2,
Host A is allowed to access the Human Resources network, and
Host B is prevented from accessing the Human Resources
network. If you do not configure ACLs on your router, all packets
passing through the router could be allowed onto all parts of the
network.
•
Decide which types of traffic are forwarded or blocked at the
router interfaces. For example, you can permit e-mail traffic to be
routed, but at the same time block all Telnet traffic.
What condition does a standard ACL use for IP data packets?
You use standard ACLs when you want to block all traffic from a network or a
specific host, allow all traffic from a specific network, or deny protocol suites.
Standard ACLs check the source address of packets that could be routed. The
result permits or denies output for an entire protocol suite (for example, TCP/IP),
based on the network, subnet, and host addresses.
10.
How do extended ACLs differ from standard ACLs?
Extended ACLs check for both source and destination packet addresses. They
also can check for specific protocols, port numbers, and other parameters. This
gives you more flexibility to describe what checking the ACL will do. Packets
can be permitted or denied output based on where the packet originated and based
on its destination.
ACL statements operate in sequential, logical order. If a condition match is true,
the packet is permitted or denied and the rest of the ACL statements are not
checked.
11.
How are standard and extended ACLs differentiated in the router?
When configuring ACLs on a router, you must identify each ACL uniquely by
assigning a number to the protocol’s ACL. When you use a number to identify an
ACL, the number must be within the specific range of numbers that is valid for
the protocol.
⇒ Standard IP ACL # 1–99
⇒ Extended IP ACL # 100–199
151x CCNA 2 EJW Ch 11 Answers
4
12.
The first step to configure an ACL is to write it. What is the second step?
Apply the ACL to an interface
13.
Describe the significance of the wildcard mask 0.0.0.7 ?
The last 3 digits of the subnet mask will be ignored
Vocabulary Exercise
Define the following terms as completely as you can. Use the online curriculum or
CCNA 2 Chapter 11 from the Cisco Networking Academy Program CCNA 1 and 2
Companion Guide, Revised Third Edition, for help.
ACL (access control list)--A list kept by a Cisco router to control access to or from the
router for a number of services (for example, to prevent packets with a certain IP address
from leaving a particular interface on the router).
Address filtering --Restricting packet forwarding based on either the source or
destination address.
Bit bucket--The destination of discarded bits as determined by the router. How do ACLs
compare each data packet to the conditions in the list?
DDR (dial-on-demand routing) --Async Dialup and ISDN are common DDR links that
involve a dialer and wide-area connectivity that is not a full-time dedicated connection.
Deny--The permit or deny term in the global ACL statement indicates how packets that
meet the test conditions are handled by Cisco IOS software. A deny statement will
immediately send a packet to Null0 (bit bucket) if the condition is met.
DNS (Domain Name System) --A system used in the Internet for translating names of
network nodes into addresses.
Extended access--Extended IP access lists use source and destination addresses for
matching operations, and optional protocol type information for finer granularity of
control.
Firewall--A router or an access server, or several routers or access servers, designated as
a buffer between any connected public networks and a private network. A firewall router
uses access control lists and other methods to ensure the security of the private network.
IP--Network layer protocol in the TCP/IP stack offering a connectionless internetwork
service. IP provides features for addressing, type-of-service specification, fragmentation
and reassembly, and security. Documented in RFC 791.
match
Editor’s Note: This vocabulary word was included in error.
Packet--Logical grouping of information that includes a header containing control
information and (usually) user data. Packets are most often used to refer to network layer
151x CCNA 2 EJW Ch 11 Answers
5
units of data. The terms datagram, frame, message, and segment also are used to describe
logical information groupings at various layers of the OSI reference model and in various
technology circles. See also PDU.
PDU (protocol data unit) --The OSI term for a data packet.
Permit--The permit or deny term in the global ACL statement indicates how packets
that meet the test conditions are handled by Cisco IOS software. A permit statement
usually means the packet will be allowed to use one or more interfaces that you will
specify later.
Queuing--A process in which ACLs can designate certain packets to be processed by a
router before other traffic, on the basis of a protocol.
Standard access lists--An ACL that filters based on a source address and mask. Standard
ACLs permit or deny the entire TCP/IP protocol suite.
TCP (Transmission Control Protocol)--Connection-oriented transport layer protocol
that provides reliable, full-duplex data transmission. TCP is part of the TCP/IP protocol
stack.
TCP/IP (Transmission Control Protocol/Internet Protocol) --Common name for the
suite of protocols developed by the U.S. Department of Defense in the 1970s to support
the construction of worldwide internetworks. TCP and IP are the two best-known
protocols in the suite.
UDP (User Datagram Protocol)--Connectionless transport layer protocol in the TCP/IP
protocol stack. UDP is a simple protocol that exchanges datagrams without
acknowledgments or guaranteed delivery, requiring that error processing and
retransmission be handled by other protocols. UDP is defined in RFC 768.
Wildcard bits-- The individual bits that make up the wildcard mask. A wildcard bit set
to a zero (0) instructs the router to check the bit. A wildcard bit set to a one (1) instructs
the router to ignore the bit.
Wildcard masking--A 32-bit quantity used in conjunction with an IP address to
determine which bits in an IP address should be ignored when comparing that address
with another IP address. A wildcard mask is specified when setting up an ACL.
CCNA Exam Review Questions
The following questions help you review for the CCNA exam. Answers appear in
Appendix B, "CCNA Exam Review Questions Answer Key."
1.
Which of the following commands would you use to find out whether ACLs are
set on an interface?
A.
B.
C.
D.
show running-config
show ip protocols
show ip interface
show ip network
151x CCNA 2 EJW Ch 11 Answers
6
2.
What do you call the additional 32 bits of information in the access-list
statement?
A.
B.
C.
D.
3.
Using Router (config)# access-list 156.1.0.0 0.0.255.255 is equivalent to saying
which of the following?
A.
B.
C.
D.
4.
Monitor whether ACLs are set.
Monitor ACL statements.
Monitor ACL debugging.
Monitor groupings.
Which wild card mask will match a host?
A.
B.
C.
D.
7.
True
False
The show access-lists command is used to do which of the following?
A.
B.
C.
D.
6.
Deny my network only.
Permit a specific host.
Permit my network only.
Deny a specific host.
When you issue a permit entry into an ACL that is accompanied by an implicit
deny all, all traffic except that which is listed in the permit statement will be
denied.
A.
B.
5.
Wildcard bits
Access bits
Zero bits
One bits
0.0.0.0
0.0.0.1
255.255.255.255
255.255.255.0
What bit in a wildcard means match?
A.
B.
C.
D.
0
1
254
255
151x CCNA 2 EJW Ch 11 Answers
7
8.
What bit in a wildcard means who cares or no match?
A.
B.
C.
D.
9.
If you do not supply a wildcard mask, what wildcard mask is applied
automatically?
A.
B.
C.
D.
10.
Atlanta#access-list 101 permit any
Atlanta#access-list 10 permit any
Atlanta#(config)#access-list 10 permit any
Atlanta#(config)#access-list 101 permit any
Which command below will create an extended standard ACL?
A.
B.
C.
D.
13.
There is an implicit deny all at the end of all ACLs
A packet can be permitted or denied based on the ACL
Each line of an ACL is checked until a match is made.
A packet that is denied by one statement may be permitted by another
statement.
Which command below will create a standard ACL?
A.
B.
C.
D.
12.
0.0.0.0
255.255.255.0
255.255.255.254
255.255.255.255
Which statement below does not describe the processing of an ACL?
A.
B.
C.
D.
11.
0
1
254
255
Atlanta#access-list 150 permit ip any any
Atlanta#access-list 150 permit ip any any
Atlanta#(config)#access-list 150 permit ip any any
Atlanta#(config)#access-list 150 ip permit any any
Which of the following is not a parameter for an ACL?
A.
B.
Protocol suite
Source address
151x CCNA 2 EJW Ch 11 Answers
8
C.
D.
14.
A router has two Ethernet ports and two serial ports routing IP. What is the
maximum number of IP ACLs that can be configured to filter packets?
A.
B.
C.
D.
15.
The first 27 bits will be ignored
The last 31 bits must match
The last 5 bits will be ignored
The first 28 bits must match
What is the meaning of access-list 150 deny tcp 192.168.5.0 0.0.0.3 any eq 80?
A.
B.
C.
D.
19.
The first 26 bits will be ignored
The last 31 bits must match
The last 5 bits will be ignored
The first 26 bits must match
What is the meaning of the wildcard mask 0.0.0.15?
A.
B.
C.
D.
18.
It will be forwarded back to the source
It will be forwarded
It will be dropped
It will be held in the output queue
What is the meaning of the wildcard mask 0.0.0.31?
A.
B.
C.
D.
17.
4
8
12
16
If a match is not found in an ACL what will happen to the packet?
A.
B.
C.
D.
16.
Destination address
Packet size
All traffic will be permitted
All web traffic to the 192.168.5.0 network will be denied
All web traffic from the 192.168.5.0 network will be denied
Some of the web traffic from the 192.168.5.0 network will be denied
What will happen if the access-list 150 deny tcp 192.168.5.0 0.0.0.3 any eq 80 is
applied to an interface with no other statements?
151x CCNA 2 EJW Ch 11 Answers
9
A.
B.
C.
D.
All traffic will be denied
All web traffic to the 192.168.5.0 network will be denied
All web traffic from the 192.168.5.0 network will be denied
Some of the web traffic from the 192.168.5.0 network will be denied
Editor’s Note: The answer key in the CCNA 1 and 2 Engineering Journal and
Workbook, Revised Third Edition states that the answer is “A.” The correct
answer is actually “D.”
151x CCNA 2 EJW Ch 11 Answers