Access Control Lists (ACLs)

As long as a router has a route to a destination network and it can reach its next hop, it will forward packets toward that destination. The next question is whether you always want that to happen.

What if you need to prevent certain networks - or even specific IP addresses - from communicating? Default routing behavior won’t help here, because routing decisions are based on reachability, not security policy.

To control which devices can communicate without changing the routing table, you can configure Access Control Lists (ACLs).

Access Control Lists (ACLs) is a Network Security topic however, in order to configure Network Address Translation (NAT), which is an IP Services topic, you must know how to configure ACLs, which is the reason why this topic is being introduced in the Network Services section.

Access control lists (ACLs)

An Access Control List (ACL) is a list of statements (often called entries) that tells a router to permit or deny packets.

You can apply an ACL to a router interface so packets are filtered:

• As they enter an interface (inbound)
• As they leave an interface (outbound)

ACLs can be used for several purposes (some appear later in this book). For CCNA-level work, the most common use is filtering IP packets as they enter or exit a router interface.

ACLs work by having the router inspect specific fields in a packet and compare them to the values in the ACL entries. When a packet matches an entry, the router takes the action in that entry (permit or deny).

ACLs can match values within IPv4 packets and also IPv6 packets as well however, for the CCNA 200-301 v1.1 exam and throughout this book, we will only be discussing ACLs for IPv4 packets.

Standard ACLs

There are two types of ACLs you can configure on a router:

• Standard ACLs
• Extended ACLs

We’ll start with Standard ACLs. A Standard ACL can match only the Source IP Address field of an IP packet.

Image 193

Image Title - Source IP Address field of an IP packet matching an ACL entry

Let’s use the scenario shown below, with R1 connected to three networks and R2 connected to two networks.

Image 194

Image Title - R1 connected to 3 networks and R2 connected to 2 networks

• The 192.168.1.0/24 network is connected to R1’s GigabitEthernet0/0.
• The 10.1.1.0/24 network is connected to R1’s GigabitEthernet0/1.
• The 100.64.1.0/30 network is connected to R1’s GigabitEthernet0/2.
• R2 is also connected to the 100.64.1.0/30 network on its GigabitEthernet0/2 (to connect to R1).
• The 172.16.1.0/24 network is connected to R2’s GigabitEthernet0/0.

Now suppose you want to prevent devices in 192.168.1.0/24 (behind R1) from communicating with devices in 172.16.1.0/24 (behind R2).

With a Standard ACL, the only thing you can match is the source address. So you would create a Standard ACL that denies packets whose source IP is in 192.168.1.0/24.

To enforce the policy specifically for traffic going into 172.16.1.0/24, you would apply that ACL so it blocks matching packets from exiting R2’s GigabitEthernet0/0 interface (the interface that leads to 172.16.1.0/24). This prevents the two networks from communicating.

Applying an ACL to a router interface (inbound vs. outbound)

After you create the ACL entries (the statements and their permit/deny actions), you must apply the ACL to an interface.

An ACL can be applied:

• Inbound: the router checks the packet against the ACL as the packet enters the interface.
• Outbound: the router checks the packet against the ACL before the packet leaves the interface.

Image 195

Image Title - Applying an ACL inbound vs. outbound of a router interface

For the previous example, the logic would look like this:

Image 196

Image Title - IP packets coming from 192.168.1.2 and 192.168.3 being denied on R2’s GigabitEthernet0/0 router interface

In the diagram, any packet sourced from 192.168.1.0/24 is denied from exiting R2’s GigabitEthernet0/0 (toward 172.16.1.0/24). That blocks communication between the two networks.

Filtering Host addresses in an ACL

Now suppose you want to allow one host from 192.168.1.0/24 to communicate with 172.16.1.0/24.

You would add another ACL entry that permits that specific host. For example, to allow 192.168.1.100:

Image 197

Image Title - IP packets coming from 192.168.1.100 being allowed on R2’s GigabitEthernet0/0 router interface

The key difference is how you define the wildcard mask in the ACL. We’ll cover wildcard masks later in this chapter.

ACL “top-down” processing and the Implicit Deny

If you stop after adding only a few permit/deny entries, you can accidentally block more traffic than you intended. This happens because of two core ACL behaviors:

1. Top-down processing
2. The Implicit Deny

An ACL is processed from the top down, one entry at a time. When a packet matches an entry:

• The router takes the action (permit or deny).
• The router stops checking the rest of the ACL.

So even if a later entry would match the same packet with a different action, it won’t matter - the first match wins.

Image 198

Image Title - ACL top-down processing

That also means that whenever you add a new entry (statement) to an ACL, it gets added to the bottom of the list

If a packet does not match any visible entry, the router reaches a hidden final rule called the Implicit Deny. This rule:

• Exists in all ACLs by default
• Is not shown in the running configuration
• Denies all IP packets

Its purpose is to enforce a strong default security posture.

Image 199

Image Title - Implicit Deny at the bottom of every ACL

It is very important to remember that at the bottom of each and every ACL (no matter the type), exists what is called the Implicit Deny statement. This means that if the Router cannot find a match in the ACL for any given packet, it will eventually reach the bottom of the ACL that contains the hidden Implicit Deny statement that denies all IP packets.

If you want all other traffic (traffic not matched by earlier entries) to be allowed into 172.16.1.0/24, you must add an explicit entry that permits everything else. This is commonly described as adding a “permit any” statement to negate the Implicit Deny.

Image 200

Image Title - Allowing all other IP packets sourced from any network to exit out of R2’s GigabitEthernet0/0 router interface

ACLs can essentially be applied on any Router and in any direction (inbound or outbound) on a router interface. You may be wondering why then, did we choose to apply our ACL outbound on R2’s GigabitEthernet0/0 router interface. There is a rule of thumb that states that Standard ACLs should be applied closest to the destination. The reason for this is because Standard ACLs can only specify a source IP address and since this is the case, we have to be careful where we apply the ACL.

In the example above, we are denying any packets coming from the 192.168.1.0/24 network. Let’s say that we applied that ACL on the GigabitEthernet0/2 interface on R1. If we were to do that, then we would essentially block any traffic coming from the 192.168.1.0/24 network from leaving the site, which is not what we want. Since we only want to block traffic from 192.168.1.0/24 to reach the 172.16.1.0/24 network (with the exception of the 192.168.1.100 IP address), then the best place to apply the ACL is outbound on the GigabitEthernet0/2 interface of R2, which leads to the 172.16.1.0/24 network.

That is the reason for this golden rule. We also have to be careful of the implicit deny at the bottom of each ACL, so we also configured a “Permit Any” statement that allows packets from all other source IP addresses through.