Configuring a Standard IP Access Lists To Block A Telnet Session

Download Activity HERE

Access-list (ACL) is a set of rules defined for controlling the network traffic and reducing network attack. ACLs are used to filter traffic based on the set of rules defined for the incoming or out going of the network.

ACL features –

1. The set of rules defined are matched serial wise i.e matching starts with the first line, then 2nd, then 3rd and so on.
2. The packets are matched only until it matches the rule. Once a rule is matched then no further comparison takes place and that rule will be performed.
3. There is an implicit deny at the end of every ACL, i.e., if no condition or rule matches then the packet will be discarded.

Once the access-list is is built, then it should be applied to inbound or outbound of the interface:

• Inbound access lists – When an access list is applied on inbound packets of the interface then first the packets will processed according to the access list and then routed to the outbound interface.
• Outbound access lists – When an access list is applied on outbound packets of the interface then first the packet will be routed and then processed at the outbound interface.

Types of ACL –

There are two main different types of Access-list namely:

1. Standard Access-list – These are the Access-list which are made using the source IP address only. These ACLs permit or deny the entire protocol suite. They don’t distinguish between the IP traffic such as TCP, UDP, Https etc. By using numbers 1-99 or 1300-1999, router will understand it as a standard ACL and the specified address as source IP address.
2. Extended Access-list – These are the ACL which uses both source and destination IP address. In these type of ACL, we can also mention which IP traffic should be allowed or denied. These use range 100-199 and 2000-2699.

Also there are two categories of access list:

1. Numbered access list – These are the access list which cannot be deleted specifically once created i.e if we want to remove any rule from an Access-list then this is not permitted in the case of numbered access list. If we try to delete a rule from access list then the whole access list will be deleted. The numbered access list can be used with both standard and extended access list.
2. Named access list – In these type of access list, a name is assigned to identify an access list. It is allowed to delete a named access list unlike numbered access list. Like numbered access list, these can be used with both standard and extended access list.

Rules for ACL –

1. The standard Access-list is generally applied close to the destination (but not always).
2. The extended Access-list is generally applied close to the source (but not always).
3. We can assign only one ACL per interface per protocol per direction, i.e., only one inbound and outbound ACL is permitted per interface.
4. We can’t remove a rule from an Access-list if we are using numbered Access-list. If we try to remove a rule then whole ACL will be removed. If we are using named access lists then we can delete a specific rule.
5. Every new rule which is added into the access list will be placed at the bottom of the access list therefore before implementing the access lists, analyse the whole scenario carefully.
6. As there is an implicit deny at the end of every access list, we should have at least a permit statement in our Access-list otherwise all traffic will be denied.
7. Standard access lists and extended access lists cannot have the same name.

By default, an access-list doesn’t keep track of the sessions. An access-list consist of various permit and deny rules which are scanned from top to bottom. If any of the condition matches then it is executed and no other condition is matched.

For a very small office, a reflexive Access-list acts as stateful firewall as it allows only those traffic which is initiated within the network and deny other packets coming from outside network.

Reflexive Access-list –
Reflexive Access-list is an access-list which allows only the replies of the packets of the sessions initiated within the network (from the outside network) .

Working –

When a session is initiated within the network and going outside the network through router (operating reflexive Access-list), reflexive Access-list are triggered.Therefore, it creates a temporary entry for the traffic which is initiated within the network and allows only those traffic from the outside network which is a part of the session (traffic generated within the network).This temporary entry is removed when the session ends.

characteristics of temporary entry –

1. The entry specifies the same source and destination address as original outbound packet (the packet going outside the network), except they are swapped when coming from outside the network.
2. The entries should have same source and destination port number as the original outbound packet, except they are swapped when coming from outside the network.
3. The entry should have same protocol as the original outbound packet.

Characteristics of Reflexive access-list –

1. Reflexive Access-list should be nested inside the named Extended Access-list.
2. It cannot be applied directly to an interface.
3. A temporary entry is generated when a session begins and automatically destroyed when session ends.
4. It does not have implicit deny at the end of Access-list.
5. Just like normal access-list, if one the condition matches then no more entries are evaluated.
6. Reflexive Access-list cannot be defined with numbered Access-list
7. Reflexive Access-list cannot be defined with named or numbered standard Access-list.