5.2.a ACLs

What this objective tests

The exam wants you to write, apply, and verify Access Control Lists (ACLs). Most exam mistakes come from five places: wildcard masks, direction, sequence order, the implicit deny, and the wrong application point. This matters because ACLs are the most common traffic filter in an enterprise network.

How an ACL works

An ACL is an ordered list of statements. The device checks packets from the top. The first match wins. If no statement matches, the implicit deny any at the end drops the packet.

seq 10 permit tcp users servers eq 443  -> match, permit, STOP
seq 20 deny ip users servers log        -> match, deny, STOP
seq 30 permit ip any any                -> match, permit, STOP
implicit deny any                       -> no match, DROP

Standard versus extended

Use a named ACL in new work. Named ACLs are easier to read and edit. Numbered and named ACLs behave the same after creation.

! Numbered
access-list 10 permit 10.10.10.0 0.0.0.255

! Named, same result
ip access-list standard MGMT-SOURCES
 permit 10.10.10.0 0.0.0.255
 deny any log

Wildcard masks

A wildcard mask is inverted from a subnet mask. A 0 bit means must match. A 1 bit means ignore.

Shortcuts: host 10.10.10.50 equals 10.10.10.50 0.0.0.0. The keyword any equals 0.0.0.0 255.255.255.255.

Direction and application

Direction is from the interface point of view:

• Inbound: traffic entering the interface.
• Outbound: traffic leaving the interface.

Apply an interface ACL with ip access-group NAME in or out. On a line, use access-class to filter management sessions by source. See 5.1.a Lines and local user authentication.

Example: users to servers on SW1

Scenario: VLAN 10 is users (10.10.10.0/24). VLAN 20 is servers (10.20.20.0/24). The DNS resolver is 10.30.30.53. Users may reach servers on HTTPS and the resolver on DNS only.

ip access-list extended USERS-TO-SERVERS
 remark HTTPS to server VLAN
 permit tcp 10.10.10.0 0.0.0.255 10.20.20.0 0.0.0.255 eq 443
 remark DNS to the resolver
 permit udp 10.10.10.0 0.0.0.255 host 10.30.30.53 eq 53
 permit tcp 10.10.10.0 0.0.0.255 host 10.30.30.53 eq 53
 remark Deny everything else to the server VLAN
 deny ip 10.10.10.0 0.0.0.255 10.20.20.0 0.0.0.255 log
 remark Permit all other traffic
 permit ip any any

interface Vlan10
 description Users
 ip access-group USERS-TO-SERVERS in

Note: Do not rebuild a live ACL to edit it. Enter the ACL and add a statement with a free sequence number, such as 15 permit ... between 10 and 20.

Expected verification output after tests:

SW1# show access-lists USERS-TO-SERVERS
Extended IP access list USERS-TO-SERVERS
    10 permit tcp 10.10.10.0 0.0.0.255 10.20.20.0 0.0.0.255 eq 443 (42 matches)
    20 permit udp 10.10.10.0 0.0.0.255 host 10.30.30.53 eq domain (17 matches)
    30 permit tcp 10.10.10.0 0.0.0.255 host 10.30.30.53 eq domain
    40 deny ip 10.10.10.0 0.0.0.255 10.20.20.0 0.0.0.255 log (3 matches)
    50 permit ip any any (128 matches)

The match counters prove which statement each test hit. Zero matches on an expected line means the traffic matched an earlier statement or never arrived.

Example: anti-spoofing edge ACL

Scenario: R1 is the Internet edge. The inside network is 10.0.0.0/8. Public addresses come from the provider. Block packets that arrive from outside with inside source addresses. Block the common unroutable ranges too.

ip access-list extended EDGE-IN-ANTISPOOF
 remark Block our own space arriving from outside
 deny ip 10.0.0.0 0.255.255.255 any log
 remark Block loopback and link-local sources
 deny ip 127.0.0.0 0.255.255.255 any log
 deny ip 169.254.0.0 0.0.255.255 any log
 remark Permit everything else inbound
 permit ip any any

interface GigabitEthernet0/0/0
 description Internet edge
 ip access-group EDGE-IN-ANTISPOOF in

A packet from the Internet with source 10.10.10.50 is forged. The first statement drops and logs it.

IPv6 ACLs

IPv6 ACLs are always named and use prefix lengths, not wildcard masks. Apply them with ipv6 traffic-filter.

ipv6 access-list V6-USERS-TO-SERVERS
 permit tcp 2001:db8:10::/64 2001:db8:20::/64 eq 443
 deny ipv6 2001:db8:10::/64 2001:db8:20::/64 log
 permit ipv6 any any

interface Vlan10
 ipv6 traffic-filter V6-USERS-TO-SERVERS in

Lab: users to servers

Topology:

[PC1 10.10.10.50] ---- [SW1] ---- [SRV1 10.20.20.10]
                    VLAN 10      VLAN 20
                              [DNS 10.30.30.53]

Do these steps:

1. Create the named extended ACL USERS-TO-SERVERS with the five statements from the example.
2. Apply it inbound on interface Vlan10.
3. From PC1, open an HTTPS connection to SRV1.
4. From PC1, send a DNS query to 10.30.30.53.
5. From PC1, try SSH to SRV1. Confirm it fails.
6. From PC1, ping an address outside the server VLAN. Confirm it works.
7. Run show access-lists USERS-TO-SERVERS.
8. Match each counter to a test you ran.

Expected results:

• HTTPS and DNS work. Their counters increase.
• SSH to SRV1 fails. The deny counter increases.
• Other traffic works. The final permit counter increases.

Exam traps

• The first match wins. Put specific statements above broad ones.
• deny ip any any log on a busy transit ACL punishes the CPU. Log denies on low-rate filters only.
• access-class filters management sessions on a line. ip access-group filters traffic on an interface.
• An ACL with no permit statements blocks everything. The implicit deny is always there.
• ACLs match headers only. They do not identify applications like an NGFW.

Pass check

You are ready for this objective when you can do these things:

• Write the wildcard mask for any subnet in under ten seconds.
• Choose standard or extended and the correct placement for a scenario.
• Explain inbound and outbound from the interface point of view.
• Prove a filter works with show access-lists match counters.
• Write an anti-spoofing ACL for an Internet edge interface.