Lesson 49 - Packet Filtering with Extended ACLs

This post I start with presenting solution to the Task 2 I left unanswered in the lesson 49.

Task 2
Configure an IP standard ACL that denies packets coming from the host 172.31.123.3 going towards 192.168.5.0/24. Traffic from other sources should be allowed. 

Again, we use the standard IP ACL here, which is going to be applied on R5. Here goes:

R5 Configuration:

!

! In the global config 

!

access-list 1 deny host 172.31.123.3

access-list 1 permit any

!

! Enter the the incoming interface and apply the access-list

!

interface serial0/2

 ip access-group 1 in

!

Notice!

• access-list 1 - ACL numbers 1-99 are IP standard ACLs (check source of the packets only.
• host 172.31.123.3 - this keyword is an alias for: 172.16.123.3 0.0.0.0. It is a source address of the packets being inspected.
• any - this keyword is an alias for: 0.0.0.0 255.255.255.255 - any source here.

I hope your answers were correct. Now is the time to learn Extended ACLs.

First, look at the syntax you see in Cisco documentation:

Pic. 1 - Extended ACL Syntax.

If you go like: 'OMG!' do not worry because you do not have to use all these keywords.

The options we are going to use can be presented as follows:

Pic. 2 - Extended ACL Common Syntax.

It looks a bit more convoluted but do not worry because in time you will feel quite confident with it. Your best friend is help '?' which is going to show you what options and arguments are required.

The best way to explain the syntax you need to get familiar with is to use an example and try to de-construct it. So, let's look at our topology one more time and create the following filter:

Task 1
Deny telnet sessions coming from 192.168.4.0/24 destined to 172.31.3.0/28 and 172.31.3.16/28. All other traffic should be allowed.

Pic. 3 - Topology.

Icons designed by: Andrzej Szoblik - http://www.newo.pl

Which ACL type should we use?
Since, we are very specific in terms of which protocols we want to deny, we must use Extended ACL. The standard ACL can only match on the source IP address, permitting or denying all protocols the packet is carrying.

Which router/interface should we apply the ACL on?
Our topology clearly shows that R3 has three different interfaces with three different addresses. So, we have two options here:

• We can configure an Extended ACL on R4 FastEthernet 1/0 interface in the inbound direction (close to the source as per ACL guideline)
• We can configure an Extended ACL on R4 Serial0/2 in the outbound direction.
• Alternatively, we can apply an Extended ACL on R3 FastEthernet1/0 (inbound).

I'm going to chose the option suggested by the ACL guide lines: as close to the source as possible.

Let's read the task again:


Task 1

Deny telnet sessions coming from 192.168.4.0/24 destined to 172.31.3.0/28 and 172.31.3.16/28. All other traffic should be allowed.

Here's one way to configure this:

R4 Configuration:

!

! In the global 'config' mode the statements are:

!

access-list 100 deny tcp 192.168.4.0 0.0.0.255 172.31.3.0 0.0.0.15 eq 23

access-list 100 deny tcp 192.168.4.0 0.0.0.255 172.31.3.16 0.0.0.15 eq 23

access-list 100 permit ip any any

!

! Apply the ACL on the interface

!

interface FastEthernet 1/0

  ip access-group 100 in

!

Three lines that 'deny' traffic are similar. Let's dissect its syntax:

access-list 100 deny tcp 192.168.4.0 0.0.0.255 172.31.3.0 0.0.0.15 eq 23

• access-list 100 - The extended ACL (numbers 100-199)
• deny - condition (either 'deny' or 'permit' are allowed)
• tcp - layer 3 or 4 protocol (such as: ip, icmp, tcp, udp, rip, eigrp etc.)
• 192.168.4.0 - source IP address
• 0.0.0.255 - source wildcard mask (inversed mask)
• 172.31.3.0 - destination IP address
• 0.0.0.15 - destination wildcard mask (inversed mask)
• eq - operator: eq (equal), lt (less than), gt (greater than), range
• 23 - destination port (telnet)

Notice!
After source wildcard there is no source port. This means that the source port is not inspected at all (disregarded).

In the next post I'm going to show you few examples of extended ACL which should reinforce your study

Intelligence book

1 Introduction Intelligence may be narrowly defined as the capacity to acquire knowledge and understanding, and use it in different novel situations. It is this ability, or capacity, which enables the individual to deal with real situations and profit intellectually from sensory experience. A test of intelligence is designed to formally study, under test conditions, the success of an individual in adapting to a specific situation. There are a number of different methods which purport to measure intelligence, the most famous of which is the IQ, or intelligence quotient test. In the formation of such tests many psychologists treat intelligence as a general ability operating as a common factor in a wide variety of aptitudes. Whilst many IQ tests measure a variety of different types of ability such as verbal, mathematical, spatial and reasoning skills, there is now a second school of thought in which it is believed that the earlier definitions of intelligence may be too simplistic. It is now becoming increasingly recognised that there are many different types of intelligence and that a high measured IQ, although desirable, is not the only key to success in life. Other characteristics, such as outstanding artistic, creative or practical prowess, especially if combined with personal characteristics such as ambition, good temperament and compassion, could result in an outstanding level of success despite a low measured IQ. It is because of this that in recent years CQ (creative quotient) and EQ (emotional quotient), to name just two examples, have come to be regarded as equally important as, or even more important than, IQ measurement. 1 It should also be pointed out that having a high IQ does not mean that one has a good memory. A good memory is yet another type of intelligence, and could result in high academic success despite a low measured IQ test score. The object of this book is to identify different types of intelligence and bring together tests for different aspects of intelligence into one book, and provide an objective assessment of abilities in a number of different disciplines. This will, therefore, give readers the opportunity to identify their own strengths and weaknesses and thus enable readers to build on their strengths and work at improving their performance in areas of weakness. As well as the identifying of such strengths and weaknesses, the tests and exercises in this book perform another important function, that of using and exercising the brain. Despite the enormous capacity of the brain, we only use on average 2% of our potential brainpower. There is, therefore, the potential for each of us to expand our brainpower considerably. It is important that we continually use our brain, for example, the more we practise at tests of verbal aptitude, the more we increase our ability to understand the meaning of words and use them effectively; the more we practise at mathematics, the more confident we become when working with numbers; and the more we practise our ability to move our fingers and manipulate small objects, the more dextrous we become at operations involving this type of aptitude. Our brain is undoubtedly our greatest asset, yet, for most of us, it is the part of the body we most take for granted. Our brain needs exercise and care in the same way as other parts of the body. We eat the right foods to keep our heart healthy, we moisturise our skin to keep it from drying out and, just as gymnasts strive to increase their performance at whatever level they are competing, by means of punishing training schedules and refinement of technique, there are exercises, or mental gymnastics, we can do to increase the performance of our brain and enhance quickness of thought.

Download the Full PDF Here