434 Chapter 12: IP Access Control List Security

ACL 1 keeps packets sent by Bob from exiting R1’s Ethernet interface, based on the matching logic of the access-list 1 deny 172.16.3.10 0.0.0.0 command. The wildcard mask of 0.0.0.0 means “match all 32 bits,” so only packets whose IP address exactly matches 172.16.3.10 match this statement and are discarded. The access-list 1 permit 0.0.0.0 255.255.255.255 command, the last statement in the list, matches all packets, because the wildcard mask of 255.255.255.255 means “don’t care” about all 32 bits. In other words, the statement matches all IP source addresses. These packets are permitted.

The list stops Bob from getting packets to Server1, but it also stops Bob from getting packets to Server2. With the topology shown in Figure 12-1, you cannot use a standard ACL and deny Bob access to Server 1 while permitting access to Server2. You need to use an extended ACL, as discussed in the next section.

Interestingly, IOS changes the configuration shown in Example 12-1. The output of the show running-config command in Example 12-2 shows what IOS actually places in the configuration file.

Example 12-2 Revised Standard Access List Stopping Bob from Reaching Server1

interface Ethernet0

ip address 172.16.1.1 255.255.255.0 ip access-group 1 out

access-list 1 remark stop all traffic whose source IP is Bob access-list 1 deny host 172.16.3.10

access-list 1 permit any

The commands in Example 12-1 are changed based on three factors. Cisco IOS allows both an older style and newer style of configuration for some parameters. Example 12-1 shows the older style, and the router changes to the equivalent newer-style configuration in Example 12-2. First, the use of a wildcard mask of 0.0.0.0 does indeed mean that the router should match that specific host IP address. The newer-style configuration uses the host keyword in front of the specific IP address. The other change to the newer-style configuration involves the use of wildcard mask 255.255.255.255 to mean “match anything.” The newer-style configuration uses the keyword any to replace wildcard mask 255.255.255.255. any simply means that any IP address is matched.

Standard IP ACL: Example 2

The second standard IP ACL exposes more ACL issues. Figure 12-3 and Examples 12-3 and 12-4 show a basic use of standard IP access lists, with two typical oversights in the first attempt at a complete solution. The criteria for the access lists are as follows:

■Sam is not allowed access to Bugs or Daffy.

■Hosts on the Seville Ethernet are not allowed access to hosts on the Yosemite Ethernet.

■All other combinations are allowed.

436 Chapter 12: IP Access Control List Security

At first glance, these two access lists seem to perform the desired function. ACL 3, enabled for packets exiting Yosemite’s S0 interface, takes care of criterion 1, because ACL 3 matches Sam’s IP address exactly. ACL 4 in Seville, enabled for packets exiting its S1 interface, takes care of criterion 2, because ACL 4 matches all packets coming from subnet 10.1.3.0/24. Both routers meet criterion 3: A wildcard permit any is used at the end of each access list to override the default, which is to discard all other packets. So all the criteria appear to be met.

However, when one of the WAN links fails, some holes can appear in the ACLs. For example, if the link from Albuquerque to Yosemite fails, Yosemite learns a route to 10.1.1.0/24 through Seville. Packets from Sam, forwarded by Yosemite and destined for hosts in Albuquerque, leave Yosemite’s serial 1 interface without being filtered. So criterion 1 is no longer met. Similarly, if the link from Albuquerque to Yosemite fails, Seville routes packets through Albuquerque, routing around the access list enabled on Seville, so criterion 2 is no longer met.

Example 12-5 illustrates an alternative solution—one that works even when some of the links fail.

Example 12-5 Yosemite Configuration for Standard Access List Example: Alternative Solution to Examples 12-3 and 12-4

interface serial 0 ip access-group 3 out

!

interface serial 1 ip access-group 3 out

!

interface ethernet 0 ip access-group 4 out

!

access-list 3 remark meets criteria 1 access-list 3 deny host 10.1.2.1 access-list 3 permit any

!

access-list 4 remark meets criteria 2 access-list 4 deny 10.1.3.0 0.0.0.255 access-list 4 permit any

The configuration in Example 12-5 solves the problem from Examples 12-3 and 12-4. ACL 3 checks for Sam’s source IP address, and it is enabled on both serial links for outbound traffic. So, of the traffic that is rerouted because of a WAN link failure, the packets from SAM are still filtered. To meet criterion 2, Yosemite filters packets as they exit its Ethernet interface. Therefore, regardless of which of the two WAN links the packets enter, packets from Seville’s subnet are not forwarded to Yosemite’s Ethernet.