Extended IP Access Control Lists 437

Extended IP Access Control Lists

Extended IP access lists have both similarities and differences compared to standard IP ACLs. Just like standard lists, you enable extended access lists on interfaces for packets either entering or exiting the interface. IOS searches the list sequentially. The first statement matched stops the search through the list and defines the action to be taken. All these features are true of standard access lists as well.

The one key difference between the two is the variety of fields in the packet that can be compared for matching by extended access lists. A single ACL statement can examine multiple parts of the packet headers, requiring that all the parameters be matched correctly in order to match that one ACL statement. That matching logic is what makes extended access lists both much more useful and much more complex than standard IP ACLs.

This section starts with coverage of the extended IP ACL concepts that differ from standard ACLs—namely, the matching logic. Following that, the configuration details are covered.

Extended IP ACL Concepts

Extended access lists create powerful matching logic by examining many parts of a packet. Figure 12-4 shows several of the fields in the packet headers that can be matched.

Figure 12-4 Extended Access List Matching Options

The top set of headers shows the IP protocol type, which identifies what header follows the IP header. You can specify all IP packets, or those with TCP headers, UDP headers, ICMP, and so on, by checking the Protocol field. You can also check both the source and destination IP addresses, as shown. The lower part of the figure shows an example with a TCP header following the IP header, pointing out the location of the TCP source and destination port numbers. These port numbers identify the application. For instance, web uses port 80 by default. If you specify a protocol of TCP or UDP, you can also check the port numbers.

438 Chapter 12: IP Access Control List Security

Table 12-5 summarizes the different fields that can be matched with an extended IP ACL, as compared with standard IP ACLs.

Knowing what to look for is just half the battle. IOS checks all the matching information configured in a single access-list command. Everything must match for that single command to be considered a match and for the defined action to be taken. The options start with the protocol type (IP, TCP, UDP, and others), followed by the source IP address, source port, destination IP address, and destination port number. (Remember that the port numbers can be referenced only if the protocol type is configured as TCP or UDP.) Table 12-6 lists several sample access-list commands, with several options configured and some explanations. Only the matching options are shown in bold.

Table 12-6 Extended access-list Commands and Logic Explanations

Extended IP Access Control Lists 441

Example 12-6 R1’s Extended Access List: Example 1

interface Serial0

ip address 172.16.12.1 255.255.255.0 ip access-group 101 in

interface Serial1

ip address 172.16.13.1 255.255.255.0 ip access-group 101 in

access-list 101 remark Stop Bob to FTP servers, and Larry to Server1 web access-list 101 deny tcp host 172.16.3.10 172.16.1.0 0.0.0.255 eq ftp access-list 101 deny tcp host 172.16.2.10 host 172.16.1.100 eq http access-list 101 permit ip any any

Focusing on the syntax for a moment, there are several new items to review. First, the access list number for extended access lists falls in the range of 100 to 199 or 2000 to 2699. Following the permit or deny action, the protocol parameter defines whether you want to check for all IP packets or just those with TCP or UDP headers. When you check for TCP or UDP port numbers, you must specify the TCP or UDP protocol.

You can check for specific port numbers or ranges. The eq parameter means “equals,” as shown in the example. It implies that you are checking the port numbers—in this case, the destination port numbers. You can use the numeric values—or, for the more popular options, a more obvious text version is valid. (If you were to enter eq 80, the config would show eq http.)

In Example 12-6, the first ACL statement prevents Bob’s access to FTP servers in subnet 172.16.1.0. The second statement prevents Larry’s access to web services on Server1. The final statement permits all other traffic.

In this first extended ACL example, the access lists could have been placed on R2 and R3. As you will read near the end of this chapter, Cisco makes some specific recommendations about where to locate IP ACLs. With extended IP ACLs, Cisco suggests that you locate them as close to the source of the packet as possible. Therefore, Example 12-7 achieves the same goal as Example 12-6 of stopping Bob’s access to FTP servers at the main site, and it does so with an ACL on R3.

Example 12-7 R3’s Extended Access List Stopping Bob from Reaching FTP Servers Near R1

interface Ethernet0

ip address 172.16.3.1 255.255.255.0 ip access-group 101 in

access-list 101 remark deny Bob to FTP servers in subnet 172.16.1.0/24 access-list 101 deny tcp host 172.16.3.10 172.16.1.0 0.0.0.255 eq ftp access-list 101 permit ip any any