Access List Basics
Access List Basics
Access lists are a stack of one-line filters that are processed sequentially to determine whether data packets are allowed to continue on through the router or as a part of a router process. Each statement in the stack tests for one set of criteria and, if the criterion matches, the packet is either permitted or denied, as defined in the same statement.
A simple analogy would be this: while grocery shopping, if the grapes are ripe, I will add them to my basket. The single criterion is whether the grapes are ripe and, based on their being ripe, they’re either permitted in my basket or denied. A more complex criterion could be if the grapes need to be ripe and from a domestic vineyard.
Two-Step Process
With all access lists, you have two separate and distinct steps in using them: the creation and the implementation. First, the ACL is always created using the access-list statement in Global Configuration mode. Second, the ACL is referenced by a process command or applied to an interface with commands unique to the application. If either part isn’t done, the ACL typically has no impact, as if it didn’t exist at all. The following output is an example of a simple standard access list and applying it to a Fast Ethernet interface.
interface Fastethernet 0/0 ip address 192.168.5.1 255.255.255.0 ip access-group 50 out ! access-list 50 deny 192.168.1.10 access-list 50 deny 192.168.2.0 0.0.0.255 access-list 50 permit any !
Access lists, when applied to an interface, called traffic filtering, only filter traffic traveling in the direction specified in the access-group statement. In the previous code output, only the outbound IP traffic is being filtered. While applying two ACLs for the same protocol for traffic going in one direction is impossible, you can have one for each direction for each protocol configured on the interface. The following code shows an example of an interface with multiple ACLs applied:
! interface Fastethernet 0/0 ip address 192.168.1.1 255.255.255.0 ip access-group 171 in ip access-group 15 out appletalk cable-range 10-19 15.11 appletalk access-group 615 out appletalk access-group 601 in ipx access-group 805 in ipx access-group 809 out ipx network 127 !
In determining whether to apply the ACL in- or outbound, visualize yourself at the center of the router. Is the data coming at you in the interface or is it traveling out through the interface? The perspective for determining in or out is always the center of the router, never the center of the network segment. A common mistake is to use an inbound filter to block traffic from entering a LAN. While the bad traffic is coming into the LAN, it’s passing out of the router. Figure A-1 shows graphically inbound and outbound traffic flows on a basic router.
Figure A-1: Inbound and outbound traffic flows on router interfaces
Numbered ACL Common Characteristics
Before looking at the details of standard and extended ACLs, consider the following characteristics of all numbered access lists:
-
An ACL is made up of one or more permit or deny statements
-
If an ACL doesn’t have at least one permit statement, it will deny everything
-
All ACL statements with the same number are part of the same ACL
-
ACL statements must be entered sequentially in order to be processed
-
An ACL can be added to (appended), but not edited. Any attempt to edit an item will delete the entire ACL
Tip? By default, router interfaces configured for a protocol “allow” all traffic in both directions without restriction. Once an ACL is applied to an interface, the default flips to “blocking” all traffic for that protocol in the specified direction, except what is explicitly allowed by the ACL.
The Numbers Matter
With numbered ACLs, the number is a list identifier that indicates the protocol used and whether the list is part of a standard or an extended ACL. Each statement in the ACL will have the same number. The following table is a recent listing of the ACL number ranges.
|
Range |
Description |
|---|---|
|
1–99 |
IP standard access list |
|
1,300–1,999 |
IP standard access list (expanded range IOS v12.1) |
|
100–199 |
IP extended access list |
|
2,000–2,699 |
IP extended access list (expanded range IOS v12.1) |
|
200–299 |
Protocol type-code access list |
|
300–399 |
DECnet access list |
|
400–499 |
XNS standard access list |
|
500–599 |
XNS extended access list |
|
600–699 |
Appletalk access list |
|
700–799 |
48-bit MAC address access list |
|
800–899 |
IPX standard access list |
|
900–999 |
IPX extended access list |
|
1,000–1,099 |
IPX SAP access list |
|
1,200–1,299 |
IPX summary address access list |
|
1,100–1,199 |
Extended 48-bit MAC address access list |
While this text and the exam focus only on IP ACLs, it’s important to remember that similar features exist for IPX, Appletalk, and other even older protocols.
