Access Control Lists

What it is

An access control list (ACL) is an ordered list of permit and deny rules that a router uses to filter traffic.

Each packet is compared with the rules. The first matching rule decides what happens to it.

ACLs are used for filtering traffic between networks, for protecting management access, and also to select traffic for other features, such as NAT.

How it works

The router checks rules from the top, stops at the first match, and drops anything that matches nothing.

How a list is processed

• Rules are checked from the top down.
• The first match wins. The router does not look at later rules.
• At the end of every ACL is an invisible implicit deny any. If a packet matches no rule, it is dropped.
• An ACL that has only deny rules therefore blocks everything. Include at least one permit.
• An ACL does nothing until it is applied to an interface, in a direction.

Wildcard masks

ACLs use a wildcard mask, which is the inverse of a subnet mask. A 0 bit means "this bit must match" and a 1 bit means "ignore this bit".

• 0.0.0.255 matches any address in a /24, such as 192.168.1.0 to 192.168.1.255.
• 0.0.0.0 matches exactly one address. The keyword host is shorthand for this.
• 255.255.255.255 matches everything. The keyword any is shorthand for this.

To find the wildcard mask, subtract the subnet mask from 255.255.255.255. For 255.255.255.192, the wildcard is 0.0.0.63.

Standard and extended ACLs

A standard ACL is simple but coarse, since it only looks at the source. An extended ACL can say, for example, "allow TCP from this subnet to that server on port 80".

Both can be numbered or named. Named ACLs are easier to read and edit.

Standard ACL example:

access-list 10 permit 192.168.1.0 0.0.0.255
access-list 10 deny any

Extended named ACL example:

ip access-list extended WEB-ONLY
 permit tcp 192.168.1.0 0.0.0.255 host 10.1.1.10 eq 80
 permit tcp 192.168.1.0 0.0.0.255 host 10.1.1.10 eq 443
 deny ip any any

An extended entry has this order: action, protocol, source, destination, and then an optional operator and port, such as eq 80 (equals port 80).

Applying an ACL

interface GigabitEthernet0/1
 ip access-group WEB-ONLY in

The direction is from the router's point of view. In filters packets as they arrive on the interface. Out filters packets as they leave it.

An interface can have one ACL per direction, per protocol.

To protect remote logins to the device itself, use an ACL on the vty lines:

line vty 0 15
 access-class 10 in

Placement

Where you put the ACL depends on how much it can see.

• Standard ACLs go close to the destination, because they only see the source. Placed near the source, they could block that source from everything.
• Extended ACLs go close to the source, because they can be exact. This stops unwanted traffic early, before it crosses the network.

Editing named lists

Named ACLs use sequence numbers, so you can remove or insert a single line without rewriting the whole list:

ip access-list extended WEB-ONLY
 no 20
 15 permit tcp host 192.168.1.50 any eq 22

On numbered ACLs, editing is more limited, so it is usually easier to use a named list. Always add a remark to describe the purpose.

IPv6 ACLs

IPv6 uses named ACLs only, applied with ipv6 traffic-filter:

ipv6 access-list BLOCK-TELNET
 deny tcp any any eq 23
 permit ipv6 any any
interface GigabitEthernet0/1
 ipv6 traffic-filter BLOCK-TELNET in

An IPv6 ACL also has implicit permit rules for neighbour discovery before the implicit deny, since IPv6 depends on it.

Verifying

show access-lists
show ip access-lists WEB-ONLY
show ip interface GigabitEthernet0/1
show running-config | section access-list

show access-lists lists every rule with a match counter, which shows how many packets hit each line. show ip interface reveals which ACL is applied on an interface and in which direction.