Infrastructure Security · Topic 2 of 4
Router Security with ACLs and uRPF
Troubleshoot IPv4 standard, extended and time based ACLs, IPv6 traffic filters and unicast reverse path forwarding in strict and loose mode on IOS XE.
- 5 min
- ACLs are processed top down, and the first match wins.
- Every ACL ends with an implicit deny.
- Standard ACLs match the source only. Extended ACLs match more fields.
What it is
Access control lists and uRPF let a router drop traffic that should not be there.
An ACL is an ordered list of permit and deny rules that match packet fields. Unicast reverse path forwarding (uRPF) checks the source address of each packet against the routing table, and drops packets with spoofed sources.
Both are applied to interfaces, and both are common causes of traffic that vanishes for no obvious reason.
How it works
ACLs are read from the top, the first match decides, and an implicit deny sits at the end.
Standard and extended ACLs
| Type | Number ranges | Matches |
|---|---|---|
| Standard | 1 to 99, 1300 to 1999 | Source address only |
| Extended | 100 to 199, 2000 to 2699 | Protocol, source, destination, ports and more |
| Named | Any name | Standard or extended |
Named ACLs are easier to edit because each line has a sequence number. Place an extended ACL close to the source, and a standard ACL close to the destination.
R1(config)# ip access-list extended WEB-ONLY
R1(config-ext-nacl)# permit tcp 10.1.1.0 0.0.0.255 any eq 80
R1(config-ext-nacl)# permit tcp 10.1.1.0 0.0.0.255 any eq 443
R1(config-ext-nacl)# deny ip any any log
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip access-group WEB-ONLY inThe ACL uses wildcard masks. A wildcard 0.0.0.255 matches any value in the last octet.
An ACL applied with ip access-group filters traffic that passes through the router. Traffic the router itself creates is not filtered by an outbound ACL.
To protect the router's own VTY lines, use access-class.
R1(config)# line vty 0 4
R1(config-line)# access-class ADMIN-HOSTS inTime based ACLs
A time based ACL only matches during a defined period.
R1(config)# time-range BUSINESS
R1(config-time-range)# periodic weekdays 8:00 to 17:00
R1(config)# ip access-list extended WEB-ONLY
R1(config-ext-nacl)# permit tcp any any eq 80 time-range BUSINESSThe rule is active only inside the range. The router needs an accurate clock, so use NTP, otherwise the rule may match at the wrong time.
Troubleshooting ACLs
Follow these steps.
- Is the ACL applied to the right interface and direction?
- Does an earlier line match before the line you expected?
- Do the counters show matches?
- Is the wildcard mask correct?
R1# show access-lists
R1# show ip interface GigabitEthernet0/0
R1# show time-rangeshow access-lists lists each line with a match count. show ip interface shows the names of the inbound and outbound ACLs on that interface.
IPv6 traffic filter
IPv6 ACLs are always named and use prefix lengths, not wildcard masks. They are applied with ipv6 traffic-filter.
R1(config)# ipv6 access-list V6-FILTER
R1(config-ipv6-acl)# permit tcp 2001:DB8:1::/64 any eq 443
R1(config-ipv6-acl)# deny ipv6 any any log
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ipv6 traffic-filter V6-FILTER inIPv6 ACLs end with an implicit permit for neighbour discovery messages, followed by the implicit deny. If you add an explicit deny ipv6 any any, neighbour discovery may stop working unless you permit it first.
Unicast reverse path forwarding
uRPF looks up the source address of an arriving packet and drops it if the check fails. It needs CEF.
| Mode | Rule | Command keyword |
|---|---|---|
| Strict | The best route to the source must point out the arrival interface | rx |
| Loose | A route to the source must exist on any interface | any |
R1(config-if)# ip verify unicast source reachable-via rx
R1(config-if)# ip verify unicast source reachable-via any
R1(config-if)# ipv6 verify unicast source reachable-via rxStrict mode suits an edge facing customers. It breaks with asymmetric routing, where return traffic uses a different interface. Loose mode suits a link with multiple providers, as it only drops sources with no route at all.
The allow-default option lets a default route satisfy the check. Without it, a source covered only by a default route fails.
show ip interface shows verify unicast drop counters, which confirms uRPF is the cause.
What to remember for the exam
Eight facts cover most questions on this topic.
- ACLs are processed top down, and the first match wins.
- Every ACL ends with an implicit deny.
- Standard ACLs match the source only. Extended ACLs match more fields.
access-classfilters VTY access.ip access-groupfilters interface traffic.- A time based ACL needs a
time-rangeand a correct clock. - IPv6 ACLs use
ipv6 traffic-filter, prefix lengths and an implicit permit for neighbour discovery. - Strict uRPF uses
reachable-via rx. Loose uRPF usesreachable-via any. - uRPF depends on CEF.
Strict uRPF drops legitimate traffic when routing is asymmetric. Use loose mode there.
Common mistakes
These five mistakes appear often.
Wrong direction. An inbound ACL applied outbound matches different traffic.
Specific rule after a general rule. The general line matches first, and the specific line is never used.
Wildcard confusion. A subnet mask used where a wildcard is needed matches the wrong hosts.
Blocking neighbour discovery. An explicit IPv6 deny at the end breaks address resolution.
Strict uRPF with asymmetric paths. Valid return traffic is dropped.
Check yourself
Work through these three questions.
Which command applies an ACL to the VTY lines?
access-class, entered under theline vtyconfiguration.What is the difference between strict and loose uRPF?
Strict requires the best route to the source to point out the arrival interface, while loose only requires a route to the source on any interface.
What does an IPv6 ACL allow before its implicit deny?
It allows neighbour discovery messages, which is why an explicit
deny ipv6 any anycan break them.
Topic 2 of 4 in Infrastructure Security
Test yourself on Infrastructure Security
The full Cisco CCNP 300-410 ENARSI question bank has 857 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.