Introduction to Admission Lists
Creating admission lists is absolutely a lot like programming a alternation of
if
-
then
statements—if a given
condition is met, again a accustomed activity is taken. If the specific activity isn’t met, annihilation happens,
and the abutting account is evaluated. Access-list statements are basically packet filters
that packets are compared against, categorized by, and acted aloft accordingly. Once the lists
are built, they can be activated to either entering or outbound cartage on any interface. Applying
an admission account causes the router to assay every packet bridge that interface in the specified
direction and booty the adapted action.
A packet follows a few important rules back it’s actuality compared to an admission list:
It’s consistently compared to anniversary band of the admission account in consecutive order; in added words, it’ll
always alpha with the aboriginal band of the admission list, again go to band 2, again band 3, and so on.
It’s compared to curve of the admission account alone until a bout is made. Once the packet
matches the activity on a band of the admission list, the packet is acted upon, and no further
comparisons booty place.
There is an absolute “deny” at the end of anniversary admission list; this agency that if a packet doesn’t
match the activity on any of the curve in the admission list, the packet will be discarded.
There are two capital types of admission lists:
Standard admission lists
These use alone the antecedent IP abode in an IP packet as the condition
test. All decisions are fabricated based on the antecedent IP address. This agency accepted admission lists
basically admittance or abjure an absolute apartment of protocols. They don’t analyze amid any of the
many types of IP cartage such as WWW, Telnet, UDP, and so on.
Extended admission lists
Extended admission lists can appraise abounding of the added fields in the layer-
3 and layer-4 headers of an IP packet. They can appraise antecedent and destination IP addresses,
the agreement acreage in the Arrangement band header, and the anchorage cardinal at the Transport layer
header. This gives continued admission lists the adeptness to accomplish abundant added diminutive decisions
when authoritative traffic.
Named admission lists
Hey, delay a minute—I said two types of admission lists but listed three! Well,
technically there absolutely are alone two since
named admission lists
are either accepted or extended
and not absolutely a new type. I’m aloof appropriate them because they’re created and referred
to abnormally than accepted and continued admission lists. But they’re functionally the same.
Here’s a account of the abounding aegis threats you can abate with ACLs:
IP abode spoofing—inbound
IP abode spoofing—outbound
DoS TCP SYN attacks—blocking alien attacks
DoS TCP SYN attacks—using TCP intercept
DoS smurf attacks
Filtering ICMP messages—inbound
Filtering ICMP messages—outbound
Filtering
traceroute
It’s about astute not to acquiesce any IP packets advancing into a clandestine arrangement that contain
the antecedent abode of any centralized hosts or networks—just don’t do it!
Here’s a account of rules to alive by back configuring ACLs from the Internet to your production
network to abate aegis problems:
Deny any addresses from your centralized networks.
Deny any bounded host addresses (127.0.0.0/8).
Deny any aloof clandestine addresses.
Deny any addresses in the IP multicast abode ambit (224.0.0.0/4).