IPv4 ACLs: standard, extended, numbered and named

Why this matters

An access control list is the most basic security tool on a Cisco router: a list of rules that says which packets may pass an interface and which are dropped. Junior network engineers write them to stop guest users reaching servers, to let only the help desk's subnet open SSH sessions to the routers, and to allow one web service through to a server while blocking everything else. ACLs also turn up inside other features, such as selecting which hosts NAT translates (lesson 19) or which traffic a VPN protects (lesson 21).

ACLs fail in quiet and dangerous ways. One deny entry on its own blocks every packet through an interface, because of a rule nobody typed. A standard ACL placed in the wrong spot cuts a department off from the whole network instead of one server. A new entry typed at the end of a list, after a broad permit or deny, is never reached. A wildcard written as a subnet mask matches the wrong hosts. Every one of these is avoided by knowing a few rules about how a router reads the list.

The lesson

IPv4 ACL types: standard and extended, numbered and named

An access control list (ACL) is an ordered list of access control entries (ACEs), each of which permits or denies packets that match it. ACLs come in two kinds, and each kind can be identified in two ways:

A numbered ACL is identified by its number, and the number tells IOS its kind. A named ACL has a name you choose, such as WEB-IN, which makes configurations easier to read, and the kind is stated when you create it.

How a router reads an ACL

Three rules govern every ACL:

1. Top down, first match. The router compares the packet with each entry in order and stops at the first entry that matches. It does not look for the best match.
2. The implicit deny. Every ACL ends with an invisible deny any. A packet that matches no entry is dropped.
3. One ACL per interface, per direction, per protocol. An interface can have one IPv4 ACL inbound and one outbound.

The implicit deny catches many people out. Suppose R1 has a standard ACL with one entry, access-list 15 deny 10.1.1.0 0.0.0.255, applied inbound on Gi0/0/0. The intent was to block one subnet. The result is that no traffic at all arrives through that interface: packets from 10.1.1.0/24 hit the deny, and everything else hits the implicit deny. The fix is a permit after the deny:

R1(config)#access-list 15 deny 10.1.1.0 0.0.0.255
R1(config)#access-list 15 permit any

Wildcard masks

ACLs match addresses with a wildcard mask, not a subnet mask. A 0 bit means "must match" and a 1 bit means "ignore". For a subnet, the wildcard is the subnet mask subtracted from 255.255.255.255, octet by octet.

Worked example: permit exactly 172.16.8.32/27.

1. A /27 mask is 255.255.255.224.
2. 255 minus 224 is 31, so the wildcard is 0.0.0.31.
3. The block size is 32, so the range runs from .32 to .63.
4. The entry is access-list 20 permit 172.16.8.32 0.0.0.31. Writing 0.0.0.32 is the classic slip of using the block size instead of the block size minus one.

Worked example: the mask 255.255.240.0. Subtract each octet from 255: 0, 0, 255 minus 240 = 15, and 255 minus 0 = 255. The wildcard is 0.0.15.255, which covers 16 values in the third octet. 0.0.16.255 is the same slip again, and it does not even describe a contiguous range.

Worked example: what does access-list 30 permit 10.1.16.0 0.0.7.255 match?

1. The third octet of the wildcard is 7, binary 00000111, so the low three bits of the third octet are free. That is 8 values.
2. Starting from 16, the third octet may be 16 to 16 + 7 = 23.
3. The fourth octet of the wildcard is 255, so any fourth octet matches.
4. The range is 10.1.16.0 to 10.1.23.255, a /21. 10.1.16.255 is only the end of the first of those eight values.

Two shortcuts:

• host 10.5.5.5 is the same as 10.5.5.5 0.0.0.0: every bit must match, so it matches one host.
• any is the same as 0.0.0.0 255.255.255.255: every bit is ignored. Writing 10.5.5.5 255.255.255.255 therefore matches every address, not one.

Standard ACLs

A standard entry names only a source:

R2(config)#access-list 5 permit 10.1.99.0 0.0.0.255
R2(config)#access-list 5 permit host 10.1.50.10

Because a standard ACL cannot see the destination, place it close to the destination. Suppose hosts in 192.168.10.0/24 must not reach the server subnet 10.5.5.0/24, but must still reach every other network. Applied inbound on the interface facing 192.168.10.0/24, a standard ACL denying that source would stop those hosts reaching everything. Applied outbound on the interface facing 10.5.5.0/24, it blocks only traffic to that subnet.

R3(config)#access-list 10 deny 192.168.10.0 0.0.0.255
R3(config)#access-list 10 permit any
R3(config)#interface GigabitEthernet0/0/2
R3(config-if)#description Server LAN 10.5.5.0/24
R3(config-if)#ip access-group 10 out

Extended ACLs

An extended entry is written in this order: action, protocol, source, destination, then optional port.

access-list 110 permit tcp 192.168.10.0 0.0.0.255 host 10.2.2.2 eq 443
                 |      |   |                     |              |
              action  proto source                destination    destination port

This permits HTTPS requests from the 192.168.10.0/24 hosts to server 10.2.2.2. Swapping source and destination, permit tcp host 10.2.2.2 eq 443 192.168.10.0 0.0.0.255, would match only the server's replies, not the requests. Writing udp would miss HTTPS over TCP, and permit ip ... 10.2.2.0 0.0.0.255 would allow every protocol to the whole server subnet.

The protocol can be ip (any IPv4 packet), tcp, udp or icmp, among others. Port operators are eq (equal), neq, lt, gt and range. A port written after the source matches the source port; a port after the destination matches the destination port.

Because an extended ACL can match the destination exactly, place it close to the source, so unwanted traffic is dropped before it crosses the network.

Named ACLs and sequence numbers

Named ACLs are configured in their own mode, and every entry gets a sequence number, by default 10, 20, 30 and so on:

R1(config)#ip access-list extended WEB-IN
R1(config-ext-nacl)#remark Allow HTTPS to the web server
R1(config-ext-nacl)#10 permit tcp any host 10.2.2.2 eq 443
R1(config-ext-nacl)#20 permit tcp any host 10.2.2.3 eq 22

Sequence numbers let you insert and delete entries without retyping the list. To insert a Telnet deny for 10.2.2.2 after entry 10 but before entry 20, give it a number between them:

R1(config)#ip access-list extended WEB-IN
R1(config-ext-nacl)#15 deny tcp any host 10.2.2.2 eq 23
R1(config-ext-nacl)#no 20

An entry typed without a number is appended at the end, numbered 10 above the last entry (25 here, now that 20 is gone), after everything else. no 20 removes a single entry. Numbered ACLs can be edited the same way, by entering ip access-list extended 110.

Applying an ACL

On an interface, ip access-group applies the ACL in one direction:

R5(config)#interface GigabitEthernet0/0/0
R5(config-if)#ip access-group 101 in

Inbound ACLs are checked as packets arrive, before the routing decision. Outbound ACLs are checked after routing, as packets leave. So to filter packets from the LAN on Gi0/0/0 before R5 routes them, apply the ACL inbound on Gi0/0/0. Outbound on Gi0/0/0 would filter only traffic going toward the LAN.

An interface takes one IPv4 ACL per direction. If Gi0/0/1 already has ip access-group 110 in and you enter ip access-group 120 in, ACL 120 replaces 110. IOS does not chain or merge the two.

To limit who can open SSH sessions to the router itself, apply a standard ACL to the VTY lines with access-class:

R2(config)#line vty 0 4
R2(config-line)#access-class 5 in

in filters incoming management sessions by source address. out would limit the sessions users start from the router to other devices. An ip access-group on an interface is not the right tool here, because it would filter all traffic through that interface. Lesson 17 covers the login side of these lines.

Worked example: turning a requirement into an ACL

Requirement: guest hosts in 192.168.50.0/24 may browse the web, but must not reach any internal server in 10.0.0.0/8. Everything else from the guest LAN is blocked.

1. Choose the kind. The rule depends on destinations and ports, so it must be extended.
2. Choose the place. Extended goes near the source: inbound on the router interface facing the guest LAN.
3. Order the entries. The specific deny comes first, so a guest packet to an internal web server is dropped before a broad permit can match it.
4. Remember the implicit deny. Anything not permitted, such as Telnet or SSH from guests, is dropped without an extra entry.

R1(config)#ip access-list extended GUEST-IN
R1(config-ext-nacl)#10 deny ip 192.168.50.0 0.0.0.255 10.0.0.0 0.255.255.255
R1(config-ext-nacl)#20 permit udp 192.168.50.0 0.0.0.255 any eq 53
R1(config-ext-nacl)#30 permit tcp 192.168.50.0 0.0.0.255 any eq 80
R1(config-ext-nacl)#40 permit tcp 192.168.50.0 0.0.0.255 any eq 443
R1(config-ext-nacl)#exit
R1(config)#interface GigabitEthernet0/0/3
R1(config-if)#ip access-group GUEST-IN in

Entry 20 matters: without DNS, guests could not resolve any web name, and the ACL would look broken. If the DNS server the guests use were inside 10.0.0.0/8, entry 10 would block it, so a permit for that one server would have to come before entry 10.

Verifying ACLs

R1#show access-lists EDGE-IN
Extended IP access list EDGE-IN
    10 permit tcp any host 10.2.2.2 eq 443 (210 matches)
    20 permit tcp any host 10.2.2.3 eq 22 (14 matches)
    30 deny ip any any log (57 matches)

The match counters show which entries are being used. Walk a packet through it. A TCP packet from 198.51.100.7 to 10.2.2.3 port 80: entry 10 needs host 10.2.2.2, so no match; entry 20 names 10.2.2.3 but needs port 22, so no match; entry 30 matches anything, so the packet is denied and logged. An explicit deny ip any any log behaves like the implicit deny, but it counts and logs what it drops.

To see which ACLs an interface uses:

R1#show ip interface GigabitEthernet0/0/1 | include access list
  Outgoing Common access list is not set
  Outgoing access list is not set
  Inbound Common access list is not set
  Inbound access list is EDGE-IN

What the exam is really asking

• Standard versus extended. Standard matches the source only (1-99, 1300-1999). Extended matches protocol, source, destination and ports (100-199, 2000-2699).
• Placement. Standard near the destination; extended near the source.
• First match, then the implicit deny. A list of only denies blocks everything.
• Wildcards are inverted masks. /27 is 0.0.0.31, not 0.0.0.32. 0.0.0.0 is one host; 255.255.255.255 is any.
• Extended order. Protocol, source, destination, port. A port after the destination is the destination port.
• Sequence numbers. Use a number between two entries to insert; an unnumbered entry goes to the end.
• One ACL per interface per direction. A second ip access-group replaces the first.
• access-class for VTY lines, ip access-group for interfaces. Inbound filtering happens before routing.