Operating principles Access Control List, classification ACL

Operating principles Access Control List, classification ACL

Part 1: Definition, classification, Operating principles 

Part 2: How it works ACL Wildcard Masking (continue)

Part 3: Configure the basic ACL types  (continue)

What is the ACL?

A List of commands to manage access (input and output) of user on the device with actions allowed (allow) or prohibited (deny)

Mechanism of action, characteristics ACL

-Mechanism filtering Packet based on packet header parameters such as source IP, destination IP, source port, destination port, state …
– The command in ACL list in order from top to bottom, if there is one rule match in List ACL, then to the exit without performing ACL rules below.

 For example, a list of ACL follows:

1-command ACL1

2-command ACL2

3-command ACL3

4-command ACL4

5-Deny all
Note:We see the statement 5 (deny all) always matches all packets, (do not configure this command, but the default is on the list, do not display the access list, but we will see if use the command Show Access-list)

+ Therefore in order to perform on it,  from top to down command, if no packet match rule, the statement end of List will apply, (it means that the packet is discarded).

+ So we need to have at least one command with access is allows (allow) in the ACL list

+ ACL has many applications, and interfaces need to be set up, line protocol or service supports ACL and must set out the direction to or direction.

– Each interface, line, protocol, or service may be used to support one or more ACL.

Classification ACL basic:

1. Standard ACL:
Standard ACL ACL consists of simple commands. Are numbered from 1-99 if the number ACL (ACL named by number).

Standard ACL only source address in the IP packet header, so they operate at Layer 3 of the OSI model or the internet layer in the TCP / IP.

Example: Indiagramswe want to deny all the PCs in the LAN access SERVER, we have used the standard ACL and should put on the router closest to the destination. In the diagram, we set ACLs on routers 0 because it not affect the packet want to network other.

2. Extended ACL:

Extended ACL is the extended ACL statement, filter based on criteria such as port number (application), source-destination IP address, protocol and options. Therefore extended ACL activity in layer 3 and layer 4 OSI model.

Extended ACLs are numbered from 100 to 199

Extended ACL filtering base source / destination IP Address, we should put it near the source ACL to avoid loss of network bandwidth required when the packet “wandering” before being denied.

In the figure above, suppose if we want to deny the computers in LAN access services to the TELNET Server in the DMZ, we should be set ACLs on the router 1.

(continue)

Thanks for you!

Lượt xem (916)

Bài viết liên quan:

Access Control List là gì, phân loại ACL Set the IP address for Layer 3 Switch Cisco Cơ chế hoạt động của Access Control List và Wildcard Mask Explore the process packets is moving in the network Process routing on a Router Why occasionally Access Point has Limited Access despite strong signal Configuring Static Route Một số công nghệ bảo mật của hệ thống tường lửa