Extended ACLs

The parts of a line

permit tcp 192.168.20.0 0.0.0.255 host 10.1.1.10 eq www

Where to put it

An extended ACL can say exactly which traffic to drop, so put it near the source: the unwanted packets are dropped before they cross the network.

Staff may use the file server's FTP, but only ADMIN may manage it with SSH. Applied in on the staff LAN interface:

In NetLab

▶ R1
R1>enable
R1#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
R1(config)#access-list 110 permit tcp 192.168.10.0 0.0.0.255 host 10.1.1.20 eq ftp
R1(config)#access-list 110 permit tcp host 192.168.10.50 host 10.1.1.20 eq 22
R1(config)#access-list 110 deny tcp any host 10.1.1.20 eq 22
R1(config)#access-list 110 permit ip any any
R1(config)#interface g0/0
R1(config-if)#ip access-group 110 in
R1(config-if)#end
*Mar  1 00:00:09.000: %SYS-5-CONFIG_I: Configured from console by console
▶ ADMIN
student@ADMIN:~$ nc -zv 10.1.1.20 22
Connection to 10.1.1.20 22 port [tcp/ssh] succeeded!
student@ADMIN:~$ nc -zv 10.1.1.20 21
Connection to 10.1.1.20 21 port [tcp/ftp] succeeded!
▶ PC1
NetLab Windows-style command prompt. Type help to see the commands.
C:\Users\student>curl http://10.1.1.20
<html><body><h1>Welcome to FILES</h1></body></html>
▶ R1
R1#show access-lists 110
Extended IP access list 110
    10 permit tcp 192.168.10.0 0.0.0.255 host 10.1.1.20 eq ftp (1 match)
    20 permit tcp host 192.168.10.50 host 10.1.1.20 eq 22 (2 matches)
    30 deny tcp any host 10.1.1.20 eq 22
    40 permit ip any any (1 match)

Tip: established on a TCP line matches only replies (packets with the ACK or RST flag set). permit tcp any 192.168.10.0 0.0.0.255 established lets the answers to staff connections back in without letting anyone start a new connection to them.