Table Of Contents
Configuring Security Access Control Lists
Maximum Number of ACLs and ACL Entries
Configuring Comments in an Extended ACL
Simplifying Access Control Lists with Object Groups
Configuring Network Object Groups
Creating a Network Object Group
Adding a Description to a Network Object Group
Configuring a Network IP Address for a Network Object Group
Configuring Service Object Groups
Creating a Service Object Group
Adding a Description to a Service Object Group
Defining Protocol Parameters for a Service Object Group
Example of Configuring an Extended ACL Without Object Groups
Example of Configuring the Equivalent Extended ACL Using Object Groups
Example of How an Object Group Expands into Multiple ACL Entries
Applying an ACL to an Interface
Applying an ACL Globally to All Interfaces in a Context
IP Addresses for ACLs with NAT
Displaying ACL Configuration Information and Statistics
Displaying ACL Configuration Information
Configuring Security Access Control Lists
This chapter describes how to configure security access control lists (ACLs) on your Cisco Application Control Engine (ACE) module. ACLs provide basic security for your network by filtering traffic and controlling network connections. This chapter contains the following major sections:
•
ACL Configuration Quick Start
•
•
•
•
•
ACL Overview
An ACL consists of a series of statements called ACL entries that define the network traffic profile. Each entry permits or denies network traffic (inbound and outbound) to the parts of your network specified in the entry. Each entry also contains a filter element that is based on criteria such as the source address, the destination address, the protocol, and protocol-specific parameters such as ports and so on.
An implicit deny-all entry exists at the end of each ACL, so you must configure an ACL on each interface that you want to permit connections. Otherwise, the ACE denies all traffic on the interface.
ACLs allow you to control network connection setups rather than processing each packet. Such ACLs are commonly referred to as security ACLs.
You can configure ACLs as parts of other features (for example, security, Network Address Translation (NAT), server load balancing (SLB), and so on). The ACE merges these individual ACLs into one large ACL called a merged ACL. The ACL compiler then parses the merged ACL and generates the ACL lookup mechanisms. A match on this merged ACL can result in multiple actions.
For example, one use of ACLs could be to permit all e-mail traffic on a VLAN, but block Telnet traffic. You can also use ACLs to allow one client to access a part of the network and prevent another client from accessing that same area.
When configuring ACLs, you must apply an ACL to an interface to control traffic on that interface. Applying an ACL on an interface assigns the ACL and its entries to that interface.
You can apply only one extended ACL to each direction (inbound or outbound) of an interface. You can also apply the same ACL on multiple interfaces.You can apply EtherType ACLs only in the inbound direction and only on Layer 2 interfaces.
This section contains the following topics:
ACL Types and Uses
You can configure the following two types of ACLs on the ACE:
•
•
Note
ACL Guidelines
This section describes the guidelines to observe when you configure and use ACLs in your network. This section contains the following topics:
•
ACL Entry Order
An ACL consists of one or more entries. Depending on the ACL type, you can specify the source and destination addresses, the protocol, the ports (for TCP or UDP), the ICMP type, the ICMP code, or the EtherType as the match criteria. By default, the ACE appends each ACL entry at the end of the ACL. You can also specify the location of each entry within an ACL.
The order of the entries is important. When the ACE decides whether to accept or refuse a connection, the ACE tests the packet against each ACL entry in the order in which the entries are listed. After it finds a match, the ACE does not check any more entries. For example, if you create an entry at the beginning of an ACL that explicitly permits all traffic, the ACE does not check any other statements in the ACL.
ACL Implicit Deny
All ACLs have an implicit deny entry at the end of the ACL, so, unless you explicitly permit it, traffic cannot pass. For example, if you want to allow all users to access a network through the ACE except for those users with particular IP addresses, then you must deny the particular IP addresses in one entry and permit all other IP addresses in another entry.
Maximum Number of ACLs and ACL Entries
The ACE supports a maximum of 8,192 unique ACLs and 64,000 ACL entries. Some ACLs use more memory than others, such as an ACL that uses large port number ranges or overlapping networks (for example, one entry specifies 10.0.0.0/8 and another entry specifies 10.1.1.0/24). Depending on the type of ACL, the actual limit that the ACE can support may be less than 64,000 entries.
If you use object groups in ACL entries, you enter fewer actual ACL entries, but the same number of expanded ACL entries as you did when you entered entries without object groups. Expanded ACL entries count toward the system limit. To view the number of expanded ACL entries in an ACL, use the show access-list name command.
If you exceed the memory limitations of the ACE, the module generates a syslog message and increments the Download Failures counter in the output of the show interface vlan number command. The configuration remains in the running-config file and the interface stays enabled. The ACL entries stay the same as they were before the failing configuration was attempted.
For example, if you add a new ACL with ten entries, but the addition of the sixth entry fails because the ACE runs out of memory, the ACE removes the five entries that you successfully entered.
ACL Configuration Quick Start
Table 1-1 provides a quick overview of the steps required to configure ACLs. Each step includes the CLI command or a reference to the procedure required to complete the task. For a complete description of each feature and all the options associated with the CLI commands, see the sections following Table 1-1.
Configuring ACLs
This section contains the following topics:
•
Configuring an Extended ACL
An extended ACL allows you to specify both the source and the destination IP addresses of traffic as well as the following parameters:
•
•
•
You can specify these parameters directly when you use the access-list command or you can use object groups for each parameter. For more information about object groups, see the "Simplifying Access Control Lists with Object Groups" section.
For TCP, UDP, and ICMP connections, you do not need to apply an ACL on the destination interface to allow returning traffic, because the ACE allows all returning traffic for established connections.
Note
Tip
To create an extended ACL, use the access-list extended command in configuration mode. There are two major types of extended ACLs:
•
•
You can permit or deny network connections based on the IP protocol, source and destination IP addresses, and TCP or UDP ports. To syntax of a non-ICMP extended ACL is as follows:
access-list name [line number] extended {deny | permit}
{protocol {any | host src_ip_address | src_ip_address netmask
| object-group net_obj_grp_name} [operator port1 [port2]] {any | host dest_ip_address | dest_ip_address netmask | object-group net_obj_grp_name} [operator port3 [port4]]}
| {object-group service_obj_grp_name} {any | host src_ip_address
| src_ip_address netmask | object-group net_obj_grp_name} {any | host dest_ip_address | dest_ip_address netmask | object-group net_obj_grp_name}You can also permit or deny network connections based on the ICMP type (for example, echo, echo-reply, unreachable, and so on). To syntax of an ICMP extended ACL is as follows:
access-list name [line number] extended {deny | permit}
{icmp {any | host src_ip_address | src_ip_address netmask | object_group net_obj_grp_name} {any | host dest_ip_address | dest_ip_address netmask | object_group network_grp_name} [icmp_type [code operator code1 [code2]]]}
| {object-group service_obj_grp_name} {any | host src_ip_address
| src_ip_address netmask | object-group net_obj_grp_name} {any | host dest_ip_address | dest_ip_address netmask | object-group net_obj_grp_name}The keywords, options, and arguments are as follows:
•
•
•
•
•
•
•
•
•
•
•
–
–
–
–
–
•
•
•
•
•
–
–
–
–
–
•
•
•
•
•
–
–
–
–
–
•
Note
For example, to configure a TCP extended ACL, enter:
host1/Admin(config)# access-list INBOUND line 10 extended permit tcp 192.168.12.0 255.255.255.0 gt 1024 172.27.16.0 255.255.255.0 lt 4000For example, to remove an entry from an extended ACL, enter:
host1/Admin(config)# no access-list INBOUND line 10To control a ping, specify echo (8) (host to ACE).
For example, to allow an external host with IP address 192.168.12.5 to ping a host behind the ACE with an IP address of 10.0.0.5, enter:
host1/Admin(config)# access-list INBOUND extended permit icmp host 192.168.12.5 host 10.0.0.5 echo code eq 0For example, to remove an entry from an ICMP ACL, enter:
host1/Admin(config)# no access-list INBOUND extended permit icmp host 192.168.12.5 echoConfiguring Comments in an Extended ACL
You can add comments about an extended ACL to clarify the function of the ACL. To add a comment to an ACL, use the access-list name remark command in configuration mode. You can enter only one comment per ACL and the comment always appears at the beginning of the ACL. The syntax of this command is as follows:
access-list name remark text
The keywords and arguments are as follows:
•
•
For example, enter:
host1/Admin(config)# access-list INBOUND remark This is a remarkFor example, to remove entry comments from an ACL, enter:
host1/Admin(config)# no access-list INBOUND line 200 remarkIf you delete an ACL using the no access-list name command, then all the remarks are also removed.
Configuring an EtherType ACL
You can configure an ACL that controls traffic based on its EtherType. An EtherType is a subprotocol identifier. EtherType ACLs support Ethernet V2 frames. EtherType ACLs do not support 802.3-formatted frames because they use a length field instead of a type field. The only exception is a bridge protocol data unit (BPDU), which is SNAP encapsulated. The ACE can specifically handle BPDUs.
You can permit or deny BPDUs. By default, all BPDUs are denied. The ACE receives trunk port (Cisco proprietary) BPDUs because ACE ports are trunk ports. Trunk BPDUs have VLAN information inside the payload, so the ACE modifies the payload with the outgoing VLAN if you allow BPDUs. If you configure redundancy, you must allow BPDUs on both interfaces with an EtherType ACL to avoid bridging loops. For details about configuring redundancy, see the Cisco Application Control Engine Module Administration Guide.
If you allow Multiprotocol Label Switching (MPLS), ensure that Label Distribution Protocol (LDP) and Tag Distribution Protocol (TDP) TCP connections are established through the ACE by configuring both MPLS routers connected to the ACE to use the IP address on the ACE interface as the router ID for LDP or TDP sessions. LDP and TDP allow MPLS routers to negotiate the labels (addresses) used to forward packets.
Note
On Cisco IOS routers, enter the appropriate command for your protocol: LDP or TDP. The interface is the interface connected to the ACE:
host1/Admin(config)# mpls ldp router-id interface forceor
host1/Admin(config)# tag-switching tdp router-id interface force
Tip
To configure an EtherType ACL, use the access-list ethertype command in configuration mode. The syntax of this command is as follows:
access-list name ethertype {deny | permit} {any | bpdu | ipv6 | mpls}
The keywords and arguments are as follows:
•
•
–
–
–
–
–
–
Note
For example, to configure an EtherType ACL for MPLS, enter:
host1/Admin(config)# access-list INBOUND ethertype permit mplsTo remove an entry from an EtherType ACL, enter:
host1/Admin(config)# no access-list INBOUND ethertype permit mplsResequencing Entries
You can resequence the entries in an extended ACL with a specific starting number and interval by using the access-list name resequence command in configuration mode. The ability to resequence entries in an ACL is supported only for extended ACLs.
The syntax of this command is as follows:
access-list name resequence [number1] [number2]
The keywords, options, and arguments are as follows:
•
•
•
•
For example, enter:
host1/Admin(config)# access-list INBOUND resequence 5 15Simplifying Access Control Lists with Object Groups
This section describes how to use object groups to simplify ACL creation and maintenance. It contains the following topics:
•
•
•
•
•
•
Overview of Object Groups
Object groups allow you to streamline the configuration of multiple ACL entries in an ACL. By grouping like objects together, you can use an object group in an ACL entry instead of having to enter an ACL entry for each object separately. You can create the following types of object groups:
•
•
For example, consider the following three object groups:
•
•
•
After you create these groups, you can use a single ACL entry to allow trusted hosts to make specific service requests to a group of public servers.
Note
The system-wide ACL entry limit of 64,000 entries applies to expanded ACL entries. An expanded ACL entry is the individually entered entry equivalent of an object-group element. If you use object groups in an ACL, you enter fewer actual ACL entries. When the ACE expands an ACL that references an object group, internally, multiple ACL entries will exist based on the number of elements present in the object group. To view the number of expanded ACL entries in an ACL, enter the show access-list name command. For details, see the "Displaying ACL Configuration Information and Statistics" section.
Configuring Network Object Groups
This section describes how to configure object groups to streamline the creation of ACL entries in an ACL. It includes the following topics:
•
•
•
•
Creating a Network Object Group
To create an object group, use the object-group command in configuration mode. The syntax of this command is as follows:
object-group network name
The keywords and arguments are as follows:
•
•
For example, to create a network object group, enter:
host1/Admin(config)# object-group network NET_OBJ_GROUP1host1/Admin(config-objgrp-netw)#To remove the network object group from the configuration, enter:
host1/Admin(config)# no object-group network NET_OBJ_GROUP1
Note
Adding a Description to a Network Object Group
To add an optional description to a network object group, use the description command in object group network configuration mode. The syntax of this command is as follows:
description text
The text argument is an unquoted text string with a maximum of 240 alphanumeric characters.
For example, to add a description to a network object group, enter:
host1/Admin(config-objgrp-netw)# description intranet network object groupTo remove a description from a network object group, enter:
host1/Admin(config-objgrp-netw)# no description intranet network object groupConfiguring a Network IP Address for a Network Object Group
To associate a network IP address with a network object group, use the ip_address argument in object-group network configuration mode. The syntax of this command is as follows:
ip_address netmask
The arguments are as follows:
•
•
For example, to add the IP address 192.168.12.15 and network mask 255.255.255.0 to a network object group, enter:
host1/Admin(config-objgrp-netw)# 192.168.12.15 255.255.255.0Enter additional object-group IP addresses as required.
To remove an IP address from the network object group, enter:
host1/Admin(config-objgrp-netw)# no 192.168.12.15 255.255.255.0Configuring a Host IP Address
To associate a host IP address with a network object group, use the host command in object-group network configuration mode. The syntax of this command is as follows:
host ip_address
The ip_address specifies the IP address of the host. Use this argument to specify a single IP address. Enter an IP address in dotted-decimal notation (for example, 192.168.12.15).
For example, to create a network object group that includes three host addresses, enter:
host1/Admin(config)# object-group network NET_OBJ_GROUP1host1/Admin(config-objgrp-netw)# description Administrator Addresseshost1/Admin(config-objgrp-netw)# host 192.168.12.15host1/Admin(config-objgrp-netw)# host 192.168.12.21host1/Admin(config-objgrp-netw)# host 192.168.12.27Configuring Service Object Groups
This section describes how to configure service object groups to streamline the creation of ACL entries that include protocol names and port names in an ACL. It includes the following sections:
•
•
•
Creating a Service Object Group
To create a service object group, use the object-group command in configuration mode. The syntax of this command is as follows:
object-group service name
The keywords and arguments are as follows:
•
•
For example, to create a service object group, enter:
host1/Admin(config)# object-group service SERV_OBJ_GROUP1host1/Admin(config-objgrp-serv)#To remove the service object group from the configuration, enter:
host1/Admin(config)# no object-group service SERV_OBJ_GROUP1
Note
Adding a Description to a Service Object Group
To add an optional description to a service object group, use the description command in object group service configuration mode. The syntax of this command is as follows:
description text
The text argument is an unquoted text string with a maximum of 240 alphanumeric characters.
For example, to add a description to a service object group, enter:
host1/Admin(config)# object-group service SERV_OBJ_GROUP1host1/Admin(config-objgrp-serv)# description intranet network object groupTo remove a description from a service object group, enter:
host1/Admin(config)# object-group service SERV_OBJ_GROUP1host1/Admin(config-objgrp-serv)# no description intranet network object groupDefining Protocol Parameters for a Service Object Group
To define protocol parameters for a service object group, use the protocol argument in object group service configuration mode. For TCP or UDP, the syntax of this command is as follows:
protocol [source {{operator} port1 | port1 port2}] [{{operator} port3 | port3 port4}]
For ICMP, the syntax of this command is:
icmp [icmp-type] [code {{operator} icmp-code1 | range icmp-code1 icmp-code2}]
The keywords, arguments, and options are as follows:
•
•
Note
•
–
