Creating an IP Access List to Filter IP Options TCP Flags Noncontiguous Ports or TTL Values

IP uses four key mechanisms in providing its service: Type of Service, Time to Live, Options, and Header Checksum.

The Options, commonly referred to as IP Options, provide for control functions that are required in some situations but unnecessary for the most common communications. IP Options include provisions for time stamps, security, and special routing.

IP Options may or may not appear in datagrams. They must be implemented by all IP modules (host and gateways). What is optional is their transmission in any particular datagram, not their implementation. In some environments the security option may be required in all datagrams.

The option field is variable in length. There may be zero or more options. IP Options can have one of two formats:

• Format 1: A single octet of option-type.
• Format 2: An option-type octet, an option-length octet, and the actual option-data octets.

The option-length octet counts the option-type octet, the option-length octet, and the option-data octets.

The option-type octet is viewed as having three fields: a 1-bit copied flag, a 2-bit option class, and a 5-bit option number. These fields form an 8-bit value for the option type field. IP Options are commonly referred to by their 8-bit value.

For a complete list and description of IP Options, refer to RFC 791, Internet Protocol at the following URL: http://www.faqs.org/rfcs/rfc791.html

• Filtering of packets that contain IP Options from the network relieves downstream routers and hosts of the load from options packets.
• This feature also minimizes load to the Route Processor (RP) for packets with IP Options that require RP processing on distributed systems. Previously, the packets were always routed to or processed by the RP CPU. Filtering the packets prevents them from impacting the RP.

The ACL TCP Flags Filtering feature provides a flexible mechanism for filtering on TCP flags. Before Cisco IOS Release 12.3(4)T, an incoming packet was matched as long as any TCP flag in the packet matched a flag specified in the access control entry (ACE). This behavior allows for a security loophole, because packets with all flags set could get past the access control list (ACL). The ACL TCP Flags Filtering feature allows you to select any combination of flags on which to filter. The ability to match on a flag set and on a flag not set gives you a greater degree of control for filtering on TCP flags, thus enhancing security.

Because TCP packets can be sent as false synchronization packets that can be accepted by a listening port, it is recommended that administrators of firewall devices set up some filtering rules to drop false TCP packets.

The ACEs that make up an access list can be configured to detect and drop unauthorized TCP packets by allowing only the packets that have a very specific group of TCP flags set or not set. The ACL TCP Flags Filtering feature gives users a greater degree of packet-filtering control in the following ways:

• Users can select any desired combination of TCP flags on which to filter TCP packets.
• Users can configure ACEs in order to allow matching on a flag that is set, as well as on a flag that is not set.

The table below lists the TCP flags, which are further described in RFC 793, Transmission Control Protocol.

This feature greatly reduces the number of ACEs required in an access control list to handle multiple entries for the same source address, destination address, and protocol. If you maintain large numbers of ACEs, we recommend that you use this feature to consolidate existing groups of access list entries wherever it is possible and also when you create new access list entries. When you configure access list entries with noncontiguous ports, you will have fewer access list entries to maintain.

IP extended named and numbered access lists may filter on the TTL value of packets arriving at or leaving an interface. Packets with any possible TTL values 0 through 255 may be permitted or denied (filtered). Like filtering on other fields, such as source or destination address, the ip access-group command specifies in or out, which makes the access list ingress or egress and applies it to incoming or outgoing packets, respectively. The TTL value is checked in conjunction with the specified protocol, application, and any other settings in the access list entry, and all conditions must be met.

• Filtering on TTL provides a way to control which packets are allowed to reach the router or prevented from reaching the router. By looking at your network layout, you can choose whether to accept or deny packets from a certain router based on how many hops away it is. For example, in a small network, you can deny packets from a location more than three hops away. Filtering on TTL allows you to validate if the traffic originated from a neighboring device, as follows. You can accept only packets that reach you in one hop, for example, by accepting only packets with a TTL of one less than the initial TTL value of a particular protocol.
• Many control plane protocols communicate only with their neighbors, but receive packets from everyone. By applying to receiving routers an access list that filters on TTL, you can block unwanted packets.
• The Cisco IOS software sends all packets with a TTL of 0 or 1 to the process level to be processed. The device must then send an ICMP TTL expire message to the source. By filtering packets that have a TTL of 0 through 2, you can reduce the load on the process level.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ip access-list extended access-list-name

4.    [sequence-number] deny protocol source source-wildcard destination destination-wildcard [option option-value] [precedence precedence] [tos tos] [log] [time-range time-range-name] [fragments]

5.    [sequence-number] permit protocol source source-wildcard destination destination-wildcard [option option-value] [precedence precedence] [tos tos] [log] [time-range time-range-name] [fragments]

6.    Repeat Step 4 or Step 5 as necessary.

7.    end

8.    show ip access-lists access-list-name

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	ip access-list extended access-list-name Example: Router(config)# ip access-list extended mylist1	Specifies the IP access list by name and enters named access list configuration mode. Note    The ACL Support for Filtering IP Options feature works only with named, extended ACLs.
Step 4	[sequence-number] deny protocol source source-wildcard destination destination-wildcard [option option-value] [precedence precedence] [tos tos] [log] [time-range time-range-name] [fragments] Example: Router(config-ext-nacl)# deny ip any any option traceroute	(Optional) Specifies a deny statement in named IP access list mode. This access list happens to use a denystatement first, but a permit statement could appear first, depending on the order of statements you need. Use the option keyword and option-value argument to filter packets that contain a particular IP Option. In this example, any packet that contains the traceroute IP option will be filtered out. Use the no sequence-number form of this command to delete an entry.
Step 5	[sequence-number] permit protocol source source-wildcard destination destination-wildcard [option option-value] [precedence precedence] [tos tos] [log] [time-range time-range-name] [fragments] Example: Router(config-ext-nacl)# permit ip any any option security	Specifies a permit statement in named IP access list mode. In this example, any packet (not already filtered) that contains the security IP option will be permitted. Use the no sequence-number form of this command to delete an entry.
Step 6	Repeat Step 4 or Step 5 as necessary.	Allows you to revise the access list.
Step 7	end Example: Router(config-ext-nacl)# end	(Optional) Exits named access list configuration mode and returns to privileged EXEC mode.
Step 8	show ip access-lists access-list-name Example: Router# show ip access-lists mylist1	(Optional) Displays the contents of the IP access list. Review the output to verify that the access list includes the new entry.

• What to Do Next
  

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ip access-list extended access-list-name

4.    [sequence-number] permit tcp source source-wildcard [operator [port]] destination destination-wildcard [operator [port]] [established|{match-any | match-all} {+ | -} flag-name] [precedence precedence] [tos tos] [log] [time-range time-range-name] [fragments]

5.    [sequence-number] deny tcp source source-wildcard [operator [port]] destination destination-wildcard [operator [port]] [established|{match-any | match-all} {+ | -} flag-name] [precedence precedence] [tos tos] [log] [time-range time-range-name] [fragments]

6.    Repeat Step 4 or Step 5 as necessary, adding statements by sequence number where you planned. Use the no sequence-numbercommand to delete an entry.

7.    end

8.    show ip access-lists access-list-name

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	ip access-list extended access-list-name Example: Router(config)# ip access-list extended kmd1	Specifies the IP access list by name and enters named access list configuration mode. Note    The ACL TCP Flags Filtering feature works only with named, extended ACLs.
Step 4	[sequence-number] permit tcp source source-wildcard [operator [port]] destination destination-wildcard [operator [port]] [established|{match-any | match-all} {+ | -} flag-name] [precedence precedence] [tos tos] [log] [time-range time-range-name] [fragments] Example: Router(config-ext-nacl)# permit tcp any any match-any +rst	Specifies a permit statement in named IP access list mode. This access list happens to use a permitstatement first, but a deny statement could appear first, depending on the order of statements you need. Use the TCP command syntax of the permitcommand. Any packet with the RST TCP header flag set will be matched and allowed to pass the named access list kmd1 in Step 3.
Step 5	[sequence-number] deny tcp source source-wildcard [operator [port]] destination destination-wildcard [operator [port]] [established|{match-any | match-all} {+ | -} flag-name] [precedence precedence] [tos tos] [log] [time-range time-range-name] [fragments] Example: Router(config-ext-nacl)# deny tcp any any match-all -ack -fin	(Optional) Specifies a deny statement in named IP access list mode. This access list happens to use a permitstatement first, but a deny statement could appear first, depending on the order of statements you need. Use the TCP command syntax of the denycommand. Any packet that does not have the ACK flag set, and also does not have the FIN flag set, will not be allowed to pass the named access list kmd1 in Step 3. See the deny(IP) command for additional command syntax to permit upper-layer protocols (ICMP, IGMP, TCP, and UDP).
Step 6	Repeat Step 4 or Step 5 as necessary, adding statements by sequence number where you planned. Use the no sequence-numbercommand to delete an entry.	Allows you to revise the access list.
Step 7	end Example: Router(config-ext-nacl)# end	(Optional) Exits the configuration mode and returns to privileged EXEC mode.
Step 8	show ip access-lists access-list-name Example: Router# show ip access-lists kmd1	(Optional) Displays the contents of the IP access list. Review the output to confirm that the access list includes the new entry.

• What to Do Next
  

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ip access-list extended access-list-name

4.    [sequence-number] permit tcp source source-wildcard [operator port [port]] destination destination-wildcard [operator [port]] [established {match-any | match-all} {+ | -} flag-name] [precedence precedence] [tos tos] [log] [time-range time-range-name] [fragments]

5.    [sequence-number] deny tcp source source-wildcard [operator port [port]] destination destination-wildcard [operator [port]] [established {match-any | match-all} {+ | -} flag-name] [precedence precedence] [tos tos] [log] [time-range time-range-name] [fragments]

6.    Repeat Step 4 or Step 5 as necessary, adding statements by sequence number where you planned. Use the no sequence-number command to delete an entry.

7.    end

8.    show ip access-lists access-list-name

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	ip access-list extended access-list-name Example: Router(config)# ip access-list extended acl-extd-1	Specifies the IP access list by name and enters named access list configuration mode.
Step 4	[sequence-number] permit tcp source source-wildcard [operator port [port]] destination destination-wildcard [operator [port]] [established {match-any | match-all} {+ | -} flag-name] [precedence precedence] [tos tos] [log] [time-range time-range-name] [fragments] Example: Router(config-ext-nacl)# permit tcp any eq telnet ftp any eq 450 679	Specifies a permit statement in named IP access list configuration mode. Operators include lt (less than), gt (greater than), eq (equal), neq (not equal), and range (inclusive range). If the operator is positioned after the source and source-wildcard arguments, it must match the source port. If the operator is positioned after the destination and destination-wildcard arguments, it must match the destination port. The range operator requires two port numbers. You can configure up to 10 ports after the eq and neqoperators. All other operators require one port number. To filter UDP ports, use the UDP syntax of this command.
Step 5	[sequence-number] deny tcp source source-wildcard [operator port [port]] destination destination-wildcard [operator [port]] [established {match-any | match-all} {+ | -} flag-name] [precedence precedence] [tos tos] [log] [time-range time-range-name] [fragments] Example: Router(config-ext-nacl)# deny tcp any neq 45 565 632	(Optional) Specifies a deny statement in named access list configuration mode. Operators include lt (less than), gt (greater than), eq (equal), neq (not equal), and range (inclusive range). If the operator is positioned after the source and source-wildcard arguments, it must match the source port. If the operator is positioned after the destination and destination-wildcard arguments, it must match the destination port. The range operator requires two port numbers. You can configure up to 10 ports after the eq and neqoperators. All other operators require one port number. To filter UDP ports, use the UDP syntax of this command.
Step 6	Repeat Step 4 or Step 5 as necessary, adding statements by sequence number where you planned. Use the no sequence-number command to delete an entry.	Allows you to revise the access list.
Step 7	end Example: Router(config-ext-nacl)# end	(Optional) Exits named access list configuration mode and returns to privileged EXEC mode.
Step 8	show ip access-lists access-list-name Example: Router# show ip access-lists kmd1	(Optional) Displays the contents of the access list. Review the output to verify that the access list displays the new entries that you created.

SUMMARY STEPS

1.    enable

2.    show ip access-lists access-list-name

3.    configure terminal

4.    ip access-list extended access-list-name

5.    no [sequence-number] permit protocol source source-wildcard destination destination-wildcard[option option-name] [precedence precedence][tos tos] [log] [time-range time-range-name] [fragments]

6.    [sequence-number] permit protocol source source-wildcard[operator port[port]] destination destination-wildcard[operator port[port]] [option option-name] [precedence precedence][tos tos] [log] [time-range time-range-name] [fragments]

7.    Repeat Steps 5 and 6 as necessary, adding permit or deny statements to consolidate access list entries where possible. Use the no sequence-number command to delete an entry.

8.    end

9.    show ip access-lists access-list-name

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	show ip access-lists access-list-name Example: Router# show ip access-lists mylist1	(Optional) Displays the contents of the IP access list. Review the output to see if you can consolidate any access list entries.
Step 3	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 4	ip access-list extended access-list-name Example: Router(config)# ip access-list extended mylist1	Specifies the IP access list by name and enters named access list configuration mode.
Step 5	no [sequence-number] permit protocol source source-wildcard destination destination-wildcard[option option-name] [precedence precedence][tos tos] [log] [time-range time-range-name] [fragments] Example: Router(config-ext-nacl)# no 10	Removes the redundant access list entry that can be consolidated. Repeat this step to remove entries to be consolidated because only the port numbers differ. After this step is repeated to remove the access list entries 20, 30, and 40, for example, those entries are removed because they will be consolidated into one permit statement. If a sequence-number is specified, the rest of the command syntax is optional.
Step 6	[sequence-number] permit protocol source source-wildcard[operator port[port]] destination destination-wildcard[operator port[port]] [option option-name] [precedence precedence][tos tos] [log] [time-range time-range-name] [fragments] Example: Router(config-ext-nacl)# permit tcp any neq 45 565 632 any eq 23 45 34 43	Specifies a permit statement in named access list configuration mode. In this instance, a group of access list entries with noncontiguous ports was consolidated into one permit statement. You can configure up to 10 ports after the eq and neq operators.
Step 7	Repeat Steps 5 and 6 as necessary, adding permit or deny statements to consolidate access list entries where possible. Use the no sequence-number command to delete an entry.	Allows you to revise the access list.
Step 8	end Example: Router(config-std-nacl)# end	(Optional) Exits named access list configuration mode and returns to privileged EXEC mode.
Step 9	show ip access-lists access-list-name Example: Router# show ip access-lists mylist1	(Optional) Displays the contents of the access list. Review the output to verify that the redundant access list entries have been replaced with your new consolidated entries.

• What To Do Next
  

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ip access-list extended access-list-name

4.    [sequence-number] permit protocol source source-wildcard destination destination-wildcard[option option-name] [precedence precedence] [tos tos] [ttl operator value] [log] [time-range time-range-name] [fragments]

5.    Continue to add permit or deny statements to achieve the filtering you want.

6.    exit

7.    interface type number

8.    ip access-group access-list-name {in | out}

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	ip access-list extended access-list-name Example: Router(config)# ip access-list extended ttlfilter	Defines an IP access list by name. An access list that filters on TTL value must be an extended access list.
Step 4	[sequence-number] permit protocol source source-wildcard destination destination-wildcard[option option-name] [precedence precedence] [tos tos] [ttl operator value] [log] [time-range time-range-name] [fragments] Example: Router(config-ext-nacl)# permit ip host 172.16.1.1 any ttl lt 2	Sets conditions to allow a packet to pass a named IP access list. Every access list must have at least one permit statement. This example permits packets from source 172.16.1.1 to any destination with a TTL value less than 2.
Step 5	Continue to add permit or deny statements to achieve the filtering you want.	--
Step 6	exit Example: Router(config-ext-nacl)# exit	Exits any configuration mode to the next highest mode in the CLI mode hierarchy.
Step 7	interface type number Example: Router(config)# interface ethernet 0	Configures an interface type and enters interface configuration mode.
Step 8	ip access-group access-list-name {in | out} Example: Router(config-if)# ip access-group ttlfilter in	Applies the access list to an interface.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ip access-list extended access-list-name

4.    [sequence-number] permit protocol source source-wildcard destination destination-wildcard ttl operator value

5.    Continue to add permit or deny statements to achieve the filtering you want.

6.    exit

7.    class-map class-map-name [match-all | match-any]

8.    match access-group {access-group | name access-group-name}

9.    exit

10.    policy-map policy-map-name

11.    class {class-name | class-default}

12.    drop

13.    exit

14.    exit

15.    control-plane

16.    service-policy {input | output} policy-map-name

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	ip access-list extended access-list-name Example: Router(config)# ip access-list extended ttlfilter	Defines an IP access list by name. An access list that filters on a TTL value must be an extended access list.
Step 4	[sequence-number] permit protocol source source-wildcard destination destination-wildcard ttl operator value Example: Router(config-ext-nacl)# permit ip host 172.16.1.1 any ttl lt 2	Sets conditions to allow a packet to pass a named IP access list. Every access list must have at least one permit statement. This example permits packets from source 172.16.1.1 to any destination with a TTL value less than 2.
Step 5	Continue to add permit or deny statements to achieve the filtering you want.	The packets that pass the access list will be dropped.
Step 6	exit Example: Router(config-ext-nacl)# exit	Exits any configuration mode to the next highest mode in the CLI mode hierarchy.
Step 7	class-map class-map-name [match-all | match-any] Example: Router(config)# class-map acl-filtering	Creates a class map to be used for matching packets to a specified class.
Step 8	match access-group {access-group | name access-group-name} Example: Router(config-cmap)# match access-group name ttlfilter	Configures the match criteria for a class map on the basis of the specified access control list.
Step 9	exit Example: Router(config-cmap)# exit	Exits any configuration mode to the next highest mode in the CLI mode hierarchy.
Step 10	policy-map policy-map-name Example: Router(config)# policy-map acl-filter	Creates or modifies a policy map that can be attached to one or more interfaces to specify a service policy.
Step 11	class {class-name | class-default} Example: Router(config-pmap)# class acl-filter-class	Specifies the name of the class whose policy you want to create or change or to specify the default class (commonly known as the class-default class) before you configure its policy.
Step 12	drop Example: Router(config-pmap-c)# drop	Configures a traffic class to discard packets belonging to a specific class.
Step 13	exit Example: Router(config-pmap-c)# exit	Exits any configuration mode to the next highest mode in the CLI mode hierarchy.
Step 14	exit Example: Router(config-pmap)# exit	Exits any configuration mode to the next highest mode in the CLI mode hierarchy.
Step 15	control-plane Example: Router(config)# control-plane	Associates or modifies attributes or parameters that are associated with the control plane of the device.
Step 16	service-policy {input | output} policy-map-name Example: Router(config-cp)# service-policy input acl-filter	Attaches a policy map to a control plane for aggregate control plane services.