Access Control Lists (ACLs) are an essential networking technology employed to manage and filter traffic based on specified criteria, thereby enhancing security and enforcing access control policies.

ACLs Overview

ACLs enable network devices to make decisions on whether to permit or deny data packets based on attributes such as source IP address, destination IP address, protocol type, and port number.

Flow Filtration Concepts

Network devices capable of packet filtering include:

• Integrated firewalls within routers
• Specialized security appliances
• Servers providing network services

Application of ACLs

ACLs contain sets of rules applied to router interfaces. These rules dictate packet handling policies for ingress and egress traffic. An ACL can be used for multiple purposes, including:

• Managnig traffic flow
• Preventing unauthorized access to network resources

Types of ACLs

• Standard ACLs: Operate on source IP addresses.
• Extended ACLs: Operate on source and destination IPs, protocol type, and port numbers.

Numerical and Named ACLs

ACLs can be classified as numerical (e.g., standard ACL range 2000–2999, extended ACL range 3000–3999) or named (assigned a textual identifier).

Configuration of ACLs

Standard ACL Configuration

To define a standard ACL:

Router(config)#access-list 1 permit 192.168.1.0 0.0.0.255
Router(config-if)#ip access-group 1 in

Extended ACL Configuration

For extended ACLs:

Router(config)#access-list 101 permit tcp 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 eq 80
Router(config-if)#ip access-group 101 out

Named ACLs

Create named ACL for added control:

Router(config)#ip access-list extended web-access
Router(config-ext-nacl)#permit tcp any any eq 80
Router(config-ext-nacl)#exit
Router(config-if)#ip access-group web-access in

Example Network Configuration

Scenario

Use ACLs to implement traffic restrictions between VLAN segments and restrict FTP access.

Configuration

ACL to block traffic between VLAN10 and VLAN20:

Router#acl 2000
Router-acl-basic-2000#rule deny source 192.168.10.0 255.255.255.0
Router-acl-basic-2000#rule permit source any
Router-acl-basic-2000#apply to interface Gi0/0

ACL to block FTP protocol from a specific host:

Router#acl 3001
Router-acl-adv-3001#rule deny tcp source 192.168.1.10 destination 202.10.100.100 eq 21
Router-acl-adv-3001#rule permit ip source any destination any
Router-acl-adv-3001#apply to interface Gi0/0

Apply these ACLs appropriately on relevant network interfaces for security purposes.