|
Network administrators must figure out
how to deny unwanted access to the network while allowing internal
users appropriate access to necessary services. Although security
tools, such as passwords, callback equipment, and physical
security devices are helpful, they often lack the flexibility of
basic traffic filtering and the specific controls most
administrators prefer. For example, a network administrator may
want to allow users access to the Internet, but not permit
external users telnet access into the LAN. Routers provide basic traffic
filtering capabilities, such as blocking Internet traffic, with
access control lists (ACLs). An ACL is a sequential list of permit
or deny statements that apply to addresses or upper-layer
protocols. This module will introduce standard and extended ACLs
as a means to control network traffic, and how ACLs are used as
part of a security solution.
In addition, this chapter includes
tips, considerations, recommendations, and general guidelines on
how to use ACLs, and includes the commands and configurations
needed to create ACLs. Finally, the chapter provides examples of
standard and extended ACLs and how to apply ACLs to router
interfaces.
ACLs can be
as simple as a single line intended to permit packets from a
specific host, or they can be extremely complex sets of rules and
conditions that can precisely define traffic and shape the
performance of router processes. While many of the advanced uses
of ACLs are beyond the scope of this course, this module provides
details about standard and extended ACLs, the proper
placement of ACLs, and some special applications of ACLs.
Students completing this module should be able to:
- Describe the differences between
standard and extended ACLs
- Explain the rules for placement
of ACLs
- Create and apply named ACLs
- Describe the function of
firewalls
- Use ACLs to restrict virtual
terminal access
|
