What is the difference between a standard and an extended Access-List?

The main difference lies in the granularity of filtering. Standard Access-Lists are simpler and filter traffic based only on the source IP address. They permit or deny traffic from an entire network or a specific host. Extended Access-Lists are more powerful and specific. They can filter traffic based on multiple criteria, including source IP address, destination IP address, protocol type (e.g., TCP, UDP, ICMP), and source and destination port numbers (e.g., port 80 for HTTP).

What is the significance of the 'implicit deny' rule in an Access-List?

The 'implicit deny' is a crucial security feature. At the end of every Access-List, there is an unwritten, invisible rule that denies any traffic that did not match any of the preceding permit or deny statements in the list. This ensures a 'default deny' security posture, meaning that no traffic is allowed unless it is explicitly permitted. It prevents accidental security holes by forcing administrators to be specific about what traffic is allowed.

Access-List

Q: What is the primary purpose of an Access-List?

The primary purpose of an Access-List is to provide a basic level of security for a network by controlling traffic. It acts as a packet filter, examining each packet and deciding whether to forward or drop it based on a predefined set of rules. This allows administrators to block unwanted traffic and permit only legitimate communication, thereby enhancing network security and managing network performance.

Intermediate

An Access-List (ACL) is a set of rules applied to network devices like routers and firewalls to filter traffic. These rules specify which packets are permitted or denied entry or exit from a network, based on criteria such as source and destination IP addresses, protocols, and port numbers.

First used·Early 1990s

Definitions·2

Synonyms·4

Category·Network Security

Also known as

ACLAccess Control ListPacket FilterFirewall Rule

Definitions

What it means.

01
Core Concept in Network Security
An Access-List (ACL), or Access Control List, is a sequence of permit or deny rules that are applied to network traffic. When a router or firewall receives a packet on an interface where an ACL is applied, it evaluates the packet against the rules in the list sequentially.

How It Works

Sequential Processing: The device checks the packet against the first rule in the list.

First Match Principle: If the packet matches the criteria of the rule, the device takes the specified action (permit or deny) and stops processing the list. No further rules are checked for that packet.

Implicit Deny: If the packet does not match any of the rules in the list, it is dropped. This is because of an invisible 'deny all' rule that exists at the end of every ACL.

For example, an ACL might be configured to allow web traffic to a server while blocking all other access:

# Permit HTTP traffic from any source to the web server at 192.168.1.100 access-list 101 permit tcp any host 192.168.1.100 eq 80 # Permit HTTPS traffic from any source to the web server at 192.168.1.100 access-list 101 permit tcp any host 192.168.1.100 eq 443 # (Implicit deny any any) - All other traffic is automatically denied
02
Types of Access-Lists
Access-Lists come in several types, each offering different levels of control. The most common types are standard and extended ACLs.

Standard ACLs

These are the most basic form of packet filter.

They filter traffic based only on the source IP address.

Because they are less specific, they are processed more quickly by the device but offer limited control.

They are typically identified by a number range (e.g., 1-99 and 1300-1999 in Cisco IOS).

Example: access-list 10 deny 192.168.1.50 (This rule denies all traffic from the host with IP 192.168.1.50).

Extended ACLs

These provide more granular control over traffic.

They can filter based on multiple criteria: source IP address, destination IP address, protocol (TCP, UDP, ICMP, etc.), and source/destination port numbers.

They are identified by a different number range (e.g., 100-199 and 2000-2699 in Cisco IOS).

Example: access-list 101 permit tcp any host 10.0.0.5 eq 80 (This rule permits TCP traffic from any source to the host 10.0.0.5 on port 80, which is HTTP).

Named ACLs

Functionally, these can be either standard or extended, but they are identified by a descriptive name instead of a number (e.g., 'BLOCK_GUEST_ACCESS'). This makes complex lists easier to understand and manage.

Origin

Where it comes from.

Etymology

The term is descriptive, derived from its function: it is a 'list' of rules that controls 'access' to or from a network segment.

Historical context

The concept of the Access-List emerged in the late 1980s and early 1990s with the commercialization of the internet and the corresponding need for network traffic control. Companies like Cisco Systems were pioneers in implementing ACLs in their router software (IOS), making them a fundamental tool for network administrators.

Initially, only simple packet filters, known as standard ACLs, were available. These lists could only filter traffic based on the source IP address. As network security needs grew more complex, extended ACLs were developed. These provided much more granular control, allowing administrators to create rules based on source and destination addresses, protocols, and port numbers.

The Access Control List became a foundational technology for modern network firewalls. While today's next-generation firewalls use more sophisticated stateful inspection and deep packet inspection, the basic principle of defining rules to permit or deny traffic, established by early ACLs, remains a core concept in network security.

Usage

In context.

The network administrator configured an Access-List on the router's interface to block all incoming traffic from a known malicious IP range.
To secure the internal server, we need to apply a strict ACL, also known as a packet filter, that only allows HTTP and HTTPS traffic from the corporate network.
Troubleshooting the connectivity issue revealed that a misconfigured Access Control List was inadvertently dropping legitimate packets from the finance department.
The new security policy requires a Firewall Rule to be implemented that denies all outbound Telnet connections, which we will enforce using an extended Access-List.

FAQ

Common questions.

The primary purpose of an Access-List is to provide a basic level of security for a network by controlling traffic. It acts as a packet filter, examining each packet and deciding whether to forward or drop it based on a predefined set of rules. This allows administrators to block unwanted traffic and permit only legitimate communication, thereby enhancing network security and managing network performance.

Taxonomy

What it means.

Core Concept in Network Security

Types of Access-Lists

Where it comes from.

In context.

Common questions.

Filed under.