Access Control List Technology Overview

Technical Background

As networks expand rapidly, security concerns and Quality of Service (QoS) issues become increasingly critical. Access Control Lists (ACLs) serve as an essential technology that enables precise identification of network packet flows. When combined with other technologies, ACLs control network access behavior, prevent cyber attacks, and optimize bandwidth utilization, ensuring both network security and reliable service quality.

Modern organizations require tools for traffic filtering. For instance, a company may need to protect financial data by blocking research department access to accounting servers while allowing unrestricted access from executive offices.

ACL Fundamentals

An Access Control List consists of ordered rules containing permit or deny statements. It functions as a matchnig mechanism that identifies and differentiates network packets.

Common Applications:

• IP traffic matching
• Traffic-filter implementation
• Network Address Translation (NAT) invocation
• Routing policy integration
• Firewall policy deployment
• QoS implementation
• Various other network functions

Core Concepts and Working Principles

ACL Structure

An ACL comprises multiple permit or deny statements, where each statement represents a distinct rule with corresponding processing actions.

Rule Identifiers and Increments

Rule IDs: Each rule within an ACL has a unique identifier.

Increment Values: The difference between consecutive rule numbers when automatically assigned, typically set to 5 by default. This facilitates insertion of new rules between existing ones.

Numbering Rules: For the first unnumbered rule, the system uses the increment value as the starting number. Subsequent rules receive the smallest integer that exceeds the current maximum rule number and is divisible by the increment.

Wildcard Masks

A wildcard mask is a 32-bit value indicating which IP address bits require exact matching versus those that can be ignored. While displayed in dotted decimal notation similar to subnet masks, its function differs completely from traditional subnet masking.

Classification and Identification Methods

Categorization by Rule Definition Method

Type	ID Range	Description
Basic ACL	2000~2999	Uses source IP address, fragmentation info, and time periods for rule definition
Advanced ACL	3000~3999	Supports source/destination IP, protocol type, ICMP types, TCP/UDP ports, time periods
Layer 2 ACL	4000~4999	Utilizes Ethernet frame header information like MAC addresses and protocol types
User-defined ACL	5000~5999	Employs packet headers, offset positions, string masks, and custom strings
User ACL	6000~6999	Combines IPv4 addresses with UCL groups, protocols, ports, and other parameters

Categorization by Identification Method

Type	Description
Numeric ACL	Traditional identification using unique numbers
Named ACL	Uses descriptive names instead of numerical identifiers

Matching Rules

Matching Mechanism

The system processes packets according to predefined matching criteria.

Processing Order

Configuration Order: Rules are processed sequentially based on their numerical order, with lower-numbered rules taking precedence.

Processing Location

Inbound and Outbound Directions: ACLs can be applied to traffic entering or exiting network interfaces.

Configuration and Implementation

Basic ACL Commands

Creating Basic ACLs

1. Create numeric basic ACL:
   [Device] acl [ number ] acl-number [ match-order config ]
   Creates a numeric basic ACL (2000-2999) and enters ACL configuration mode.
2. Create named basic ACL:
   [Device] acl name acl-name { basic | acl-number } [ match-order config ]
   Creates a named basic ACL and enters configuration mode.

Configuring Basic ACL Rules

In basic ACL mode, configure rules using:
[Device-acl-basic-2000] rule [ rule-id ] { deny | permit } [ source { source-address source-wildcard | any } | time-range timename ]

Implemantation Example: Basic ACL Traffic Filtering

Requirements: Configure a router to filter packets originating from the 192.168.1.0/24 subnet while allowing other traffic, preventing users in this subnet from accessing server networks on the router's right side.

Steps:

1. Ensure router has IP addressing and routing configured
2. Create basic ACL to block 192.168.1.0/24 subnet:

[Router] access-list 2000
[Router-acl-basic-2000] rule 5 deny source 192.168.1.0 0.0.0.255
[Router-acl-basic-2000] rule 10 permit source any

3. Apply traffic filtering on incoming direction of interface GE0/0/1:

[Router] interface GigabitEthernet 0/0/1
[Router-GigabitEthernet0/0/1] traffic-filter inbound acl 2000
[Router-GigabitEthernet0/0/1] exit

Advanced ACL Commands

Creating Advanced ACLs

1. Create numeric advanced ACL:
   [Device] acl [ number ] acl-number [ match-order config ]
   Creates numeric advanced ACL (3000-3999) and enters configuration mode.
2. Create named advanced ACL:
   [Device] acl name acl-name { advance | acl-number } [ match-order config ]
   Creates named advanced ACL and enters configuration mode.

Configuring Advanced ACL Rules

Rules vary based on protocol type. For IP protocol:
rule [ rule-id ] { deny | permit } ip [ destination { destination-address destination-wildcard | any } | source { source-address source-wildcard |any } | time-range time-name | [ dscp dscp | [ tos tos | precedence precedence ] ] ]

For TCP protocol:
rule [ rule-id ] { deny | permit } { protocol-number | tcp } [ destination { destination-address destination-wildcard | any } | destination-port{ eq port | gt port | lt port | range port-start port-end } | source { source-address source-wildcard | any } | source-port { eq port | gt port | lt port | range port-start port-end } | tcp-flag { ack | fin | syn } * | time-range time-name ] *

Implementation Example: Advanced ACL Inter-subnet Restrictions

Requirements: A company uses a router to connect departments. The IT administrator has allocated separate IP subnets for R&D and Marketing divisions. Implement restrictions to prevent inter-departmental communication and protect sensitive corporate information.

Steps:

1. Verify router IP addressing and routing configuration
2. Create advanced ACL 3001 to block R&D from accessing Marketing:

[Router] access-list 3001
[Router-acl-adv-3001] rule 5 deny ip source 172.16.1.0 0.0.0.255 destination 172.16.2.0 0.0.0.255
[Router-acl-adv-3001] exit

3. Create advanced ACL 3002 to block Marketing from accessing R&D:

[Router] access-list 3002
[Router-acl-adv-3002] rule 5 deny ip source 172.16.2.0 0.0.0.255 destination 172.16.1.0 0.0.0.255
[Router-acl-adv-3002] exit

4. Apply traffic filtering on both interfaces since inter-departmental traffic enters through GE0/0/1 and GE0/0/2:

[Router] interface GigabitEthernet 0/0/1
[Router-GigabitEthernet0/0/1] traffic-filter inbound acl 3001
[Router-GigabitEthernet0/0/1] exit
[Router] interface GigabitEthernet 0/0/2
[Router-GigabitEthernet0/0/2] traffic-filter inbound acl 3002
[Router-GigabitEthernet0/0/2] exit

Access Control Lists represent a widely-used networking technology. Their fundamental principle involves network devices with ACL configurations examining passing packets against pre-established matching criteria, then executing predetermined actions on matched packets. These matching rules and corresponding actions are tailored to specific network requirements. The variety of processing actions and matching criteria allows ACLs to fulfilll diverse networking objectives. ACL technology consistently integrates with firewalls, routing policies, QoS mechanisms, and traffic filtering systems.