Cisco Router OSPF Design and Implementation Guide
William Parkhurst, PhD, CCIE
 $54.95  0-07-048626-3
Backward Forward
Chapter: 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13

Reserve your copy at a
Beta Bookstore near you!
Contact Bet@books
© 1998 The McGraw-Hill Companies, Inc. All rights reserved.
Any use of this Beta Book is subject to the rules stated in the Terms of Use.

Chapter 7

IP Traffic Management

Introduction

In general, there are two types of IP traffic, routing and control traffic and user traffic. This chapter examines techniques for managing user traffic. Types of user traffic that you are probably most familiar with are telnet, ftp, email, pings, and of course the World Wide Web. IP traffic can be managed through the use of standard and extended IP access lists. But before we look at the facilities available in the Cisco IOS for traffic management we need to examine the structure of IP, UDP, and TCP packets in order to gain an understanding of the information available in these packets that we can use to selectively manage IP traffic.

IP Data Packet Format

We have seen that the Internet Protocol operates at layer three, the network layer, of the Internet layered model. Data from layer four processes are encapsulated in an IP datagram having the structure shown in figure 7.1. The 4-bit version field contains the version number of the format of the IP datagram. Routers must check the version number to see if it matches the version number of IP that they are running. If the version number does not match then the packet will be rejected. The current IP version number is 4. The 4-bit header length is the length of the IP header in 32-bit words. If IP options and padding are not used then this field will contain 5 meaning that the IP header length is 20

0 3 4 7 8 15 16 31

Version

HLEN

Type of Service

Total Length

Identification

Flags

Fragment Offset

Time to Live

Protocol

Header Checksum

Source IP Address

Destination IP Address

IP Options

Padding

Data

.

.

.

Data

Figure 7.1. IP datagram packet format.

bytes. The 8-bit type of service field specifies how the IP datagram should be handled by the router. This field is ignored by routers but will eventually have a use in later versions. The total length is the length of the IP datagram in bytes and includes both the header length and the data length. The length of the data can easily be determined by subtracting the header length * 4 from this field. Since the total length field is 16-bits the maximum size of an IP datagram is 65,635 bytes. IP datagrams may traverse networks with different MTU sizes possibly causing the IP packet to become fragmented. The identification, flags and fragment offset fields are used to control the fragmentation and re-assembly of IP datagrams. Routing loops may occur which can cause an IP packet to endlessly circulate in the network. The time to live field is used to break potential routing loops. The TTL field is initialized to a positive number and each router that the packet passes through decrements this field by 1. When the TTL field goes to zero the router will discard the packet. The data contained in an IP packet is from a layer four protocol. The protocol field identifies from which layer four process the data was received, such as UDP or TCP. The header checksum is a checksum that is computed for the IP header only and does not include the data. The upper layer protocol that supplied the data typically includes a data checksum so there is no need for the data to be included in the IP checksum. The source IP address contains the IP address of the originator of the datagram and the destination address is the address of the ultimate destination for the packet. A forwarding router never changes the source and destination IP addresses. As we have seen in chapter 4, a router will change the source and destination MAC addresses of a forwarded packet but the router will never change the IP addresses in the IP header. The IP options field has a variable length depending on the type of option that is being used. The padding field is also a variable length that depends on the size of the options field. Since the header length field gives a length in 32-bit words then the header must end on a 32-bit boundary. The padding field is filled with zeros so that the length of the options field and the length of the padding field is 32 bits.

Standard IP Access Lists

A standard IP access list can be used to filter IP traffic based on the source address contained in the IP header. Standard IP access lists cannot be used to filter traffic based on any other parameter. An access-list is created in global configuration mode as shown.

Standard IP access lists are identified by a number in the range from 1 to 99 so a router can have a maximum of 99 standard IP access-lists active simultaneously.

router#configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

router(config)#access-list ?

<1-99> IP standard access list

<100-199> IP extended access list

<1000-1099> IPX SAP access list

<1100-1199> Extended 48-bit MAC address access list

<1200-1299> IPX summary address access list

<200-299> Protocol type-code access list

<300-399> DECnet access list

<400-499> XNS standard access list

<500-599> XNS extended access list

<600-699> Appletalk access list

<700-799> 48-bit MAC address access list

<800-899> IPX standard access list

<900-999> IPX extended access list

The first parameter for a standard IP access list is the list number having a value of 1 to 99.

router(config)#access-list 1 ?

deny Specify packets to reject

permit Specify packets to forward

The second parameter indicates whether traffic will be permitted or denied. For example, assume we want to deny host 1 from accessing network 172.16.2.0 in figure 7.2 but we want to allow all other hosts to be able to access network 172.16.2.0.

This would be a deny operation in an access list.

router(config)#access-list 1 deny ?

Hostname or A.B.C.D Address to match

any Any source host

host A single host address

What do we want to deny? We want to deny host 1, which has an IP address of 172.16.3.1. There are two ways to enter a host address. The first is to simply enter the host address as an IP address.

router(config)#access-list 1 deny 172.16.3.1 ?

A.B.C.D Wildcard bits

<cr>

Notice that the entire address of the host was entered. The next parameter is called the wildcard bits and the bits can be considered a reverse mask because we enter a 0 to match a bit and a 1 indicates that we don’t care what the corresponding bit value is. In order to match the entire host address the wild card bits would all be zero.

router(config)#access-list 1 deny 172.16.3.1 0.0.0.0 ?

<cr>

We can now list the access list from exec mode.

router#show access-lists

Standard IP access list 1

deny 172.16.3.1

Another way to enter a host address is to use the keyword host when creating the access list.

router(config)#access-list 1 deny ?

Hostname or A.B.C.D Address to match

any Any source host

host A single host address

router(config)#access-list 1 deny host ?

Hostname or A.B.C.D Host address

router(config)#access-list 1 deny host 172.16.3.1 ?

<cr>

List the access-list to see if there is any difference from the previous example.

router#show access-lists

Standard IP access list 1

deny 172.16.3.1

As we can see there is no difference. The forms 172.16.3.1 0.0.0.0 and host 172.16.3.1 are identical. From the access list listing we can see that there is only one statement contained in the access-list, but there are actually two statements. The last statement in an IP access list is always deny any. This has the effect of denying all IP traffic and is implicitly added at the end of every access-list. Our access list that we have created actually contains

Standard IP access list 1

deny 172.16.3.1

deny any (implicit)

A very common mistake when working with access lists is to forget the implicit deny any statement that the router adds at the end of the access list. Sometimes this implicit statement is useful as we shall see, but many times it can cause your access list to filter traffic that you had no intention of filtering. For this example we only want to deny one host from accessing network 172.16.2.0 and allow any other host to access this network so we need to permit all other hosts.

router(config)#access-list 1 permit any

The access list now contains the statements to accomplish our objective.

router#show access-lists

Standard IP access list 1

deny 172.16.3.1

permit any

For an access-list to be active it must be applied to a router interface in interface configuration mode. From figure 7.2 we can see that we have six interfaces on which we can apply the access-list. Of course the access list would have to be created on the router that we are going to use to filter the traffic. Where is the best place to put the access list? Our goal is to block host 172.16.3.1 from reaching network 172.16.2.0 but not to interfere with host 1’s traffic in any other way. If we put the access-list on the ethernet interface on router r3 we would block all of host 1’s traffic. A standard IP access list can only filter on the source address and not the destination address. If the access-list is placed on router r3 then host 1 could not reach network 172.16.4.0 or any other network. A good rule for standard access lists is stated below and should be committed to memory.

A standard access list should be applied as close to the destination as possible.

This rule means to place the standard access list on the router directly attached to the network that you are trying to deny access to. So the access-list for this example should be placed on router r1. Now that we have decided on which router to place the access list the next question is on which interface should we place it. We can use the access list to filter traffic coming in the serial interface or going out the ethernet interface. For this example the interface makes no difference, but it will soon. The commands for placing the access-list on the interfaces are shown below.

For the serial interface

r1(config)#interface serial 0

r1(config-if)#ip access-group ?

<1-199> IP access list (standard or extended)

WORD Access-list name

r1(config-if)#ip access-group 1 ?

in inbound packets

out outbound packets

<cr>

r1(config-if)#ip access-group 1 in

For the ethernet interface

r1(config)#interface ethernet 0

r1(config-if)#ip access-group ?

r1(config-if)#ip access-group 1 out

The ip access-group interface configuration command is used to associate an access-list with the interface. Which way is preferred? For this example, placing the access-list on the serial interface as an input list will relieve the router of having to route the packet to the ethernet interface thereby making the process more efficient. If router r1 has multiple attached networks as shown in figure 7.3 then the serial interface is not the place to put the access list. Can you determine why?

Figure 7.3. An input access-list on router r1 will deny host 1 access to networks 2.0 and 5.0.

If host 1 tries to access a resource on network 172.16.5.0 the input access list on the serial interface of router r1 will block the traffic since an access-list can only filter traffic based on the source address. For this scenario the best place to put the access list is on the output of the ethernet interface on router r1. Host 1 could then access network 172.16.5.0 but not 172.16.2.0. Is there an input access list we can use on the serial interface of router r1 so that host 1 can reach network 172.16.5.0 but not 172.16.2.0? The answer is no. In order to do this, we will need to use an extended IP access list, which we will cover shortly. Before doing so we need to look at the mechanics of building access lists. Whenever we add a permit or deny statement to an access list the statement is inserted at the end of the list. Well, almost the end of the list. Actually the statement is inserted as the second to the last statement since the implicit deny any statement is always the last statement. If you create an access list and you notice that your permit and deny statements are not in the proper order, there is no way to delete a statement or insert a statement anywhere in the list. The only choice is to delete the access list and start over. The no form of the command is used to delete an access list.

r1#configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

r1(config)#no access-list 1

We have seen how to deny a host access to a network using a standard IP access list. We can also deny access to an entire network with a standard IP access list. For example, we want to deny all hosts on network 172.16.3.0 from reaching network 172.16.2.0. How we would accomplish this goal? Remember that the wildcard bits are used to determine which part of the address is used when determining if traffic is to be filtered. To deny access to the entire 172.16.3.0 network we would use the source/wildcard bits pair shown below.

172.16.3.0 0.0.0.255

In other words, we don’t care what the last octet of the source address is and any address in the range 172.16.3.0 to 172.16.3.255 will match. The corresponding access list for this case is

Standard IP access list 1

deny 172.16.3.0, wildcard bits 0.0.0.255

permit any

One final standard IP access list example is in order. Assume that we only want hosts on network 172.16.3.0 to be able to access network 172.16.2.0. What would we do this? The following access list will accomplish this goal.

Standard IP access list 1

permit 172.16.3.0, wildcard bits 0.0.0.255

Any traffic with a source IP address of 172.16.3.x would be allowed and all other traffic would be denied because of the implicit deny any statement at the end of the list. Standard IP access lists either permit or deny all IP traffic from a source that has an address that matches the permit or deny statements, regardless of the traffic type or destination. Extended IP access lists should be used when we want to filter traffic based on the destination or type of traffic. Before we cover the commands for extended IP access lists we need to examine layer four protocol packet headers to determine what information is available to an extended IP access list.

User Datagram Protocol

The user datagram protocol (UDP) is a connectionless protocol that uses IP as its transport mechanism. The format of a UDP packet is shown in figure 7.4.

0 15 16 31

UDP Source Port

UDP Destination Port

UDP Message Length

UDP Checksum

Data

.

.

.

Data

Figure 7.4. User Datagram Protocol packet format.

The UDP source and destination ports identify the upper layer application that is utilizing UDP. The source port is optional and if it is not used then this field should be set to zero. Table 7.1 lists some of the common UDP port numbers.

Table 7.1. Common UDP port numbers.

UDP Port Number

Decimal

UDP Port Number

Hexadecimal

Application

7

7

Echo (PING)

37

25

Time

53

35

DNS

67

43

BOOTP Server

68

44

BOOTP Client

69

45

TFTP

The UDP message length field is the length, in bytes, of the UDP datagram including the UDP header and data. If the datagram contains no data then the length is 8 bytes which is the minimum length for a UDP datagram. The UDP checksum is zero if it is not used. If the checksum is used then it is computed for the UDP header, data, and information that is not included in the UDP datagram. The additional information is contained in a UDP pseudo-header shown in figure 7.5.

IP Source Address

IP Destination Address

Zero

Protocol = 17

UDP Datagram Length

Figure 7.5. UDP pseudo-header format.

The pseudo-header is not part of the UDP datagram and it is used only to compute the UDP checksum. Since the UDP datagram does not contain either a source or destination IP address it is possible for a UDP packet to arrive at the wrong destination. UDP will "peer" into the IP packet header and use the destination address to compute the checksum. This may seem like a violation of the Internet layered model and it is. The pseudo-header is used to ensure that the UDP datagram arrives at the proper destination. Since the IP packet checksum only includes the IP header, the UDP checksum is normally used in order to detect any transmission errors that may have corrupted the UDP packet. Once the UDP datagram has been created it is encapsulated as the data portion in an IP packet as shown in figure 7.6.

Figure 7.6. Encapsulation of a UDP datagram in an IP packet.

Transmission Control Protocol

The Transmission Control Protocol (TCP) is a connection oriented protocol that uses IP as its transport mechanism. The format of a TCP packet is shown in figure 7.7.

Source Port

Destination Port

Sequence Number

Acknowledgement Number

Header

Length

Reserved

Code Bits

Window

Checksum

Urgent Pointer

Options

Padding

User Data

.

.

.

User Data

Figure 7.7. TCP segment format.

The fields that we are concerned with in the TCP segment header are the source and destination ports. As with UDP these port numbers specify the upper level application that is using TCP. Some common TCP port numbers are listed in table 7.2.

Table 7.2. Common TCP port numbers.

UDP Port Number

Decimal

UDP Port Number

Hexadecimal

Application

7

7

Echo (PING)

21

15

FTP

23

17

TELNET

25

19

SMTP

79

4F

FINGER

80

4F

HTTP/WWW

110

6E

POP-3

The TCP checksum uses a pseudo-header, which is identical to the UDP pseudo-header. This chapter is not concerned about the operation of TCP but only the information contained in the TCP header that can be applied to extended access lists. A complete understanding of TCP will help you to be a better network designer and I have included references at the end of this chapter for further study of UDP and TCP.

Once the TCP segment has been created it is encapsulated as the data portion in an IP packet as shown in figure 7.8.

Figure 7.8. Encapsulation of a TCP segment in an IP Packet.

Extended IP Access Lists

An extended IP access list can be used to filter IP traffic based on the source and destination IP addresses contained in the IP header. Extended IP access lists can also be used to filter traffic based on the IP, UDP, and TCP port numbers contained in their respective headers. An extended access-list is created in global configuration mode as shown. Extended IP access lists are identified by a number in the range from 100 to 199 so a router can have a maximum of 99 extended IP access-lists active simultaneously.

r1(config)#access-list ?

<1-99> IP standard access list

<100-199> IP extended access list

<1000-1099> IPX SAP access list

<1100-1199> Extended 48-bit MAC address access list

<1200-1299> IPX summary address access list

<200-299> Protocol type-code access list

<300-399> DECnet access list

<400-499> XNS standard access list

<500-599> XNS extended access list

<600-699> Appletalk access list

<700-799> 48-bit MAC address access list

<800-899> IPX standard access list

<900-999> IPX extended access list

Chose a number in the range 100 to 199.

r1(config)#access-list 100 ?

deny Specify packets to reject

dynamic Specify a DYNAMIC list of PERMITs or DENYs

permit Specify packets to forward

We have an option that didn’t exist with standard IP access-lists, the dynamic list. Dynamic lists are covered at the end of the chapter. Select either permit or deny and then determine the next parameter.

r1(config)#access-list 100 deny ?

<0-255> An IP protocol number

eigrp Cisco's EIGRP routing protocol

gre Cisco's GRE tunneling

icmp Internet Control Message Protocol

igmp Internet Gateway Message Protocol

igrp Cisco's IGRP routing protocol

ip Any Internet Protocol

ipinip IP in IP tunneling

nos KA9Q NOS compatible IP over IP tunneling

ospf OSPF routing protocol

tcp Transmission Control Protocol

udp User Datagram Protocol

As you can see we have many more options that we had with standard access-lists. The options that we will explore are the IP, UDP, TCP, and ICMP options.

r1(config)#access-list 100 deny ip ?

A.B.C.D Source address

Any Any source host

Host A single source host

The source address is entered the same way as a standard access-list, as an address and wildcard mask. Assume we want to block host 172.16.3.1 from accessing network 172.16.2.0 in figure 7.2. We have seen that there are two ways of entering a host address.

r1(config)#access-list 100 deny ip 172.16.3.1?

A.B.C.D Source wildcard bits

r1(config)#access-list 100 deny ip 172.16.3.0 0.0.0.0 ?

A.B.C.D Destination address

Any Any destination host

Host A single destination host

Extended IP access-lists have the additional selection for the destination address, which was not present with a standard IP access-list. The destination address is entered exactly as we entered the source address.

r1(config)#access-list 100 deny ip 172.16.3.1 0.0.0.0 172.16.2.0 ?

A.B.C.D Destination wildcard bits

This deny statement is sufficient to block access to network 172.16.2.0 from host 1. Additionally we can base the deny action on the precedence or TOS parameters present in the IP header.

r1(config)#access-list 100 deny ip 172.16.3.0 0.0.0.255 172.16.2.0 0.0.0.255 ?

log Log matches against this entry

log-input Log matches against this entry, including input interface

precedence Match packets with given precedence value

tos Match packets with given TOS value

<cr>

r1(config)#$ip 172.16.3.0 0.0.0.255 172.16.2.0 0.0.0.255 precedence ?

<0-7> Precedence value

critical Match packets with critical precedence (5)

flash Match packets with flash precedence (3)

flash-override Match packets with flash override precedence (4)

immediate Match packets with immediate precedence (2)

internet Match packets with internetwork control precedence (6)

network Match packets with network control precedence (7)

priority Match packets with priority precedence (1)

routine Match packets with routine precedence (0)

r1(config)#$ip 172.16.3.0 0.0.0.255 172.16.2.0 0.0.0.255 tos ?

<0-15> Type of service value

max-reliability Match packets with max reliable TOS (2)

max-throughput Match packets with max throughput TOS (4)

min-delay Match packets with min delay TOS (8)

min-monetary-cost Match packets with min monetary cost TOS (1)

normal Match packets with normal TOS (0)

List the extended access list that we have entered.

r1#show access-lists 100

Extended IP access list 100

deny ip host 172.16.3.1 172.16.2.0 0.0.0.255

The difference between the extended and standard access list, at least with this example, is the addition of the destination address. As with standard access lists there is an implicit deny any any at the end of the list so we need to add the statement permit any any as the last statement that we enter (but not always).

r1(config)#access-list 100 permit ip any any

r1#show access-lists 100

Extended IP access list 100

deny ip host 172.16.3.1 172.16.2.0 0.0.0.255

permit ip any any

We deduced that the best location for a standard access list was as close to the destination as possible. Where would be the best place to put an extended IP access-list? We could put the access-list on router r1 in figure 7.2 but the traffic would have to propagated through routers r2 and r3 before reaching router r1. Since we know both the source and destination address the traffic can be blocked by router r3 at the input to the ethernet interface. Therefore, the rule to remember for extended IP access lists is

An extended access list should be applied as close to the source as possible.

Even though the list would operate properly on any of the routers, we want to stop the traffic as soon as possible in order to reduce the bandwidth utilization of the network.

Traffic can also be filtered based on the information contained in the UDP or TCP headers. First we will examine the filtering of UDP packets.

r1(config)#access-list 100 deny udp ?

A.B.C.D Source address

any Any source host

host A single source host

Again we need to input the source address to filter. For this example we will use the host keyword.

r1(config)#access-list 101 deny udp host 172.16.3.1 ?

A.B.C.D Destination address

any Any destination host

eq Match only packets on a given port number

gt Match only packets with a greater port number

host A single destination host

lt Match only packets with a lower port number

neq Match only packets not on a given port number

range Match only packets in the range of port numbers

r1(config)#access-list 100 deny udp 172.16.3.0 0.0.0.255 eq ?

<0-65535> Port number

biff Biff (mail notification, comsat, 512)

bootpc Bootstrap Protocol (BOOTP) client (68)

bootps Bootstrap Protocol (BOOTP) server (67)

discard Discard (9)

dnsix DNSIX security protocol auditing (195)

domain Domain Name Service (DNS, 53)

echo Echo (7)

mobile-ip Mobile IP registration (434)

nameserver IEN116 name service (obsolete, 42)

netbios-dgm NetBios datagram service (138)

netbios-ns NetBios name service (137)

ntp Network Time Protocol (123)

rip Routing Information Protocol (router, in.routed, 520)

snmp Simple Network Management Protocol (161)

snmptrap SNMP Traps (162)

sunrpc Sun Remote Procedure Call (111)

syslog System Logger (514)

tacacs TAC Access Control System (49)

talk Talk (517)

tftp Trivial File Transfer Protocol (69)

time Time (37)

who Who service (rwho, 513)

xdmcp X Display Manager Control Protocol (177)

The available options for UDP are quite extensive. In general, we can accomplish the following with UDP filters.

  1. Filter UDP based on source and destination IP addresses.
  2. access-list 100 deny udp 172.16.3.1 0.0.0.0 172.16.2.0 0.0.0.255

  3. Filter UDP based on source address and UDP port number and on a destination address.
  4. access-list 100 deny udp 172.16.3.1 0.0.0.0 eq tftp 172.16.2.0 0.0.0.255

  5. Filter UDP based on a source address and destination address and port number.
  6. access-list 100 deny udp 172.16.3.1 0.0.0.0 172.16.2.0 0.0.0.255 eq tftp

  7. Filter UDP based on a source address and port number and a destination address and port number.

access-list 100 deny udp 172.16.3.1 0.0.0.0 eq tftp 172.16.2.0 0.0.0.255 eq tftp

For the port numbers we can use the keywords eq for equal, gt for greater than, lt for less than, and neq for not equal to. We can also enter a range of UDP ports numbers.

access-list 100 deny udp host 172.16.3.1 range echo tftp 172.16.2.0 0.0.0.255 range echo tftp

At this point you may be tempted to think that this is getting carried away and I would agree. The most common form you will see is form 3 since typically the source and destination port numbers are the same or the source port number is not used. If we want to prevent host 1 in figure 7.1 from being able to tftp to network 172.16.2.0, we would use the extended access-list shown below.

Extended IP access list 100

deny udp host 172.16.3.1 172.16.2.0 0.0.0.255 eq tftp

permit ip any any

Filtering based on TCP port numbers is identical to filtering based on UDP port numbers.

r1(config)#$ 100 deny tcp ?

A.B.C.D Source address

any Any source host

host A single source host

r1(config)#$ 100 deny tcp 172.16.2.0 0.0.0.255 172.16.3.0 0.0.0.255 ?

eq Match only packets on a given port number

established Match established connections

gt Match only packets with a greater port number

log Log matches against this entry

log-input Log matches against this entry, including input interface

lt Match only packets with a lower port number

neq Match only packets not on a given port number

precedence Match packets with given precedence value

range Match only packets in the range of port numbers

tos Match packets with given TOS value

<cr>

r1(config)#access-list 100 deny tcp any any eq ?

<0-65535> Port number

bgp Border Gateway Protocol (179)

chargen Character generator (19)

cmd Remote commands (rcmd, 514)

daytime Daytime (13)

discard Discard (9)

domain Domain Name Service (53)

echo Echo (7)

exec Exec (rsh, 512)

finger Finger (79)

ftp File Transfer Protocol (21)

ftp-data FTP data connections (used infrequently, 20)

gopher Gopher (70)

hostname NIC hostname server (101)

ident Ident Protocol (113)

irc Internet Relay Chat (194)

klogin Kerberos login (543)

kshell Kerberos shell (544)

login Login (rlogin, 513)

lpd Printer service (515)

nntp Network News Transport Protocol (119)

pop2 Post Office Protocol v2 (109)

pop3 Post Office Protocol v3 (110)

smtp Simple Mail Transport Protocol (25)

sunrpc Sun Remote Procedure Call (111)

syslog Syslog (514)

tacacs TAC Access Control System (49)

talk Talk (517)

telnet Telnet (23)

time Time (37)

uucp Unix-to-Unix Copy Program (540)

whois Nicname (43)

www World Wide Web (HTTP, 80)

For example, assume we want to allow any host to access a web server on network 172.16.2.0 but deny all other traffic to network 172.16.2.0. The access-list we can use is shown below.

Extended IP access list 102

permit tcp any 172.16.2.0 0.0.0.255 eq www

Notice that the deny any any statement the is implicit at the end of the list is exactly want we want. This access-list permits only www traffic and prevents all others.

Finally, I want to take at look at Internet Control Message protocol (ICMP) filtering. The most familiar ICMP function is echo, or PING.

r1(config)#access-list 100 deny icmp ?

A.B.C.D Source address

any Any source host

host A single source host

r1(config)#$ 100 deny icmp ?

<0-255> ICMP message type

administratively-prohibited Administratively prohibited

alternate-address Alternate address

conversion-error Datagram conversion

dod-host-prohibited Host prohibited

dod-net-prohibited Net prohibited

echo Echo (ping)

echo-reply Echo reply

general-parameter-problem Parameter problem

host-isolated Host isolated

host-precedence-unreachable Host unreachable for precedence

host-redirect Host redirect

host-tos-redirect Host redirect for TOS

host-tos-unreachable Host unreachable for TOS

host-unknown Host unknown

host-unreachable Host unreachable

information-reply Information replies

information-request Information requests

log Log matches against this entry

log-input Log matches against this entry, including input interface

mask-reply Mask replies

mask-request Mask requests

mobile-redirect Mobile host redirect

net-redirect Network redirect

net-tos-redirect Net redirect for TOS

net-tos-unreachable Network unreachable for TOS

net-unreachable Net unreachable

network-unknown Network unknown

no-room-for-option Parameter required but no room

option-missing Parameter required but not present

packet-too-big Fragmentation needed and DF set

parameter-problem All parameter problems

port-unreachable Port unreachable

precedence Match packets with given precedence value

precedence-unreachable Precedence cutoff

protocol-unreachable Protocol unreachable

reassembly-timeout Reassembly timeout

redirect All redirects

router-advertisement Router discovery advertisements

router-solicitation Router discovery solicitations

source-quench Source quenches

source-route-failed Source route failed

time-exceeded All time exceededs

timestamp-reply Timestamp replies

timestamp-request Timestamp requests

tos Match packets with given TOS value

traceroute Traceroute

ttl-exceeded TTL exceeded

unreachable All unreachables

As you can see there are many choices but they are entered in the same manner as UDP and TCP access-lists. If we want to prevent host 1 in figure 7.1 from being able to ping the ethernet interface on router r1 we could use the access list shown below.

Extended IP access list 151

deny udp host 172.16.3.1 host 172.16.2.1 eq echo

permit ip any any

One final property of access lists should be mentioned. An access list cannot be used to filter traffic that originates in the router. For example, if we want to prevent router r3 in figure 7.2 from being able to ping router r1, the access-list cannot be placed on router r3 since access lists do not affect traffic that originates in the router.

Dynamic Access Lists

The network of figure 7.9 contains a server on network 172.16.4.0 with IP address 172.16.4.1. We want hosts on network 172.16.3.0 to only have telnet access to this server, so we can use an extended IP access-list to filter telnet traffic to this network.

The access list on r1 should allow telnet but block all other traffic.

access-list 100 permit tcp any host 172.16.4.1 eq telnet

This access-list would then be applied to the ethernet 0 interface on router r1 as an input access-group.

interface Ethernet0

ip address 172.16.3.2 255.255.255.0

ip access-group 100 in

Assume that at times a particular user on network 172.16.3.0 needs access to network 172.16.4.0 using applications other than telnet. With the applied access-list this would not be possible. We could modify the access list to allow this a host access as shown.

access-list 100 permit tcp any host 172.16.4.1 eq telnet

access-list 100 permit ip host 172.16.3.1 any

This would accomplish our goal of allowing host 172.16.3.1 to be able to access network 172.16.4.0. The problem is that the user must be logged into the host 172.16.3.1. Also, anyone logged into that particular host can gain access to the network. This may not be what is intended. A more secure method is to use a dynamic IP access list, also referred to as Lock-and-Key security. The idea behind lock-and-key security is to allow a user to temporarily open a hole in the access list using a dynamic access list. The mechanics for lock-and-key security are:

  1. The user telnets into the router via the virtual terminal port.
  2. The router opens a telnet session and prompts the user for a password. Several methods are available for user authentication such as local authentication, TACACS+, or RADIUS.
  3. When the user successfully passes authentication they are logged out of the router and a temporary entry is created in the access-list.
  4. The authenticated user can now access the server.
  5. The dynamic access-list will be deleted after a configured timeout has expired.

For this example we will use local authentication for the user. First create a username and password on the route.

r1(config)#username elvis password king

next, enable local login authentication on the vty lines.

r1(config)#line vty 0 4

r1(config-line)#login ?

local Local password checking

tacacs Use tacacs server for password checking

r1(config-line)#login local

Create the dynamic access list on the router.

access-list 100 dynamic allow_elvis timeout 5 permit ip any any

The dynamic access list is given a name, allow_elvis, and an idle timeout in minutes.

Finally configure the virtual terminal lines to allow the activation of the dynamic access list.

r1(config)#line vty 0 4

r1(config-line)#login local

r1(config-line)#autocommand

r1(config-line)#autocommand ?

LINE Appropriate EXEC command

r1(config-line)#autocommand access-enable timeout 10

The timeout specified is an absolute timeout value and should be greater than the timeout specified for the access list idle timeout.

When a user telnets into the router as user elvis and supplies the correct password the user will be logged out and the dynamic access list will be invoked, allowing the user access to network 172.16.4.0.

For further study of IP, UDP and TCP I suggest two very good books. The first is by Douglas E. Comer and the title is "Internetworking with TCP/IP – Volume 1", which is published by Prentice Hall. The second book is by W. Richard Stevens and the title is "TCP/IP Illustrated Volume1", which is published by Addison Wesley.

Backward Forward
Chapter: 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13

Reserve your copy at a
Beta Bookstore near you!
Contact Bet@books
© 1998 The McGraw-Hill Companies, Inc. All rights reserved.
Any use of this Beta Book is subject to the rules stated in the Terms of Use.

Beta Books | Beta Bookstores | Computing McGraw-Hill

Professional Publishing Home | Contact Us | Customer Service | For Authors | International Offices | New Book Alert | Search Catalog/Order | Site Map | What's New


A Division of the McGraw-Hill Companies
Copyright © 1998 The McGraw-Hill Companies. All rights reserved. Any use is subject to the Terms of Use; the corporation also has a comprehensive Privacy Policy governing information we may collect from our customers.