Cisco Router OSPF Design and Implementation Guide William Parkhurst, PhD, CCIE $54.95 0-07-048626-3 |
![]() ![]() |
Chapter: 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 |
Reserve your copy at a Beta Bookstore near you! |
Contact Bet@books © 1998 The McGraw-Hill Companies, Inc. All rights reserved. Any use of this Beta Book is subject to the rules stated in the Terms of Use. |
In general, there are two types of IP traffic, routing and control traffic and user traffic. This chapter examines techniques for managing user traffic. Types of user traffic that you are probably most familiar with are telnet, ftp, email, pings, and of course the World Wide Web. IP traffic can be managed through the use of standard and extended IP access lists. But before we look at the facilities available in the Cisco IOS for traffic management we need to examine the structure of IP, UDP, and TCP packets in order to gain an understanding of the information available in these packets that we can use to selectively manage IP traffic.
IP Data Packet Format
We have seen that the Internet Protocol operates at layer three, the network layer, of the Internet layered model. Data from layer four processes are encapsulated in an IP datagram having the structure shown in figure 7.1. The 4-bit version field contains the version number of the format of the IP datagram. Routers must check the version number to see if it matches the version number of IP that they are running. If the version number does not match then the packet will be rejected. The current IP version number is 4. The 4-bit header length is the length of the IP header in 32-bit words. If IP options and padding are not used then this field will contain 5 meaning that the IP header length is 20
0 3 4 7 8 15 16 31
Version |
HLEN |
Type of Service |
Total Length |
||
Identification |
Flags |
Fragment Offset |
|||
Time to Live |
Protocol |
Header Checksum |
|||
Source IP Address |
|||||
Destination IP Address |
|||||
IP Options |
Padding |
||||
Data |
.
.
.
Data |
Figure 7.1. IP datagram packet format.
bytes. The 8-bit type of service field specifies how the IP datagram should be handled by the router. This field is ignored by routers but will eventually have a use in later versions. The total length is the length of the IP datagram in bytes and includes both the header length and the data length. The length of the data can easily be determined by subtracting the header length * 4 from this field. Since the total length field is 16-bits the maximum size of an IP datagram is 65,635 bytes. IP datagrams may traverse networks with different MTU sizes possibly causing the IP packet to become fragmented. The identification, flags and fragment offset fields are used to control the fragmentation and re-assembly of IP datagrams. Routing loops may occur which can cause an IP packet to endlessly circulate in the network. The time to live field is used to break potential routing loops. The TTL field is initialized to a positive number and each router that the packet passes through decrements this field by 1. When the TTL field goes to zero the router will discard the packet. The data contained in an IP packet is from a layer four protocol. The protocol field identifies from which layer four process the data was received, such as UDP or TCP. The header checksum is a checksum that is computed for the IP header only and does not include the data. The upper layer protocol that supplied the data typically includes a data checksum so there is no need for the data to be included in the IP checksum. The source IP address contains the IP address of the originator of the datagram and the destination address is the address of the ultimate destination for the packet. A forwarding router never changes the source and destination IP addresses. As we have seen in chapter 4, a router will change the source and destination MAC addresses of a forwarded packet but the router will never change the IP addresses in the IP header. The IP options field has a variable length depending on the type of option that is being used. The padding field is also a variable length that depends on the size of the options field. Since the header length field gives a length in 32-bit words then the header must end on a 32-bit boundary. The padding field is filled with zeros so that the length of the options field and the length of the padding field is 32 bits.
Standard IP Access Lists
A standard IP access list can be used to filter IP traffic based on the source address contained in the IP header. Standard IP access lists cannot be used to filter traffic based on any other parameter. An access-list is created in global configuration mode as shown.
Standard IP access lists are identified by a number in the range from 1 to 99 so a router can have a maximum of 99 standard IP access-lists active simultaneously.
router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
router(config)#access-list ?
<1-99> IP standard access list
<100-199> IP extended access list
<1000-1099> IPX SAP access list
<1100-1199> Extended 48-bit MAC address access list
<1200-1299> IPX summary address access list
<200-299> Protocol type-code access list
<300-399> DECnet access list
<400-499> XNS standard access list
<500-599> XNS extended access list
<600-699> Appletalk access list
<700-799> 48-bit MAC address access list
<800-899> IPX standard access list
<900-999> IPX extended access list
The first parameter for a standard IP access list is the list number having a value of 1 to 99.
router(config)#access-list 1 ?
deny Specify packets to reject
permit Specify packets to forward
The second parameter indicates whether traffic will be permitted or denied. For example, assume we want to deny host 1 from accessing network 172.16.2.0 in figure 7.2 but we want to allow all other hosts to be able to access network 172.16.2.0.
This would be a deny operation in an access list.
router(config)#access-list 1 deny ?
Hostname or A.B.C.D Address to match
any Any source host
host A single host address
What do we want to deny? We want to deny host 1, which has an IP address of 172.16.3.1. There are two ways to enter a host address. The first is to simply enter the host address as an IP address.
router(config)#access-list 1 deny 172.16.3.1 ?
A.B.C.D Wildcard bits
<cr>
Notice that the entire address of the host was entered. The next parameter is called the wildcard bits and the bits can be considered a reverse mask because we enter a 0 to match a bit and a 1 indicates that we don’t care what the corresponding bit value is. In order to match the entire host address the wild card bits would all be zero.
router(config)#access-list 1 deny 172.16.3.1 0.0.0.0 ?
<cr>
We can now list the access list from exec mode.
router#show access-lists
Standard IP access list 1
deny 172.16.3.1
Another way to enter a host address is to use the keyword host when creating the access list.
router(config)#access-list 1 deny ?
Hostname or A.B.C.D Address to match
any Any source host
host A single host address
router(config)#access-list 1 deny host ?
Hostname or A.B.C.D Host address
router(config)#access-list 1 deny host 172.16.3.1 ?
<cr>
List the access-list to see if there is any difference from the previous example.
router#show access-lists
Standard IP access list 1
deny 172.16.3.1
As we can see there is no difference. The forms 172.16.3.1 0.0.0.0 and host 172.16.3.1 are identical. From the access list listing we can see that there is only one statement contained in the access-list, but there are actually two statements. The last statement in an IP access list is always deny any. This has the effect of denying all IP traffic and is implicitly added at the end of every access-list. Our access list that we have created actually contains
Standard IP access list 1
deny 172.16.3.1
deny any (implicit)
A very common mistake when working with access lists is to forget the implicit deny any statement that the router adds at the end of the access list. Sometimes this implicit statement is useful as we shall see, but many times it can cause your access list to filter traffic that you had no intention of filtering. For this example we only want to deny one host from accessing network 172.16.2.0 and allow any other host to access this network so we need to permit all other hosts.
router(config)#access-list 1 permit any
The access list now contains the statements to accomplish our objective.
router#show access-lists
Standard IP access list 1
deny 172.16.3.1
permit any
For an access-list to be active it must be applied to a router interface in interface configuration mode. From figure 7.2 we can see that we have six interfaces on which we can apply the access-list. Of course the access list would have to be created on the router that we are going to use to filter the traffic. Where is the best place to put the access list? Our goal is to block host 172.16.3.1 from reaching network 172.16.2.0 but not to interfere with host 1’s traffic in any other way. If we put the access-list on the ethernet interface on router r3 we would block all of host 1’s traffic. A standard IP access list can only filter on the source address and not the destination address. If the access-list is placed on router r3 then host 1 could not reach network 172.16.4.0 or any other network. A good rule for standard access lists is stated below and should be committed to memory.
A standard access list should be applied as close to the destination as possible.
This rule means to place the standard access list on the router directly attached to the network that you are trying to deny access to. So the access-list for this example should be placed on router r1. Now that we have decided on which router to place the access list the next question is on which interface should we place it. We can use the access list to filter traffic coming in the serial interface or going out the ethernet interface. For this example the interface makes no difference, but it will soon. The commands for placing the access-list on the interfaces are shown below.
For the serial interface
r1(config)#interface serial 0
r1(config-if)#ip access-group ?
<1-199> IP access list (standard or extended)
WORD Access-list name
r1(config-if)#ip access-group 1 ?
in inbound packets
out outbound packets
<cr>
r1(config-if)#ip access-group 1 in
For the ethernet interface
r1(config)#interface ethernet 0
r1(config-if)#ip access-group ?
r1(config-if)#ip access-group 1 out
The ip access-group interface configuration command is used to associate an access-list with the interface. Which way is preferred? For this example, placing the access-list on the serial interface as an input list will relieve the router of having to route the packet to the ethernet interface thereby making the process more efficient. If router r1 has multiple attached networks as shown in figure 7.3 then the serial interface is not the place to put the access list. Can you determine why?
Figure 7.3. An input access-list on router r1 will deny host 1 access to networks 2.0 and 5.0.
If host 1 tries to access a resource on network 172.16.5.0 the input access list on the serial interface of router r1 will block the traffic since an access-list can only filter traffic based on the source address. For this scenario the best place to put the access list is on the output of the ethernet interface on router r1. Host 1 could then access network 172.16.5.0 but not 172.16.2.0. Is there an input access list we can use on the serial interface of router r1 so that host 1 can reach network 172.16.5.0 but not 172.16.2.0? The answer is no. In order to do this, we will need to use an extended IP access list, which we will cover shortly. Before doing so we need to look at the mechanics of building access lists. Whenever we add a permit or deny statement to an access list the statement is inserted at the end of the list. Well, almost the end of the list. Actually the statement is inserted as the second to the last statement since the implicit deny any statement is always the last statement. If you create an access list and you notice that your permit and deny statements are not in the proper order, there is no way to delete a statement or insert a statement anywhere in the list. The only choice is to delete the access list and start over. The no form of the command is used to delete an access list.
r1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
r1(config)#no access-list 1
We have seen how to deny a host access to a network using a standard IP access list. We can also deny access to an entire network with a standard IP access list. For example, we want to deny all hosts on network 172.16.3.0 from reaching network 172.16.2.0. How we would accomplish this goal? Remember that the wildcard bits are used to determine which part of the address is used when determining if traffic is to be filtered. To deny access to the entire 172.16.3.0 network we would use the source/wildcard bits pair shown below.
172.16.3.0 0.0.0.255
In other words, we don’t care what the last octet of the source address is and any address in the range 172.16.3.0 to 172.16.3.255 will match. The corresponding access list for this case is
Standard IP access list 1
deny 172.16.3.0, wildcard bits 0.0.0.255
permit any
One final standard IP access list example is in order. Assume that we only want hosts on network 172.16.3.0 to be able to access network 172.16.2.0. What would we do this? The following access list will accomplish this goal.
Standard IP access list 1
permit 172.16.3.0, wildcard bits 0.0.0.255
Any traffic with a source IP address of 172.16.3.x would be allowed and all other traffic would be denied because of the implicit deny any statement at the end of the list. Standard IP access lists either permit or deny all IP traffic from a source that has an address that matches the permit or deny statements, regardless of the traffic type or destination. Extended IP access lists should be used when we want to filter traffic based on the destination or type of traffic. Before we cover the commands for extended IP access lists we need to examine layer four protocol packet headers to determine what information is available to an extended IP access list.
User Datagram Protocol
The user datagram protocol (UDP) is a connectionless protocol that uses IP as its transport mechanism. The format of a UDP packet is shown in figure 7.4.
0 15 16 31
UDP Source Port |
UDP Destination Port |
UDP Message Length |
UDP Checksum |
Data |
.
.
.
Data |
Figure 7.4. User Datagram Protocol packet format.
The UDP source and destination ports identify the upper layer application that is utilizing UDP. The source port is optional and if it is not used then this field should be set to zero. Table 7.1 lists some of the common UDP port numbers.
Table 7.1. Common UDP port numbers.
UDP Port Number Decimal |
UDP Port Number Hexadecimal |
Application |
7 |
7 |
Echo (PING) |
37 |
25 |
Time |
53 |
35 |
DNS |
67 |
43 |
BOOTP Server |
68 |
44 |
BOOTP Client |
69 |
45 |
TFTP |
The UDP message length field is the length, in bytes, of the UDP datagram including the UDP header and data. If the datagram contains no data then the length is 8 bytes which is the minimum length for a UDP datagram. The UDP checksum is zero if it is not used. If the checksum is used then it is computed for the UDP header, data, and information that is not included in the UDP datagram. The additional information is contained in a UDP pseudo-header shown in figure 7.5.
IP Source Address |
||
IP Destination Address |
||
Zero |
Protocol = 17 |
UDP Datagram Length |
Figure 7.5. UDP pseudo-header format.
The pseudo-header is not part of the UDP datagram and it is used only to compute the UDP checksum. Since the UDP datagram does not contain either a source or destination IP address it is possible for a UDP packet to arrive at the wrong destination. UDP will "peer" into the IP packet header and use the destination address to compute the checksum. This may seem like a violation of the Internet layered model and it is. The pseudo-header is used to ensure that the UDP datagram arrives at the proper destination. Since the IP packet checksum only includes the IP header, the UDP checksum is normally used in order to detect any transmission errors that may have corrupted the UDP packet. Once the UDP datagram has been created it is encapsulated as the data portion in an IP packet as shown in figure 7.6.
Figure 7.6. Encapsulation of a UDP datagram in an IP packet.
Transmission Control Protocol
The Transmission Control Protocol (TCP) is a connection oriented protocol that uses IP as its transport mechanism. The format of a TCP packet is shown in figure 7.7.
Source Port |
Destination Port |
|||
Sequence Number |
||||
Acknowledgement Number |
||||
Header Length |
Reserved |
Code Bits |
Window |
|
Checksum |
Urgent Pointer |
|||
Options |
Padding |
|||
User Data |
.
.
.
User Data |
Figure 7.7. TCP segment format.
The fields that we are concerned with in the TCP segment header are the source and destination ports. As with UDP these port numbers specify the upper level application that is using TCP. Some common TCP port numbers are listed in table 7.2.
Table 7.2. Common TCP port numbers.
UDP Port Number Decimal |
UDP Port Number Hexadecimal |
Application |
7 |
7 |
Echo (PING) |
21 |
15 |
FTP |
23 |
17 |
TELNET |
25 |
19 |
SMTP |
79 |
4F |
FINGER |
80 |
4F |
HTTP/WWW |
110 |
6E |
POP-3 |
The TCP checksum uses a pseudo-header, which is identical to the UDP pseudo-header. This chapter is not concerned about the operation of TCP but only the information contained in the TCP header that can be applied to extended access lists. A complete understanding of TCP will help you to be a better network designer and I have included references at the end of this chapter for further study of UDP and TCP.
Once the TCP segment has been created it is encapsulated as the data portion in an IP packet as shown in figure 7.8.
Figure 7.8. Encapsulation of a TCP segment in an IP Packet.
Extended IP Access Lists
An extended IP access list can be used to filter IP traffic based on the source and destination IP addresses contained in the IP header. Extended IP access lists can also be used to filter traffic based on the IP, UDP, and TCP port numbers contained in their respective headers. An extended access-list is created in global configuration mode as shown. Extended IP access lists are identified by a number in the range from 100 to 199 so a router can have a maximum of 99 extended IP access-lists active simultaneously.
r1(config)#access-list ?
<1-99> IP standard access list
<100-199> IP extended access list
<1000-1099> IPX SAP access list
<1100-1199> Extended 48-bit MAC address access list
<1200-1299> IPX summary address access list
<200-299> Protocol type-code access list
<300-399> DECnet access list
<400-499> XNS standard access list
<500-599> XNS extended access list
<600-699> Appletalk access list
<700-799> 48-bit MAC address access list
<800-899> IPX standard access list
<900-999> IPX extended access list
Chose a number in the range 100 to 199.
r1(config)#access-list 100 ?
deny Specify packets to reject
dynamic Specify a DYNAMIC list of PERMITs or DENYs
permit Specify packets to forward
We have an option that didn’t exist with standard IP access-lists, the dynamic list. Dynamic lists are covered at the end of the chapter. Select either permit or deny and then determine the next parameter.
r1(config)#access-list 100 deny ?
<0-255> An IP protocol number
eigrp Cisco's EIGRP routing protocol
gre Cisco's GRE tunneling
icmp Internet Control Message Protocol
igmp Internet Gateway Message Protocol
igrp Cisco's IGRP routing protocol
ip Any Internet Protocol
ipinip IP in IP tunneling
nos KA9Q NOS compatible IP over IP tunneling
ospf OSPF routing protocol
tcp Transmission Control Protocol
udp User Datagram Protocol
As you can see we have many more options that we had with standard access-lists. The options that we will explore are the IP, UDP, TCP, and ICMP options.
r1(config)#access-list 100 deny ip ?
A.B.C.D Source address
Any Any source host
Host A single source host
The source address is entered the same way as a standard access-list, as an address and wildcard mask. Assume we want to block host 172.16.3.1 from accessing network 172.16.2.0 in figure 7.2. We have seen that there are two ways of entering a host address.
r1(config)#access-list 100 deny ip 172.16.3.1?
A.B.C.D Source wildcard bits
r1(config)#access-list 100 deny ip 172.16.3.0 0.0.0.0 ?
A.B.C.D Destination address
Any Any destination host
Host A single destination host
Extended IP access-lists have the additional selection for the destination address, which was not present with a standard IP access-list. The destination address is entered exactly as we entered the source address.
r1(config)#access-list 100 deny ip 172.16.3.1 0.0.0.0 172.16.2.0 ?
A.B.C.D Destination wildcard bits
This deny statement is sufficient to block access to network 172.16.2.0 from host 1. Additionally we can base the deny action on the precedence or TOS parameters present in the IP header.
r1(config)#access-list 100 deny ip 172.16.3.0 0.0.0.255 172.16.2.0 0.0.0.255 ?
log Log matches against this entry
log-input Log matches against this entry, including input interface
precedence Match packets with given precedence value
tos Match packets with given TOS value
<cr>
r1(config)#$ip 172.16.3.0 0.0.0.255 172.16.2.0 0.0.0.255 precedence ?
<0-7> Precedence value
critical Match packets with critical precedence (5)
flash Match packets with flash precedence (3)
flash-override Match packets with flash override precedence (4)
immediate Match packets with immediate precedence (2)
internet Match packets with internetwork control precedence (6)
network Match packets with network control precedence (7)
priority Match packets with priority precedence (1)
routine Match packets with routine precedence (0)
r1(config)#$ip 172.16.3.0 0.0.0.255 172.16.2.0 0.0.0.255 tos ?
<0-15> Type of service value
max-reliability Match packets with max reliable TOS (2)
max-throughput Match packets with max throughput TOS (4)
min-delay Match packets with min delay TOS (8)
min-monetary-cost Match packets with min monetary cost TOS (1)
normal Match packets with normal TOS (0)
List the extended access list that we have entered.
r1#show access-lists 100
Extended IP access list 100
deny ip host 172.16.3.1 172.16.2.0 0.0.0.255
The difference between the extended and standard access list, at least with this example, is the addition of the destination address. As with standard access lists there is an implicit deny any any at the end of the list so we need to add the statement permit any any as the last statement that we enter (but not always).
r1(config)#access-list 100 permit ip any any
r1#show access-lists 100
Extended IP access list 100
deny ip host 172.16.3.1 172.16.2.0 0.0.0.255
permit ip any any
We deduced that the best location for a standard access list was as close to the destination as possible. Where would be the best place to put an extended IP access-list? We could put the access-list on router r1 in figure 7.2 but the traffic would have to propagated through routers r2 and r3 before reaching router r1. Since we know both the source and destination address the traffic can be blocked by router r3 at the input to the ethernet interface. Therefore, the rule to remember for extended IP access lists is
An extended access list should be applied as close to the source as possible.
Even though the list would operate properly on any of the routers, we want to stop the traffic as soon as possible in order to reduce the bandwidth utilization of the network.
Traffic can also be filtered based on the information contained in the UDP or TCP headers. First we will examine the filtering of UDP packets.
r1(config)#access-list 100 deny udp ?
A.B.C.D Source address
any Any source host
host A single source host
Again we need to input the source address to filter. For this example we will use the host keyword.
r1(config)#access-list 101 deny udp host 172.16.3.1 ?
A.B.C.D Destination address
any Any destination host
eq Match only packets on a given port number
gt Match only packets with a greater port number
host A single destination host
lt Match only packets with a lower port number
neq Match only packets not on a given port number
range Match only packets in the range of port numbers
r1(config)#access-list 100 deny udp 172.16.3.0 0.0.0.255 eq ?
<0-65535> Port number
biff Biff (mail notification, comsat, 512)
bootpc Bootstrap Protocol (BOOTP) client (68)
bootps Bootstrap Protocol (BOOTP) server (67)
discard Discard (9)
dnsix DNSIX security protocol auditing (195)
domain Domain Name Service (DNS, 53)
echo Echo (7)
mobile-ip Mobile IP registration (434)
nameserver IEN116 name service (obsolete, 42)
netbios-dgm NetBios datagram service (138)
netbios-ns NetBios name service (137)
ntp Network Time Protocol (123)
rip Routing Information Protocol (router, in.routed, 520)
snmp Simple Network Management Protocol (161)
snmptrap SNMP Traps (162)
sunrpc Sun Remote Procedure Call (111)
syslog System Logger (514)
tacacs TAC Access Control System (49)
talk Talk (517)
tftp Trivial File Transfer Protocol (69)
time Time (37)
who Who service (rwho, 513)
xdmcp X Display Manager Control Protocol (177)
The available options for UDP are quite extensive. In general, we can accomplish the following with UDP filters.
access-list 100 deny udp 172.16.3.1 0.0.0.0 172.16.2.0 0.0.0.255
access-list 100 deny udp 172.16.3.1 0.0.0.0 eq tftp 172.16.2.0 0.0.0.255
access-list 100 deny udp 172.16.3.1 0.0.0.0 172.16.2.0 0.0.0.255 eq tftp
access-list 100 deny udp 172.16.3.1 0.0.0.0 eq tftp 172.16.2.0 0.0.0.255 eq tftp
For the port numbers we can use the keywords eq for equal, gt for greater than, lt for less than, and neq for not equal to. We can also enter a range of UDP ports numbers.
access-list 100 deny udp host 172.16.3.1 range echo tftp 172.16.2.0 0.0.0.255 range echo tftp
At this point you may be tempted to think that this is getting carried away and I would agree. The most common form you will see is form 3 since typically the source and destination port numbers are the same or the source port number is not used. If we want to prevent host 1 in figure 7.1 from being able to tftp to network 172.16.2.0, we would use the extended access-list shown below.
Extended IP access list 100
deny udp host 172.16.3.1 172.16.2.0 0.0.0.255 eq tftp
permit ip any any
Filtering based on TCP port numbers is identical to filtering based on UDP port numbers.
r1(config)#$ 100 deny tcp ?
A.B.C.D Source address
any Any source host
host A single source host
r1(config)#$ 100 deny tcp 172.16.2.0 0.0.0.255 172.16.3.0 0.0.0.255 ?
eq Match only packets on a given port number
established Match established connections
gt Match only packets with a greater port number
log Log matches against this entry
log-input Log matches against this entry, including input interface
lt Match only packets with a lower port number
neq Match only packets not on a given port number
precedence Match packets with given precedence value
range Match only packets in the range of port numbers
tos Match packets with given TOS value
<cr>
r1(config)#access-list 100 deny tcp any any eq ?
<0-65535> Port number
bgp Border Gateway Protocol (179)
chargen Character generator (19)
cmd Remote commands (rcmd, 514)
daytime Daytime (13)
discard Discard (9)
domain Domain Name Service (53)
echo Echo (7)
exec Exec (rsh, 512)
finger Finger (79)
ftp File Transfer Protocol (21)
ftp-data FTP data connections (used infrequently, 20)
gopher Gopher (70)
hostname NIC hostname server (101)
ident Ident Protocol (113)
irc Internet Relay Chat (194)
klogin Kerberos login (543)
kshell Kerberos shell (544)
login Login (rlogin, 513)
lpd Printer service (515)
nntp Network News Transport Protocol (119)
pop2 Post Office Protocol v2 (109)
pop3 Post Office Protocol v3 (110)
smtp Simple Mail Transport Protocol (25)
sunrpc Sun Remote Procedure Call (111)
syslog Syslog (514)
tacacs TAC Access Control System (49)
talk Talk (517)
telnet Telnet (23)
time Time (37)
uucp Unix-to-Unix Copy Program (540)
whois Nicname (43)
www World Wide Web (HTTP, 80)
For example, assume we want to allow any host to access a web server on network 172.16.2.0 but deny all other traffic to network 172.16.2.0. The access-list we can use is shown below.
Extended IP access list 102
permit tcp any 172.16.2.0 0.0.0.255 eq www
Notice that the deny any any statement the is implicit at the end of the list is exactly want we want. This access-list permits only www traffic and prevents all others.
Finally, I want to take at look at Internet Control Message protocol (ICMP) filtering. The most familiar ICMP function is echo, or PING.
r1(config)#access-list 100 deny icmp ?
A.B.C.D Source address
any Any source host
host A single source host
r1(config)#$ 100 deny icmp ?
<0-255> ICMP message type
administratively-prohibited Administratively prohibited
alternate-address Alternate address
conversion-error Datagram conversion
dod-host-prohibited Host prohibited
dod-net-prohibited Net prohibited
echo Echo (ping)
echo-reply Echo reply
general-parameter-problem Parameter problem
host-isolated Host isolated
host-precedence-unreachable Host unreachable for precedence
host-redirect Host redirect
host-tos-redirect Host redirect for TOS
host-tos-unreachable Host unreachable for TOS
host-unknown Host unknown
host-unreachable Host unreachable
information-reply Information replies
information-request Information requests
log Log matches against this entry
log-input Log matches against this entry, including input interface
mask-reply Mask replies
mask-request Mask requests
mobile-redirect Mobile host redirect
net-redirect Network redirect
net-tos-redirect Net redirect for TOS
net-tos-unreachable Network unreachable for TOS
net-unreachable Net unreachable
network-unknown Network unknown
no-room-for-option Parameter required but no room
option-missing Parameter required but not present
packet-too-big Fragmentation needed and DF set
parameter-problem All parameter problems
port-unreachable Port unreachable
precedence Match packets with given precedence value
precedence-unreachable Precedence cutoff
protocol-unreachable Protocol unreachable
reassembly-timeout Reassembly timeout
redirect All redirects
router-advertisement Router discovery advertisements
router-solicitation Router discovery solicitations
source-quench Source quenches
source-route-failed Source route failed
time-exceeded All time exceededs
timestamp-reply Timestamp replies
timestamp-request Timestamp requests
tos Match packets with given TOS value
traceroute Traceroute
ttl-exceeded TTL exceeded
unreachable All unreachables
As you can see there are many choices but they are entered in the same manner as UDP and TCP access-lists. If we want to prevent host 1 in figure 7.1 from being able to ping the ethernet interface on router r1 we could use the access list shown below.
Extended IP access list 151
deny udp host 172.16.3.1 host 172.16.2.1 eq echo
permit ip any any
One final property of access lists should be mentioned. An access list cannot be used to filter traffic that originates in the router. For example, if we want to prevent router r3 in figure 7.2 from being able to ping router r1, the access-list cannot be placed on router r3 since access lists do not affect traffic that originates in the router.
Dynamic Access Lists
The network of figure 7.9 contains a server on network 172.16.4.0 with IP address 172.16.4.1. We want hosts on network 172.16.3.0 to only have telnet access to this server, so we can use an extended IP access-list to filter telnet traffic to this network.
The access list on r1 should allow telnet but block all other traffic.
access-list 100 permit tcp any host 172.16.4.1 eq telnet
This access-list would then be applied to the ethernet 0 interface on router r1 as an input access-group.
interface Ethernet0
ip address 172.16.3.2 255.255.255.0
ip access-group 100 in
Assume that at times a particular user on network 172.16.3.0 needs access to network 172.16.4.0 using applications other than telnet. With the applied access-list this would not be possible. We could modify the access list to allow this a host access as shown.
access-list 100 permit tcp any host 172.16.4.1 eq telnet
access-list 100 permit ip host 172.16.3.1 any
This would accomplish our goal of allowing host 172.16.3.1 to be able to access network 172.16.4.0. The problem is that the user must be logged into the host 172.16.3.1. Also, anyone logged into that particular host can gain access to the network. This may not be what is intended. A more secure method is to use a dynamic IP access list, also referred to as Lock-and-Key security. The idea behind lock-and-key security is to allow a user to temporarily open a hole in the access list using a dynamic access list. The mechanics for lock-and-key security are:
For this example we will use local authentication for the user. First create a username and password on the route.
r1(config)#username elvis password king
next, enable local login authentication on the vty lines.
r1(config)#line vty 0 4
r1(config-line)#login ?
local Local password checking
tacacs Use tacacs server for password checking
r1(config-line)#login local
Create the dynamic access list on the router.
access-list 100 dynamic allow_elvis timeout 5 permit ip any any
The dynamic access list is given a name, allow_elvis, and an idle timeout in minutes.
Finally configure the virtual terminal lines to allow the activation of the dynamic access list.
r1(config)#line vty 0 4
r1(config-line)#login local
r1(config-line)#autocommand
r1(config-line)#autocommand ?
LINE Appropriate EXEC command
r1(config-line)#autocommand access-enable timeout 10
The timeout specified is an absolute timeout value and should be greater than the timeout specified for the access list idle timeout.
When a user telnets into the router as user elvis and supplies the correct password the user will be logged out and the dynamic access list will be invoked, allowing the user access to network 172.16.4.0.
For further study of IP, UDP and TCP I suggest two very good books. The first is by Douglas E. Comer and the title is "Internetworking with TCP/IP – Volume 1", which is published by Prentice Hall. The second book is by W. Richard Stevens and the title is "TCP/IP Illustrated Volume1", which is published by Addison Wesley.
![]() ![]() Chapter: 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 |
Reserve your copy at a Beta Bookstore near you! |
Contact Bet@books © 1998 The McGraw-Hill Companies, Inc. All rights reserved. Any use of this Beta Book is subject to the rules stated in the Terms of Use. |