Introduction to access-lists part 2

In the second installment of our guide to access-lists we are going to talk a little about named access-lists, how they work, what the benefits are, and how using them allows us to create reflexive access-lists. Named access-lists are exactly what they sound like, they are an extended access-list that has a name instead of a number. One of the nice features of named access-lists is that each line of the access-list has a number. this way you can delete just one line in an access-list without removing the whole access-list. You can create a named access list by using the following command.

#ip access-list extended  (name goes here)

The neat thing about named access-lists is that when you do a show access-list command you see number s next to the lines in the acl. This allows you to add or remove lines without deleting the whole access-list.

test#sh ip access-list



extended ip access-list example

	10 permit ip any any

	20 deny tcp any any eq 80

	30 permit udp any any eq 53  

Reflexive access-lists allow you to filter connections based on session. Reflexive ACL’s are part of the ip plus feature set and was the first attempt to create a statefull inspection firewall on routers. Before the invention of reflexive access-lists the only way we had to allow stateful return traffic from the internet was by using the establish keyword. The problem with the established keyword is that the router only checks for the ack bit on the packets. The ack bit is set on packets once the 3 way handshake has been completed. the problem with this is that it does not do anything for udp packets since those connections are stateless, and it is very easy for hackers to set the ack bit. To get around this problem Cisco invented the reflexive access-list.

permit tcp any any eq 80 established

Reflexive access-lists are very easy. I have added the code for the access-list below. Basically reflexive access-list are made up of two parts. The first part, is the access-list that filters outbound traffic. This access-list is made up of statements that allow outbound traffic. the key part here is the reflect statement. What this means is that you want to reflect that packet in another access list.

In my example below I reflected the statements in an access-list called dynamic. Now I created two access-lists. I created an inbound access-list to allow static inbound traffic to my webserver. I created an outbound access-list to allow traffic from my lan to the internet. I told my inbound access-list to check the reflexive entries before blocking traffic using the evaluate command. This is all there is too it. With these simple commands you can commands you can configure a statefull firewall to protect your network from harm. As good as this is though it isn’t perfect. It doesn’t work for application which use dynamic port numbers for return traffic. To solve this problem cisco added layer 4 inspection and refined reflexive access-lists in what they call Content Based Access Control or CBAC. However CBAC is part of the ios fw feature set and is a topic for another time.

interface FastEthernet0/0

 description WAN Interface

 ip address 192.168.0.1 255.255.255.0

 ip access-group internet_in in

 ip access-group lan_out out

 duplex auto

 speed auto

!

!

ip access-list extended internet_in

 remark Internet---->lan traffic

 permit tcp any any eq 80

 permit tcp any any eq 443

 evaluate dynamic

!

!

ip access-list extended lan_out

 remark inside----->internet traffic

 permit tcp any any eq www reflect dynamic

 permit tcp any any eq 443 reflect dynamic

 permit tcp any any eq 22 reflect dynamic

 permit tcp any any eq ftp reflect dynamic

 permit tcp any any eq telnet reflect dynamic

 permit tcp any any eq pop3 reflect dynamic

 permit tcp any any eq nntp reflect dynamic

 permit tcp any any eq smtp reflect dynamic

!

!