CCNA Complete Guide 2nd Edition.pdf - Cisco Learning Home

The Access Control List established Keyword
- The established keyword is only applicable to TCP access list entries to match TCP segments
that have the ACK and / or RST control bit set (regardless of the source and destination ports),
which assumes that a TCP connection has already been established in one direction only.
Non-matching cases are initial TCP connection-establishment segments with only the SYN bit set.
- A typically usage is to distinguish the connections originating inside from connections
originating elsewhere. Figure below shows a scenario which allowing internal systems to initiate
Telnet connections to any Internet site (outside network), but not the other way around. A simple
solution is to block incoming packets that don’t have the ACK or RST bits set by using the
established keyword, which permitting return traffic for connections that are established and
initiated from the inside, and denying connections initiated from outside to inside.
Internet
RT1 configuration:
Figure A6-14: Sample ACL established Network I
- Note: This method of blocking unwanted traffic originating outside the network can be
circumvented – it is possible to forge a packet with the appropriate bits set.
- Another usage is to allow connections to be initiated from client systems only, but not from the
server to the others. This can prevent abuse from the server and tighten the server to offer only
the necessary services.
Figure A6-15: Sample ACL established Network II
- The access-list 101 permit tcp any any established is equivalent to access-list 101
permit tcp any any ack rst.
270
S0 E0
RT1
access-list 101 permit tcp any any established
access-list 102 permit tcp any any eq telnet
!
interface Serial0
ip access-group 101 in
ip access-group 102 out
RT1 configuration:
E0 E1
RT1
10.10.10.10
access-list 101 permit tcp host 10.10.10.10 any established
access-list 102 permit tcp any host 10.10.10.10 eq telnet
!
interface Ethernet1
ip access-group 101 in
ip access-group 102 out
Copyright © 2008 Yap Chin Hoong
yapchinhoong@hotmail.com