Understanding the network.pdf - Back to Home

ACL (using the ACL ID number) is associated with the filtering or logic command
that is specific to an application.
When ACLs are used for protocol-specific packet filtering, they are applied to
interfaces as access-groups. Each interface can support a single, standard or
extended, inbound and outbound access-group. This variability applies to all
enabled protocols. Each access-group is applied as an interface configuration
subcommand . If
no filter direction is specified, the access-group will be applied as an inbound filter.
When creating the ACL, take into account where the ACL will be placed in the
interface's path. Traditionally, access-groups used for security are inbound filters,
on the assumption that you are defending against unauthorized packets from
outside your LAN. When inbound filters are applied, all traffic flows to the interface.
During the matching process, the inbound list is first compared to the source
address of the incoming packet. If the packet matches an address on the list, it is
processed further. If no match is made, it is processed by the default action (usually
deny). Outbound filters are also used for security filtering in scenarios where the
router is acting as a firewall and outbound access is restricted or requires
authentication. More often, though, they are used as traffic filters, to discard
unneeded traffic and permit everything else. With outbound filters, the traffic flows
through the interface, a route lookup is performed, and then the packet is processed
through the filter. If a match is made, the packet is forwarded on, otherwise it is
discarded. The first match of an outbound filter is made against the source address
of the outgoing packet. The issue to be aware of is that the type of list and match
tests used to process packets changes, depending on which side of the interface it's
applied to.
NOTE
IOS also supports advanced IP access control lists of two types: dynamic and
reflexive. Dynamic ACLs provide lock and key IP traffic filtering. Lock and key
filtering allows you to configure a gateway router to act as a firewall. Before a user
can send traffic out through the router, he must authenticate first. After being
successfully authenticated (and assuming the destination host is also permitted)
temporary access through the gateway is granted.
Reflexive lists are created with named ACLs. Where they differ from regular ACLs is
that, rather than having a static list of matching statements that leave specific ports
open, reflexive lists add ACL entries for specific hosts on a dynamic and temporary
basis. These entries are based on upper-layer session activity that is defined as part
of the reflexive ACL. This kind of configuration is particularly advantageous from a
security perspective, because it defends against most network-based security
assaults (when used in conjunction with extended ACL matching statements). By