O'Reilly - Practical UNIX & Internet Sec... 7015KB

[Chapter 21] 21.3 Example: Cisco Systems Routers as Chokes
Be aware that the show access-lists command is normally not a privileged command; anybody who can log into your
router can see all of your access lists. You can make it privileged by using the IOS privilege commands added in IOS
Version 10.3.
21.3.3 access-class Command: Protecting Virtual Terminals
After you have created one or more access lists, you can use the access-class command to assign the access-control list to
a particular Cisco virtual-terminal line. You assign access lists to a particular Cisco interface by using the access-class
command. You should use the access-class command to configure your router so that it will reject login attempts from
any host outside your organization. You may also wish to configure your router so that it rejects all login attempts from
inside your organization as well, with the exception of a specially designed administrative machine.
The access-class command has the following syntax:
access-class access-list-number {in|out}
Where:
access-list-number
Specifies the number of an access list. This must be a number between 1 and 199.
in | out
Specifies whether incoming connections or outgoing connections should be blocked.
You can use this command to prevent people from logging directly onto your router (using one of the vty interfaces)
unless they are coming from a specially designated network. For example, to configure your router so that it will only
accept logins from the subclass C network 198.3.3, you could use the following sequence of IOS commands:
router#config t
Enter configuration commands, one per line. End with CNTL/Z.
router(config)#access-list 12 permit 198.3.3.0 0.0.0.255
router(config)#line vty 0 4
router(config-line)#access-class 12 in
router(config-line)#^Z
router#
21.3.4 ip access-group Command: Protecting IP Interfaces
You can also use access lists to specify packets that should be blocked from crossing an IP interface. For example, if you
are using the Cisco interface to create a conventional choke-and-gate interface, and you have a serial connection to an
Internet service provider, you can specify that the only IP packets that should be transmitted in from the interface should
be those that are destined for the gate machine, and that the only IP packets that should be transmitted out from the serial
interface are those that are from your gate.
The command that associates an access list with a particular interface is the access-group command. This is an
interface-configuration command, which means that it is typed when the router is in interface-configuration mode.
The access-group command has the following syntax:
ip access-group access-list-number {in | out}
Where:
access-list-number
Specifies the number of an access list. This must be a number between 1 and 199.
in | out
file:///C|/Oreilly Unix etc/O'Reilly Reference Library/networking/puis/ch21_03.htm (4 of 5) [2002-04-12 10:45:57]