8.2 Access Control

Key Concepts

• Access Control Lists (ACLs)
• Standard ACLs
• Extended ACLs
• Named ACLs
• Wildcard Masks
• Implicit Deny

Access Control Lists (ACLs)

Access Control Lists (ACLs) are a series of commands used to filter packets based on criteria such as source and destination IP addresses, protocols, and ports. ACLs are applied to interfaces to control the flow of traffic entering or leaving the network.

Example: Think of ACLs as bouncers at a nightclub. They decide who gets in (allow) and who gets turned away (deny) based on specific criteria like age, dress code, or membership.

Standard ACLs

Standard ACLs are the simplest form of ACLs, which filter packets based only on the source IP address. They are typically used to control access to a specific network or host from another network or host.

Example: Consider a standard ACL as a security guard at the entrance of a building. The guard only checks the ID (source IP address) of each person (packet) to decide whether they can enter.

Extended ACLs

Extended ACLs provide more granular control by filtering packets based on the source and destination IP addresses, protocol type, and port numbers. This allows for more precise traffic filtering and access control.

Example: Imagine an extended ACL as a customs officer at an airport. The officer checks not only the passport (source IP address) but also the destination (destination IP address), the purpose of the trip (protocol), and the luggage contents (port numbers) to decide whether to allow the traveler (packet) to pass.

Named ACLs

Named ACLs are a more flexible and manageable form of ACLs, where the ACL is identified by a name rather than a number. This allows for easier editing and management of ACL entries.

Example: Think of named ACLs as a personalized membership card at a gym. Instead of using a generic number, each member has a unique name on their card, making it easier to manage and update their access privileges.

Wildcard Masks

Wildcard masks are used in ACLs to specify which bits in an IP address should be matched exactly and which bits can vary. They are the inverse of subnet masks and are used to define the range of IP addresses to be allowed or denied.

Example: Consider a wildcard mask as a paintbrush that can either paint a specific area (exact match) or leave it blank (variable). The brush (wildcard mask) determines which parts of the canvas (IP address) are painted and which are left untouched.

Implicit Deny

Implicit deny is a default rule in ACLs that denies any packet that does not match any of the explicitly defined allow rules. This ensures that only explicitly allowed traffic is permitted, while all other traffic is blocked.

Example: Think of implicit deny as a default "no trespassing" sign on a property. Unless there is a specific sign (allow rule) giving permission, anyone who enters (packet) is considered trespassing and is denied access.