Cyberstudy
PDF p.252 In progress

Access Control Lists (ACLs)

Open PDF at p.252 9 flashcards

Summary

PDF p.252

Access Control Lists (ACLs) are used on network devices like routers and switches to control traffic based on packet information. They add a layer of security and efficiency by permitting or denying traffic based on specified rules.

In plain words

Supplementary — not from your PDF

ACLs on routers, switches and firewalls permit or deny traffic based on IP addresses, ports and protocols. Rules are checked from top to bottom and the first match wins, so put the most specific rules first. Anything not matched falls to the implicit deny at the end.

Detailed explanation

PDF p.252
  • ACLs: Control traffic at the network interface level using packet information such as IP addresses, port numbers, and protocols.
  • Firewall Rules: Provide both network and application-level control, protecting the network perimeter by preventing unauthorized access.

Firewall ACL Processing

  • Rule Order: Processed from top to bottom; the most specific rules are placed at the top.
  • Implicit Deny: Default rule to block any traffic not matching a rule.

Important terms

taken from the text above
ACLs
Control traffic at the network interface level using packet information such as IP addresses, port numbers, and protocols.
Firewall Rules
Provide both network and application-level control, protecting the network perimeter by preventing unauthorized access.
Rule Order
Processed from top to bottom; the most specific rules are placed at the top.
Implicit Deny
Default rule to block any traffic not matching a rule.
ACLs Access Control Lists

Examples & real-world scenarios

Supplementary — not from your PDF
  • Allow TCP 443 to the web server, then deny all.
  • A specific deny for one bad host placed above a broader allow.
  • An ACL restricting router management to the admin subnet.

Scenario

An admin adds a rule blocking one malicious IP at the bottom of the list, but an earlier 'allow all HTTPS' rule matches first, so the block never applies. Moving the specific rule above the broad one fixes it.

Common mistakes

Supplementary — not from your PDF
  • Putting broad rules above specific ones.
  • Forgetting the implicit deny when traffic mysteriously fails.

Practical skills

Supplementary — not from your PDF
  • Order a set of firewall rules correctly and predict the outcome for sample packets.

What I should remember

Key Points PDF p.252
  • ACL Parameters (Tuples): Protocol, Source Address, Source Port, Destination Address, Destination Port.
  • Configuration Principles
    • Block spoofed internal/private IP addresses.
    • Block local network protocols (ICMP, DHCP, routing).
    • Use penetration testing and log monitoring.
    • Secure firewall hardware and management interface.

Firewall Rule Examples

  • Allow Specific Traffic: HTTP (port 80) and HTTPS (port 443) for web servers.
  • Restrict Protocols: Block FTP or SSH if not needed.
  • Restrict Outgoing Traffic: Block SMTP (port 25) to prevent spam.