Dynamic ACL

Dynamic ACL

Dynamic ACLs (also called Lock-and-key ACLs) allows users to send traffic through the router based on authentication process.

Dynamic ACLs configured are as follows:

Let's create locally on the R5 local user with password. Then configure accesss-enable autocomand to make dynamic ACLs work.
Please note that TAB key will not complete  "accesss-enable host" command!!!  

R4#
interface FastEthernet0/0
ip address 10.50.45.4 255.255.255.0

R5#

!
interface FastEthernet0/0
ip address 10.50.45.5 255.255.255.0
ip access-group TEST_DYN in
!
interface FastEthernet0/1
ip address 10.50.56.5 255.255.255.0
!

!

ip access-list extended TEST_DYN
permit ospf any any #to save our ospf session
permit tcp any host 10.50.45.5 eq telnet  #to telnet on R5 

permit icmp any any log-input #just for testing connectivity
dynamic TEST permit tcp any any log-input #permits telnet session to any host

!

ip access-list log-update threshold 1 #for monitoring access-list operation

!

username cisco password 0 cisco #creating username  with password 

!

line vty 0 4
login local #allow our user to telnet on R5

!

username cisco autocommand access-enable host #invokes access-enable command allowing to authenticate user to "turn on" dynamic ACL

Let's try:

Lets look at dynamic ACL before we initiate TCP session (telnet session in our example) through the R5:

R5(config-ext-nacl)#do sh ip access
Extended IP access list TEST_DYN
    10 permit ospf any any (11 matches)
    15 permit tcp any host 10.50.45.5 eq telnet
    20 permit icmp any any log-input
    30 Dynamic TEST permit tcp any any log-input

Telnet to R6...

R4#telnet 6.6.6.6
Trying 6.6.6.6 ...
% Destination unreachable; gateway or host down

Now let's telnet to R5's interface on which we configured dynamic ACL

R4#telnet 10.50.45.5
Trying 10.50.45.5 ... Open
User Access Verification
Username: cisco
Password:
[Connection to 10.50.45.5 closed by foreign host]

After login and password was checked R5 closed the session

Now let's see on ACL:

R5(config-ext-nacl)#do sh ip access
Extended IP access list TEST_DYN
    10 permit ospf any any (92 matches)
    15 permit tcp any host 10.50.45.5 eq telnet (84 matches)
    20 permit icmp any any log-input
    30 Dynamic TEST permit tcp any any log-input
    30   permit tcp host 10.50.45.4 any log-input  #new ACE appeared with ip address of our R4' interface

R4#telnet 6.6.6.6
Trying 6.6.6.6 ... Open
User Access Verification
Username: cisco
Password:
R6>exit
Success! ))

On R5 we can see ACL treshold and logging:

R5(config-ext-nacl)#

*Nov 19 06:16:40.931: %SEC-6-IPACCESSLOGP: list TEST_DYN permitted tcp 10.50.45.4(65223) (FastEthernet0/0 ca04.5184.0008) -> 6.6.6.6(23), 1 packet

See you. 

Best Regards!

Reflexive ACL

Reflexive ACLs works as adaptive firewall. It allows outbound traffic and allows inbound traffic in response to upper layer protocols sessions originated inside the router ( similar to content based):

We will configure Reflexive ACL on F0/1 of R5...

R5(config)#!

ip access-list extended REF_TEST_OUT

permit ospf any any #to allow OSPF
permit tcp any any reflect REF #After permitting TCP session ACL creates/reflects sessions parameters to ACL named as "REF" with ACE's statements "mirrored" or reflected to current session.

!

ip access-list extended REF_TEST
permit ospf any any
evaluate REF #this statement evaluates new reflective ACL named "REF" and  apply them "inbound" to interface

!
interface FastEthernet0/1
ip address 10.50.56.5 255.255.255.0
ip access-group REF_TEST in
ip access-group REF_TEST_OUT out

Look at the example....

here are ACLs before any tcp session occurs:

R5(config)#do sh ip access | sec REF
Reflexive IP access list REF
Extended IP access list REF_TEST
    10 permit ospf any any (121 matches)
    20 evaluate REF
Extended IP access list REF_TEST_OUT
    5 permit ospf any any
    10 permit tcp any any reflect REF (88 matches)
R5(config)#

Now we try to telnet to router R6:

R4#telnet 10.50.56.6
Trying 10.50.56.6 ... Open
User Access Verification
Username: cisco
Password:
R6>

And on R5 we can see Reflexive ACL's permit statement...

R5(config)#do sh ip access | sec REF
Reflexive IP access list REF
     permit tcp host 10.50.56.6 eq telnet host 10.50.45.4 eq 60050 (45 matches) (time left 279)
Extended IP access list REF_TEST
    10 permit ospf any any (133 matches)
    20 evaluate REF
Extended IP access list REF_TEST_OUT
    5 permit ospf any any
    10 permit tcp any any reflect REF (113 matches)

 This statement will be configured till the end of the tcp session.

See you!

Best Regards!

Traffic filtering with VLAN map.

Here some info that I found on Cisco.com on configuration gudes for Catalyst6500 series and Catalyst3750 switches.

1.1 All non-IP protocols are access-controlled through MAC addresses and Ethertype using MAC VLAN maps.
1.2 IP traffic is not access controlled by MAC VLAN maps with matching Ethertype 0x0800

2.1 Each VLAN access map can consist of one or more map sequences; each sequence has a match clause and an action clause. The match clause specifies IP or MAC ACLs for particular type traffic filtering and the action clause specifies the action to be taken when a match occurs.

3.1 When a flow matches a permit ACL entry, the associated action is taken and the flow is not checked against the remaining sequences.
3.2 When a flow matches a deny ACL entry, it will be checked against the next ACL in the same sequence or the next sequence of VLAN map.

4.1 If there is a match clause for that type of packet (IP or MAC) in the VLAN map, the default action is to drop the packet if the packet does not match any of the entries within the map.
4.2 If there is no match clause for that type of packet (no "match ip address" or no "match mac address" command in any clause), the default is to forward the packet.

5.1 VACLs have an implicit deny at the end of the map.

6.1 If an empty or undefined ACL is specified in a VACL, any packets will match the ACL, and the associated action is taken.
-It means you can specify any VLAN map clause without specifyed ACL, but with specifyed action, all traffic that meet this clause will be forwarded.

7.1 You can enforce VLAN maps only on packets going through the switch;  you cannot enforce VLAN maps on traffic between hosts on a hub or on another switch connected to this switch.
-It means you can not filter traffic that generates two neighboring switches such as CDP/VTP/DTP/PAGP

Topology for our little lab:

Let's test connectivity from R2

Connectivity test_1:

R2#ping 10.1.1.1

!!!!!

R2#ping 172.20.1.1

!!!!!

R2#ping 172.20.2.1

!!!!!

R2#ping 172.20.3.1

!!!!!

We begin our lab from configuring necessary ACLs:

Empty MAC and IP  ACLc:

SWITCH_2(config)#mac access-list ex MAC_EMPTY

SWITCH_2(config)#ip access-list extended IP_EMPTY

MAC ACL for matching ARP packet

SWITCH_2(config)#mac access-list extended ALL_ARP

SWITCH_2(config-ext-macl)#permit any any 0x806 0x0

IP acl for matching R1's IP addresses

SWITCH_2(config)#ip access-list extended R1_IP

SWITCH_2(config-ext-nacl)#10 permit ip 172.20.3.0 0.0.0.255 any

SWITCH_2(config-ext-nacl)#20 permit ip 10.0.0.0 0.255.255.255 any

SWITCH_2(config-ext-nacl)#30 permit ip 172.20.2.0 0.0.0.255 any

SWITCH_2(config-ext-nacl)#40 deny ip 172.20.1.0 0.0.0.255 any

Verify created ACL's:

SWITCH_2(config)#do sh access-list

Extended IP access list IP_EMPTY

Extended IP access list R1_IP

    10 permit ip 172.20.3.0 0.0.0.255 any

    20 permit ip 10.0.0.0 0.255.255.255 any

    30 permit ip 172.20.2.0 0.0.0.255 any

    40 deny ip 172.20.1.0 0.0.0.255 any

Extended MAC access list ALL_ARP

    permit any any 0x806 0x0

Extended MAC access list MAC_EMPTY

Ther is no any filters on VLAN 12 (see topology):

SWITCH_2(config)#do sh vlan filter

SWITCH_2(config)#

Configure VLAN map as written in  2.1

Configure VLAN map TEST-MAP without any ACL and actions and apply this map to VLAN12:

SWITCH_2(config)#vlan access-map TEST-MAP ?

  <0-65535>  Sequence to insert to/delete from existing vlan access-map entry

  <cr>

SWITCH_2(config)#vlan access-map TEST-MAP 10

SWITCH_2(config-access-map)#exit

SWITCH_2(config)#vlan filter TEST-MAP vlan-list 12

SWITCH_2(config)#end

Verify applyed VLAN map on a VLAN12

SWITCH_2#sh vlan filter

VLAN Map TEST-MAP is filtering VLANs:

  12

SWITCH_2#

SWITCH_2#sh vlan access-map

Vlan access-map "TEST-MAP"  10

  Match clauses:

  Action:

    forward

SWITCH_2#

As you can see above - the default action is "forward" (see 6.1)

Connectivity test_2:

Let's test connectivity from R2:

R2#ping 10.1.1.1

!!!!!

R2#ping 172.20.1.1

!!!!!

R2#ping 172.20.2.1

!!!!!

R2#ping 172.20.3.1

!!!!!

Now apply only empty MAC ACL to clause 10 of our VLAN map:

SWITCH_2(config)#vlan access-map TEST-MAP 10

SWITCH_2(config-access-map)#match mac address MAC_EMPTY

SWITCH_2(config-access-map)#exit

SWITCH_2(config)#do sh vlan access TEST-MAP

Vlan access-map "TEST-MAP"  10

  Match clauses:

    mac address: MAC_EMPTY

  Action:

    forward

Connectivity test_3:

R2#ping 10.1.1.1

!!!!!

R2#ping 172.20.1.1

!!!!!

R2#ping 172.20.2.1

!!!!!

R2#ping 172.20.3.1

!!!!!

As show us connectivity test_3 empty MAC ACL doesnt filter any taaffic (see 6.1 ACL MAC_EMPTY) 

Let's add to our VLAN map MAC ACL matching ARPs:

SWITCH_2#conf t

SWITCH_2(config)#vlan access-map TEST-MAP 9

SWITCH_2(config-access-map)#match mac address ALL_ARP

SWITCH_2(config-access-map)#action drop

SWITCH_2(config-access-map)#exit

SWITCH_2(config)#do sh vlan access-map

Vlan access-map "TEST-MAP"  9

  Match clauses:

    mac address: ALL_ARP

  Action:

    drop

Vlan access-map "TEST-MAP"  10

  Match clauses:

    mac address: MAC_EMPTY

  Action:

    forward

Connectivity test_4:

R2#ping 10.1.1.1

!!!!!

Look at the ARP table on both routers and clear ARP on R1:

R2#sh ip arp

Protocol  Address          Age (min)  Hardware Addr   Type   Interface

Internet  10.1.1.1               84   0000.0000.0002  ARPA   FastEthernet0/0

Internet  10.1.1.2                -   0000.0000.0001  ARPA   FastEthernet0/0

R1#sh ip arp

Protocol  Address          Age (min)  Hardware Addr   Type   Interface

Internet  10.1.1.1                -   0000.0000.0002  ARPA   FastEthernet0/0

Internet  10.1.1.2               84   0000.0000.0001  ARPA   FastEthernet0/0

R1#clear ip arp 10.1.1.2

R1#

R1#sh ip arp

Protocol  Address          Age (min)  Hardware Addr   Type   Interface

Internet  10.1.1.1                -   0000.0000.0002  ARPA   FastEthernet0/0

Connectivity test_5:

R2#ping 10.1.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

Now add static ARP entry to both routers and test connectivity again:

R1(config)#arp 10.1.1.2 0000.0000.0001 ARPA

R2(config)#arp 10.1.1.1 0000.0000.0002 ARPA

R2(config)#end

Connectivity test_6:

R2#ping 10.1.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 16/44/92 ms

Connectivity test_5 shows us that our ARP filter works well and test_6 shows us that IP traffic wasn't filtered by our VLAN map that's why all IP packets are forwarded after addinf static ARP entry (see 4.2)

Next we will delete empty clause 10 and add IP ACL to our VLAN map:

SWITCH_2(config)#no vlan access-map "TEST-MAP" 10

SWITCH_2(config)# vlan access-map "TEST-MAP" 10

SWITCH_2(config-access-map)#match ip address R1_IP

SWITCH_2(config-access-map)#action forward

SWITCH_2(config-access-map)#exit

SWITCH_2(config)#do sh vlan access-map

Vlan access-map "TEST-MAP"  9

  Match clauses:

    mac address: ALL_ARP

  Action:

    drop

Vlan access-map "TEST-MAP"  10

  Match clauses:

    ip  address: R1_IP

  Action:

    forward

Connectivity test_7:

R2#ping 10.1.1.1

!!!!!

R2#ping 172.20.1.1

.....

R2#ping 172.20.2.1

!!!!!

R2#ping 172.20.3.1

!!!!!

Connectivity test_7 shows us explicit drop (see 5.1) and denied traffic addressed to 172.20.1.1 caused by ACL R1_IP's deny entry. (see 4.1 and ACL R1_IP) 

Now let me show you 3.1 and 3.2 in action.

In clause 10 wee change action to "drop":

SWITCH_2(config)#vlan access-map "TEST-MAP" 10

SWITCH_2(config-access-map)#action drop

conncetivity test_8

R2#ping 10.1.1.1

.....

R2#ping 172.20.3.1

.....

R2#ping 172.20.2.1

.....

R2#ping 172.20.1.1

.....

As you see all packets to addresses permited by IP ACL R1_IP were administratively dropped by action "drop" of our VLAN map and packets sent to 172.20.1.1 were dropped by implicit deny of our map.

Configure empty caluse 15 to permit all packets that was not filtered before and send pings:

SWITCH_2(config)#vlan access-map "TEST-MAP" 15

Connectivity test_9

R2#ping 172.20.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.20.1.1, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

Test_9 didn't show connectivity because ICMP request was sent from address 10.1.1.2 (we can see it from debugging_1):

debugging_1:

R2#deb ip packet

IP packet debugging is on

R2#ping 172.20.1.1 rep 1

*Mar 10 07:54:02.344: IP: tableid=0, s=10.1.1.2 (local), d=172.20.1.1 (FastEthernet0/0), routed via FIB

*Mar 10 07:54:02.348: IP: s=10.1.1.2 (local), d=172.20.1.1 (FastEthernet0/0), len 100, sending.

Success rate is 0 percent (0/1)

Configure interface Lo4 with ip address 172.20.1.2/32 on R2 and add static route to this address on R1 and see the result:

R2#conf t

R2(config)#int lo4

R2(config-if)#ip add

R2(config-if)#ip address 172.20.1.2 255.255.255.255

R1#conf t

R1(config)#ip route 172.20.1.2 255.255.255.255 10.1.1.2

Connectivity test_10:

R2#ping 172.20.1.1 source 172.20.1.2  <----------<<<< (specify a source address for not to be filtered by                                                                                                 our VLAN MAP see IP ACL R1_IP )

Packet sent with a source address of 172.20.1.2

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 12/37/80 ms

As i said in the beginning of this little lab, you can not filter IP traffic by MAC VLAN map with specifying ethertype 0x0800. You also can not filter traffic between two switches such as CDP/VTP/PAGP. It is not necesary to reapply VLAN map filter every time you reconfigured it, at least I did not reconfigured it while labbing.

All that was shown and mentioned above you can test by yourself.

Any comments will be usefull.

Best regards!

Dmitriy Kravets.