Analysis and technical implementation of ACL
ACL
Access control list (ACL) is an access control technology based on packet filtering. It can filter the data packets on the interface according to the set conditions and allow them to pass or discard. Access control list is widely used in routers and three-layer switches. With the help of access control list, users' access to the network can be effectively controlled, so as to ensure network security to the greatest extent.
Type of access control list
Standard access control list Filter packets based on source IP address The access control list number of the baiozhun access control list is 1 ~ 99 Extended access control list Filter packets based on source IP address, destination IP address, specified protocol, port, and flag The access control list number of the extended access control list is 100 ~ 199 Named access control list Named access control lists allow names to be used in place of table numbers in flag and extended access control lists
Application rules
3P principle
When applying an ACL on a router, you can use each protocol and each direction for each protocol. Configuring acLs using each interface (each interface) is often referred to as the 3P principle. (1) An ACL can be based on only one protocol. Therefore, an independent ACL must be configured for each protocol. (2) The data passing through the router interface has both input and output directions. Therefore, configuring the ACL on the interface has both input and output directions. Each interface can be configured with an ACL for the incoming direction, the incoming direction, or both. However, an ACL can control only one direction. (3) AN ACL can control data flows on only one interface but not multiple interfaces at the same time.
The order of statements determines the order in which data is controlled
The statement of an ACL is a logical top-down arrangement.The data matching process is to compare the statements in turn. Once the matching is successful, it is processed according to the current statement control strategy and is no longer compared with the following statements.Therefore, the correct order of statements can achieve the desired control effect.
At least one Permit statement
The last statement of all ACLs is an implicit deny statement, indicating that when all statements fail to match, data will be rejected and automatically discarded in case it accidentally enters the network.Therefore, when writing "deny" ACLs, there must be at least one Permit statement, otherwise the interface that configures the ACL will reject any data and affect normal network communication.
The most restrictive statements should be placed at the front of the ACL
The most restrictive statements are placed at the front of the ACL, which first filters out a lot of data that does not meet the requirements, saving the comparison time of the following statements, thus improving the efficiency of the router.
Experimental Topology:
1-R5 sets the IP address 192.168.12.1 24, R6 sets the IP address 192.168.12.2 24
2-Set ACL mode at R6, deny R5 remote access to R6 entries, and set flow direction at R6 port to deny R5 entry
3-Setting remote login password in R6
That's all. Thank you.
