| Overview

Network administrators must figure out how to deny unwanted access to the network while allowing internal users appropriate access to necessary services. Although security tools, such as passwords, callback equipment, and physical security devices are helpful, they often lack the flexibility of basic traffic filtering and the specific controls most administrators prefer. For example, a network administrator may want to allow users access to the Internet, but not permit external users telnet access into the LAN. Routers provide basic traffic filtering capabilities, such as blocking Internet traffic, with access control lists (ACLs). An ACL is a sequential list of permit or deny statements that apply to addresses or upper-layer protocols. This module will introduce standard and extended ACLs as a means to control network traffic, and how ACLs are used as part of a security solution. In addition, this chapter includes tips, considerations, recommendations, and general guidelines on how to use ACLs, and includes the commands and configurations needed to create ACLs. Finally, the chapter provides examples of standard and extended ACLs and how to apply ACLs to router interfaces. ACLs can be as simple as a single line intended to permit packets from a specific host, or they can be extremely complex sets of rules and conditions that can precisely define traffic and shape the performance of router processes. While many of the advanced uses of ACLs are beyond the scope of this course, this module provides details about standard and extended ACLs, the proper placement of ACLs, and some special applications of ACLs. Students completing this module should be able to: Describe the differences between standard and extended ACLs Explain the rules for placement of ACLs Create and apply named ACLs Describe the function of firewalls Use ACLs to restrict virtual terminal access