Definition, Purposes, Benefits, and Functions of ACL

Routers connect different networks. When a router receives a data packet on an interface, it reads the packet's destination address and forwards it out the interface connected to that address. It is known as routing. Routers follow this procedure for all incoming packets. By default, they do not differentiate between genuine packets and fake packets. Any host that knows the destination address can send packets through the router. An adversary can utilize this feature to gain unauthorized access to network resources. It creates security risks. To mitigate this threat, you can create rules on the router. After that, the router will forward only allowed packets. It will discard all remaining packets. The rules you use to define the criteria and actions for filtering data packets are called access rules.

Access list

An access list is a list of statements. An ACL statement consists of criteria and actions. The requirements describe the pattern for matching. Actions define the functions for matching packets. It allows you to control the flow of data packets by permitting or denying them based on predefined conditions. To match a pattern, a router checks an access list from top to bottom in sequential order. Once a pattern matches for a packet, it does not check the remaining statements. All ACLs have an implicit 'deny any' statement at the end. If a packet does not match any of the statements in the ACL, the router drops it.

Purposes and uses of ACLs

In addition to routing, many other router features also use ACLs. Some features that utilize ACLs include Dial-on-Demand routing (DDR), Quality of Service (quality of service), Network Address Translation (NAT), and Port Address Translation (PAT). Filtering routing information, restricting remote access, prioritizing traffic, adjusting the administrative distance of routes, and triggering phone calls are just a few more ways a router can use ACLs.

Controlling traffic

You can use ACLs to control network traffic. For example, you can apply an ACL on a slow WAN link. In that ACL, you can define which traffic can traverse the WAN link. This setup enhances performance and reduces unnecessary traffic. ACLs allow you to specify the permitted addresses for various services such as NAT, PAT, and DDR. Once an ACL is applied, the service will allow traffic only from the allowed addresses.

ACLs help you manage network bandwidth by prioritizing certain types of traffic, limiting resource usage, or shaping data flow. For instance, you can prioritize voice (VoIP) over video streaming to ensure smooth communication, or restrict outbound traffic from specific hosts to prevent abuse or congestion.

Mitigating security risks

Security enforcement is the primary purpose of an ACL. It enhances network security by blocking unwanted traffic, such as preventing unauthorized access to internal resources (e.g., restricting web server access to specific hosts), blocking malicious traffic patterns (e.g., port scans or known attack signatures), and implementing policies for secure remote access and VPNs.

ACLs mitigate several security risks. Through ACLs, you can block IP spoofing and denial of service attacks. You can also define applications and ports that can receive traffic from users. If you specify allowed applications, the router will forward traffic only if it matches one of them. For example, to secure a web server, you can create an ACL that allows only web traffic. After that, the router will block all traffic, excluding web traffic.

Authentication

ACLs allow you to set up a database of permitted users who can access the router for management and administration. For example, the RSH (Remote Shell) and RCP (Remote Copy) protocols use an ACL database for authentication. ACLs allow you to create network segments to control inter-VLAN routing and enforce policies across different parts of a network, enhancing the overall security posture.

Advantages of ACLs

The main benefits of ACLs are the following.

Securing network

ACLs allow you to filter and block unauthorized traffic. You can filter traffic by source IP address, destination IP address, protocol, flow direction, and more. You can also use ACLs to secure remote access to the router. For example, using an ACL, you can permit only one specified remote terminal to access an inbound VTY session and disallow all other Telnet traffic entering or leaving the network.

Reducing network traffic

Many services depend on broadcast messages for various functions. For example, routers use broadcast messages to send and receive periodic routing table updates. Broadcast messages generate significant network traffic and degrade network performance. You can limit routing updates by using ACLs. You can create an ACL that specifies which networks are to be advertised and apply it to the dynamic routing protocol configured on the router. An ACL used as a protocol rather than an interface is called a distribute list.

Prioritizing traffic

ACLs allow you to prioritize traffic. You can prioritize traffic based on the address, data type, protocol, and data purpose. For example, you can prioritize live video streaming data over text data.

Key points:-

• ACLs provide fine-grained control over packet filtering based on various criteria (source/destination IP addresses, protocols, ports, etc.).
• ACLs are flexible. You can easily add new rules or remove existing ones as needed.
• ACLs are scalable. They can handle large volumes of traffic efficiently.
• By examining the logs of applied ACLs, you can check network behavior and potential issues.

Functions

Packet filtering, traffic shaping and policing, logging and monitoring, and Quality of Service (QoS) are the main functions of ACLs.

Packet Filtering

Packet filtering is the core function of ACLs. They have many criteria to define conditions for allowed and blocked traffic. You can use them to filter traffic based on source and destination addresses, protocols, and ports. They apply rules sequentially. The first match determines the action taken.

Traffic Shaping and Policing

You can use ACLs to limit bandwidth usage by setting rate limits for specific traffic types and marking packets based on their priority before forwarding them along different paths or queues.

Logging and Monitoring

You can use ACLs to log matched/denied packets, provide valuable data for security audits, analysis, and troubleshooting.

Quality of Service (quality of service)

ACL integrates with quality of service mechanisms to ensure critical traffic types receive priority over others, enhancing overall network efficiency.

Conclusion

Access Control Lists are essential tools in modern networking for enforcing policies, managing traffic, ensuring security, and optimizing network performance. This tutorial introduced ACLs, explained what they are, and showed how routers use them for various purposes. Learning these essential things helps you understand and manage ACLs more effectively.