In this video, we're going to walk through an example of setting up some
infrastructure ACL entries.
And as part of our game plan, let's demonstrate a few things.
Number one, let's demonstrate anti spoofing.
And we'll imagine that our internal network here is 25 dot 25.
And the reason I'm using 325 is that it's easy to recognize.
So when you see 25, 25, 25, you just think, oh, that represents the internal
management address space for infrastructure devices.
So we want to do anti spoofing to stop any incoming traffic, we'll play inbound
right here on R4. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
right here on R4.
And inbound traffic, that says it's coming from 25, 25, 25, 0.
Let's also go ahead and set up some anti spoofing.
So for source, we'll say no or deny for source 25, 25, 25, 0.
Let's also say no to any source addresses that are pretending to come from 0
dot 0 dot 0.
And let's also throw in an RFC 1918 address space just for grins.
So anything claiming to come from 10 dot 0 dot 0 or once to be 2 dot 16 dot 0 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So anything claiming to come from 10 dot 0 dot 0 or once to be 2 dot 16 dot 0
dot 0 and this will be a slash 8 and this will be a slash 12.
So we'll say no to all that will put a little red indicator there saying we're
going to do a deny.
And then we'll go ahead and we'll deny fragments that are going to our address
base of our management network of 25 dot 25 dot 0.
Let's also go ahead and deny options so an attacker could be using options in
IP headers to help manipulate and trick our system.
So let's also deny options going to our address base again for transit traffic
that's going through our network and not to our network devices. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that's going through our network and not to our network devices.
We can let those go, but we want to go ahead and deny fragments and options to
our management address base.
So those would also be denies to our address base and then for the permits and
I'll go ahead and mark that in crane.
So next we want to do our permits for traffic that's going to our management
devices that we need.
For example, we'd want to go ahead and permit traffic like BGP and lock it down
between our devices in our infrastructure and our external BGP peers.
So here I'm going to say permit BGP explicitly meaning just to the sources and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So here I'm going to say permit BGP explicitly meaning just to the sources and
destinations that are needed.
And the same thing would be true for SSH and possibly ICMP. Then we want to
deny that traffic BGP and SSH and ICMP.
It is going to 25 25 25 0 because if it wasn't permitted explicitly earlier, we
want to go ahead and deny any of that type of traffic to our management address
base of our devices.
And then at the tail end, we'd want to permit IP any any just without all the
transit traffic that didn't get explicitly denied. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
transit traffic that didn't get explicitly denied.
So with that in mind, let's go ahead and use some of that information and
create an infrastructure ACL right here inbound on gig 00 on our four.
So here in the lab environment, let me go ahead and double click on the top
ology, making sure that we are on the right lab.
That's always helpful for a good demo. So there's our topology that looks great
.
And just for grins, I'm going to go to this client nug computer for a moment,
which is up in the upper right, double click on it to bring it up.
That's the little Windows 11 machine.
It's one of verify that I can reach server one nug just to confirm all of our WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It's one of verify that I can reach server one nug just to confirm all of our
network routing is in place.
So here's the console coming up for client nug in the upper left hand corner of
our topology.
And if you do an IP config, you'll show us the IP address 100150.
That looks good.
And we'll do a ping access to a trace a trace RT space dash deeper.
Don't bother doing name resolution over to our server at 23 dot 1 dot 2 dot 100
.
And there's the hop.
So the first hop is based on the last octet. That's our one and then our two
and then our four and I can't reach the server. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then our four and I can't reach the server.
Why is that? Let's do control C. Oh, there it is. I just didn't wait long
enough.
And there's the final destination of our server 23 dot 1 dot 2 dot 100.
So the path is going through the network like this.
So I verify we had basic connectivity and we do great, great, great.
So let me go ahead and minimize client nug in case we need to use them again.
And let's go to server one nug which will give us console access to all of our
routers.
So here's the console access to router four.
And that's where we're going to create our infrastructure ACL.
And we'll just put a few examples in to give you the feel of it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we'll just put a few examples in to give you the feel of it.
The first thing we should do in our four is verify we don't yet have an access
list that we're going to build upon.
So show access list and press center and we have an IPV six ACL, but we don't
have any IPV four.
Also, by the way, the same type of filtering we would use for IPV four for
filtering out bogus or incoming traffic.
Also, because that's showing up, we would also want to create the same types of
access control list if we're using IPV six as we're doing with IPV four.
So in this demo, I should get focused on IPV four, but the concepts are very WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So in this demo, I should get focused on IPV four, but the concepts are very
similar.
So now that we know that we don't have any IPV four access control list, let's
go ahead and go into configuration mode and let's create IP access list
extended.
And let's call it our dash I ACL, just remind ourselves of what it is.
And then we're in extended access list configuration mode.
So let's go ahead and deny source traffic if it claims to be coming from the
address base at zero zero zero zero trying to go anywhere.
We'll kill that fantastic.
And let's also let's take one more from RFC 3030 and how about deny IP coming WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's also let's take one more from RFC 3030 and how about deny IP coming
from 127 anything.
So for our wildcard, we'll match on the first octet and not care about the
second one, third one or fourth one going to anywhere.
So once this ACL is applied, this could deny those two.
And let's pick one example from the RFC 1918 address base.
Let's do a deny about once a two dot 16 dot zero zero.
So let's say slash 12.
So the range is once a two is 16 through once a two 31.
So the wildcard bits there would be zero dot for the first octet for the second WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So the wildcard bits there would be zero dot for the first octet for the second
octet be 15, meaning we only care about matching on the first page.
So that second octet and then 55 that 55 meaning we don't care about mentioning
any of the bits from octet three or four going to anywhere.
And I thought IP, but I didn't say it.
So I need to say IP fantastic.
And let's do a do show access list and we'll specify the name of our access
control list, our dash I ACL press enter.
And there's our access control list so far.
So that's an example of some of the addressing space that we want to deny as WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So that's an example of some of the addressing space that we want to deny as
source addresses before allowing them to come into our network.
However, another deny that we should do is deny IP anything claiming to come
from 25 dot 25 dot 25 dot zero.
That's our internal address base.
We don't want anybody claiming their source address coming in from the outside
world is coming from that same address space.
So the wildcard bits there to be zero dot and then two to five dot two to five
dot two to five space going to anywhere.
Perfect.
Now here is our access control list so far and I love that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now here is our access control list so far and I love that.
I wanted to match on the first three octets.
So let's go ahead and fix that with a no 40 remove that 40 entry and then we'll
go ahead and we'll do deny IP 25 dot 25 dot 25 dot zero space and we want to
match on the first three octets of zero dot zero dot zero dot.
And then the last octet we don't care about and that looks much better.
Another good reason to check our work going to any destination.
So we'll do a do show access list our IACL and that looks way better.
So we'll check this as we go. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we'll check this as we go.
So next listed I fragments they're trying to go into our management address
space.
So we'll say deny and let's go ahead and do TCP source from anywhere going to
our management network of 25 dot 25 dot zero with the wildcard mass saying we
want to match on this first three octets space and then we're going to use the
key word fragments right there.
Check on non initial fragments.
So that's going to deny those and it'll do the same thing for fragments for UDP
coming to our management space and also for ICMP.
Again, these are the examples of what we might want to include in an WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Again, these are the examples of what we might want to include in an
infrastructure access control list to protect our infrastructure devices.
So now even if it's coming in from authorized source and it's for example an
authorized session.
If there's fragments involved, it'll block that on the way in.
Next list deny options.
So do deny IP coming from any to our address base of 25 dot 25 dot 25 dot zero
with the wildcard mask of zero dot zero dot zero dot two fifty five. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
with the wildcard mask of zero dot zero dot zero dot two fifty five.
We'll use the keyword option and then which options do you want to match on.
So what do we want to match on a record route and there's tons of options here.
I'm going to go ahead for the demo and say any options.
So we'll go ahead and do any options press enter and let's check our access
control list.
So so far we have a whole bunch of denies fantastic.
And now let's go ahead and start permitting some traffic.
How about BGP?
So if we had BGP peers that we need to allow BGP traffic in on or we weren't WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if we had BGP peers that we need to allow BGP traffic in on or we weren't
sure who's going to initiate the session.
We'd want to allow for both sides of that conversation. So we do permit TCP and
let's say for example we had a host out at nine dot nine dot nine dot nine.
That's who we're appearing with. So we put in the peers address of nine nine
nine nine.
So I will use the keyword of host in front of that.
And then we can specify our internal address space.
Now it'd be even better if we locked it down to a specific BGP speaker that was
in our address base.
But for the demo I'll go ahead and say the destination can be 25 dot 25 dot 25 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But for the demo I'll go ahead and say the destination can be 25 dot 25 dot 25
dot anything if the destination port equals BGP.
And we could also hit the upper key and say permit TCP host nine nine nine nine
with a source port of BGP.
And the keyword BGP points to port 179 and that's where BGP operates.
So this next entry would allow an external host.
For example, nine nine nine nine that's our external BGP speaker. If they're
sourcing their traffic from port 179 coming into our address base.
This permit statement would allow that to happen.
Oh, my wildcard mouse there. So I'll go ahead and update that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Oh, my wildcard mouse there. So I'll go ahead and update that.
I just washed my hands and can't do a thing with them. So I'll do a no 100 and
I will fix that with the wildcard mask of 255.
So one thing that's interesting about access controllers is that the bits the
wildcard bits do not have to be contiguous.
So I'm going to go ahead and put that back in, but with the correct wildcard
mask of 255 and that last octet.
And then we'll check our work with a quick show command. All right, that looks
better.
And if that's the only BGP we need, we then want to go ahead and delete all WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And if that's the only BGP we need, we then want to go ahead and delete all
other BGP going to our address base.
So we can do a denied TCP any to the address base of 25 dot 25 dot 25.
If the destination port equals BGP just like that.
We can also flip that and specify if it's the source port equals BGP and then
the tail end go ahead and take off the equal BGP there.
And so now anything that's not explicitly permitted here in lines 90 and 100
are going to be explicitly denied by these next two entries, which would be 110 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
are going to be explicitly denied by these next two entries, which would be 110
and 120.
So we do a quick show command. Next, let's allow SSH. So we'll permit TCP.
And let's imagine that we want to permit SSH from this one server coming to
anything in our 25 address space.
We'll say permit TCP host and the server is out there at 23 dot 1 dot 2 dot 100
space question mark and the destination is going to be 25 dot 25 dot 25 dot
anything.
If the destination port equals 22, which is SSH and that will allow that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If the destination port equals 22, which is SSH and that will allow that
traffic.
And if that's the only traffic we want, we then want to go ahead and deny all
other SSH coming into our address base.
So we'll do deny TCP from anyone coming to 25 dot 25 dot 25 dot 0 24 bit mask.
If that destination port is 22 just like that.
And let's do a quick check of our work with the show access list.
And so far I think we're on track.
We'll do a more for ICMP. So for ICMP list also allow ICMP from server one nug
out here to anything in our 25 address base.
So say permit ICMP from host 23 dot 1 dot 2 dot 100 going to anything in the 25 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So say permit ICMP from host 23 dot 1 dot 2 dot 100 going to anything in the 25
dot 25 dot 25 address base.
And then we can lock it down to specifics regarding ICMP, but for the demo, I
'll leave it open.
And if that's the only ICMP we want to address base, we then do a deny ICMP
from anywhere going to 25 dot 25 dot 0 with the last eight bits not mattering.
And let's do a quick verification of our work with a show access list.
And that looks pretty good to know the very tail end of this. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that looks pretty good to know the very tail end of this.
This is all for infrastructure control.
The last thing we want to do is allow other traffic that, for example, might be
transiting our network.
So we're going to add one more line.
It'll be 170.
We'll say permit IP any any.
And if we want to also we could add the log keyword on these, but I've also
discovered that because we have hit counts, you can go back.
You can see it counts and identify that an access list control entry has been
hit even without the log keyword.
So our next step then would be to apply this inbound on our four gig zero zero
interface. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
interface.
So let's go ahead and do that.
So we'll go into interface configuration mode for gig zero slash zero and we
use the command IP access group.
The name of our access control list, which I will copy paste so I don't have a
typo.
And we want it to be applied inbound.
Awesome.
So if we look at our access control list, let's do a show access list, our dash
I ACL press center.
We've already had some matches here at the very end to catch all the permit IP
any any.
But let's go ahead and test the SSH here.
So this line right here says that we are permitting TCP traffic from the server WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So this line right here says that we are permitting TCP traffic from the server
2312100 going to anywhere in the 25.
A dress base 252525, etc.
If the destination port is 22, I just realized that I don't have SSH running on
my router.
So let's let's do this.
Let's set up SSH here on our one so that we can go ahead and connect there.
And it's also set up a loop back address that's reachable at 25 dot 25 dot 25
dot one.
So let me go ahead to our one and let me set that up. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let me go ahead to our one and let me set that up.
It'll make for a much better demo.
Also in our infrastructure access control list if we're not allowing telnet for
example, we want to block that as well as any other management protocols to our
address base.
So here are our one.
Let's go ahead and do an IP domain name of nuggetlab.com that will be needed as
we do our crypto key generate RSA.
So the next crypto key generate RSA module.
Let's use 2048.
So these are commands we learned back in CCNA level training about setting up WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So these are commands we learned back in CCNA level training about setting up
basic SSH capabilities.
Let's do IP SH version two and let's do a do show run pipe section line just to
take a look at our line configurations and we'll do a little work there.
So let's go ahead and take off the no login.
We want to then be able to go ahead and log in.
So we'll need a local user as well.
Let's create a username of admin and and privilege 15 and secret.
In fact, let's use capital C ISCO exclamation mark two three because that's the
one that rolls off of my fingertips the easiest and handle. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
one that rolls off of my fingertips the easiest and handle.
So I'm going to use a simple password like that and then we'll go to line VTY
zero through 15 and I'll do a login local.
We could also turn on for a new model if you want, but it's going to say login
local and also transport input.
That's the thing and that way we're not even allowing input telnet on this
router.
So we're just eliminating the telnet option altogether.
So now that's done, let's go ahead and test it locally. Let's do a show IP
interface brief.
I'll say please exclude anything that has the output of an assigned in it and
let's do a telnet to 1.1.1.1. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
let's do a telnet to 1.1.1.1.
I'm not telling it.
Let's do SSH 1.1.1.1 locally and it says no user specified with the show run
pipe section line.
Take a layer of line configuration real quick login local.
That looks good and oh, and I forgot the specify user here.
So SSH my fault dash L for login as admin to that address in the password is
capital C. I SEO exclamation mark 23 boom and we are in.
So if you do a show users fantastic if we do a show SSH and press enter WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if you do a show users fantastic if we do a show SSH and press enter
fantastic.
We are logged in. We know SSH works. So I'm going to go ahead and type in exit.
Let's also go ahead and create a loop back address in the 25 address range.
So do a config D and specify interface loop back. Let's make interface loop
back 25.
I'll do IP address 25 dot 25 dot 25 dot 1 with a 32 bit mask and fantastic and
then we'll add that to OSPF.
Let's do show IP OSPF interface brief.
Yep. I don't have a network state. Oh, it's already covered. Great, great,
great.
So I must have a network statement that's wide open and it's included fantastic WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So I must have a network statement that's wide open and it's included fantastic
.
So now that address is reachable. Let's go ahead and do a ping out to the
server at 23 dot 1 dot 2 dot 100 will source it from loop back 25 just to
verify we have reach ability there and back and we do great, great, great.
So now if we went to the server now in our topology server one nug is this
server that we're currently sitting at right here.
So if we went to a command prompt on this server, let's do that by clicking on
the command prompt icon.
So here, let's go ahead and type in SSH press enter and let's take a look at WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So here, let's go ahead and type in SSH press enter and let's take a look at
our options here so we can go ahead and do a user at host fantastic work force.
So we'll do a SSH space admin 25 dot 25 dot 25 dot 1 and no matching cipher.
All right.
Well, I know based on earlier on our output, let's go take a look that if we
did when we did a show SSH, it does support this.
So I'm going to go ahead and copy that go back to the command prompt and we'll
just add that in so be SSH space. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
just add that in so be SSH space.
And then we'll do a dash C for cipher based on the legend up here.
And we'll go ahead and paste that in and then we'll go ahead and log in as
admin 25 dot 25 dot 25 dot 1 center and okay.
Yeah, I'll accept the thumbprint and yes.
And boom, we'll put in the password and we are in fantastic.
So if we go back to our four and we take a look at the access control list, let
's do that real quick.
We'll do a upper key show access list.
There were our pings that we did for testing and here's our traffic for SSH. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
There were our pings that we did for testing and here's our traffic for SSH.
The permit statement permitting that server 2312 100 to use SSH to anything in
the address space of 25 25 25.
So if we change the IP address on server one, let's do that from just a moment.
So back at server one, if we exit out of our existing session, we do a n CPA
dot CPL to change our IP address here real quick.
And I just change this the lab net care.
Look at the properties and let me change the IPB for address to have about one
zero one.
So now the address has changed.
We'll click OK. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We'll click OK.
We'll go back now.
Now we try to do an SSH to that same host.
It's going to fail.
And that's because the access control list says, hey, you know what?
You weren't permitted earlier and I'm denying all other state traffic or that
specific IP address.
So if we go back to our console session previously, we had no matches here on
line 140 and now we have the upper key and press center.
Now we have some denies on 140 and before I forget, I'm going to go back to
server one and change this IP address back.
So we'll go to properties, go back to IPB for change it back to 100, click on WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we'll go to properties, go back to IPB for change it back to 100, click on
OK a couple of times and then go back to the command line.
And now that same upper key, now we're able to log in to our one because the
access control list is permitted.
So the login is admin with our password type correctly and we are in.
So we do a show SH and we are good to go.
So I'll type in exit and I close that command prompt and come back into a
refresh here.
So as a summary here of our infrastructure access controllers, we want to deny
traffic that should never be coming into our network based on their source
addresses.
And that includes our own block of dresses being used as a source coming in WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that includes our own block of dresses being used as a source coming in
from the outside or RC 1918 addresses or RC 3330 addresses.
Next words, the nine fragments that are coming in to our management address
space of 25, etc.
And then we're also denying traffic that is using options coming into our 25
address space and then we'll get very specific on permitting traffic that we
need, for example, permitting BGP and then denying BGP from everything else
going to our address space.
And then for this example, printing SSH and then explicitly denying a sage to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then for this example, printing SSH and then explicitly denying a sage to
our address space from everywhere else.
And then permitting explicitly the ICMP traffic, we want to go to our address
space and then denying everything else coming to our address space, then
finally allowing everything else to transit traffic to go through.
So now that we've taken a look at an example of an infrastructure ACL on the
next video, I'd like to turn our attention to control plain policing.
So I'll see you there in the next video in just a moment.