3_8

(8) ACL Implementation

Acacia Router - ACL Configuration

Router(config)# access-list 101 permit tcp host 10.42.110.1 any eq email
................. (when applied to pri0 incoming) disallows outside world all access except to send e-mail to e-mail server

Router(config)# access-list 102 permit tcp any any eq DNS
Router(config)# access-list 102 permit tcp any any eq email
Router(config)# access-list 102 permit tcp any any eq http
................. (when applied to pri0 outgoing) allows everyone in school to e-mail, DNS & http outside of school - deny all other services

Router(config)# int pri0
Router(config-if)# ip access-group 101 in
Router(config-if)# ip access-group 102 out
................. APPLIES above access lists to pri0 (which connects to the outside world)

Router(config)# access-list 103 permit ip 10.42.111.0 0.0.0.255 10.42.112.0 0.0.0.255
Router(config)# access-list 103 permit ip 10.42.111.0 0.0.0.255 10.42.113.0 0.0.0.255
................. (when applied to e0 incoming) permits admin access to curriculum

Router(config)# int E0
Router(config-if)# ip access-group 103 in
................. APPLIES above access list to e0 (which connects to the admin section)

Router(config)# access-list 104 permit tcp 10.42.112.0 0.0.0.255 host 10.42.111.2 eq DNS
Router(config)# access-list 104 permit tcp 10.42.112.0 0.0.0.255 host 10.42.111.2 eq email
Router(config)# access-list 104 permit tcp 10.42.112.0 0.0.0.255 host 10.42.111.2 eq http
Router(config)# access-list 104 permit tcp 10.42.112.0 0.0.0.255 host 10.42.111.2 eq ftp-data
Router(config)# access-list 104 deny ip 10.42.112.0 0.0.0.255 10.42.111.0 0.0.0.255
................. (when applied to e1 incoming) denies curriculum access to admin, BUT allows curriculum to access services of the enterprise server (e-mail, DNS, application & library)
......................... NOTE: http was allowed because we have assumed library info service is in the form of http.
......................... NOTE: ftp-data was allowed because we're not sure how else to allow applications to be downloaded - we have assumed that passwords can be used to prevent students from causing any damage.

Router(config)# int E1
Router(config-if)# ip access-group 104 in
................. APPLIES above access list to e1 (which connects to the curriculum section)

Router(config)# access-list 103 permit tcp 10.42.113.0 0.0.0.255 host 10.42.111.2 eq DNS
Router(config)# access-list 103 permit tcp 10.42.113.0 0.0.0.255 host 10.42.111.2 eq email
Router(config)# access-list 103 permit tcp 10.42.113.0 0.0.0.255 host 10.42.111.2 eq http
Router(config)# access-list 103permit tcp 10.42.113.0 0.0.0.255 host 10.42.111.2 eq ftp-data
Router(config)# access-list 103 deny ip 10.42.113.0 0.0.0.255 10.42.111.0 0.0.0.255
................. (when applied to e2 incoming) denies curriculum access to admin, BUT allows curriculum to access services of the enterprise server (e-mail, DNS, application & library)

Router(config)# int E2
Router(config-if)# ip access-group 105 in
................. APPLIES above access list to e2 (which connects to the curriculum section)

*****Followed by all ipx acls - which are exactly the same as above, but using access-list numbers 900-999

Security Policies/Purpose of ACLs:

The ACLs will be used to:

deny any incoming web traffic apart from email data (on pri0, in)
permit outgoing DNS, email and http (on pri0, out)
permit admin network access to the curriculum network (on E0, i)
deny curriculum network access to admin network (on E1, and E2, in)

List of Routers with ACLs

main school router (as shown above)
In fact, all school routers will have ACLs applied - this acts as the first firewall to the outside world
The router on the WAN, which connects to the Internet - this acts as the second firewall to the outside world - preventing all but e-mail and http traffic from coming into the District WAN.

Reasons for using ACLs

The ACL's have been placed as close to the source networks as possible, which is standard practice when using extended access control lists. Furthermore, this is the only router in the school, and ACLs are essential in denying curriculum access to admin, but permitting admin access to curriculum.