Access control list.
In this lesson, we're going to discuss
how we can best secure our network
using access control list, firewall rule sets,
and how to configure role-based access.
Now, an access control list, or ACL,
is a list of permissions associated
with a given system or network resource.
An ACL can be applied to any packet filtering device
such as a router, a Layer 3 switch, or a firewall.
In an ACL, you're going to have a list of rules
that are being applied based on an IP address,
a port, or an application, depending on the type of device
you're applying this ACL onto.
Now, as the access control list
is being processed by the device,
it's going to start at the top of the list
and work through each line
until it reaches the end of that list.
So we're going to work from top to bottom.
Therefore, you always want to make sure
your most specific rules are at the top
and your most generic rules are at the bottom.
For example, let's pretend I had an access control list
as I'm working as a bouncer at a nightclub.
Now at the top of the list,
I might have something very specific,
like somebody's name, John Smith.
He came in last week and he caused all sorts of trouble,
so John Smith cannot come in the club.
Now as I move down the list,
I may get to something more generic.
So I might get to something that says
anybody whose driver's license
says they live in Montana,
because I'm running a club in Florida.
If that was the case, I might want to block that
because maybe we had a lot of people
coming with fake IDs from Montana,
so we're not going to accept those anymore.
Now as we get to the end of that list,
we might see something very generic,
something like, no men allowed.
Maybe this is a woman's only club.
Now, this is a pretty generic rule, right?
'Cause half of the people on the planet are men.
So this is a very generic way of saying things.
So as we go from the top to the bottom,
we go from very specific
to more general to the most general.
Now, the same thing happens in our networks.
If I'm going to create a rule to block SSH
for a single computer based on its IP address,
that's going to be towards the top of my list.
If I want to block any IP address that's using port 110,
that's going to be a bit more generic,
so it'll be somewhere in the middle.
Finally, if I want to block any IP going to any port,
that is going to be something that is really generic
and it should be at the end of my list.
So, let's talk about some things
that we may want to block using our ACLs
in order to help secure our networks better.
Now first, we want to make sure we're blocking
incoming requests from internal
or private loop back addresses
or multicast IP ranges or experimental ranges
if we have something that's coming
from outside of the network going into our network.
So, if you have something that says it's coming from
192.168 dot something dot something,
and it's coming from the internet interface,
well, that's a non-writeable IP
and it shouldn't be coming from there.
So you should be blocking that.
That should never be allowed to come into your network
from the internet because usually it's an attacker
trying to spoof their IP.
Similarly, if you start seeing source IP addresses
coming from areas that are reserved for things
like loop back or experimental IP ranges,
those things should also be blocked immediately.
Second, you want to block incoming requests from protocols
that should only be used locally.
For example, if you have ICMP, DHCP, OSPF, SMB,
and other things like that,
you want to block those at the firewall
as things try to enter your network.
Now if you have something like Windows file sharing
for instance, which operates over SMB,
that should not be happening over the internet.
That is something that should happen
inside the local network only.
So again, you should be blocking that at the firewall
at the border of your network.
If somebody has a VPN and they're working from home,
they'll be able to tunnel through your firewall,
access the local network, and then use SMB that way.
But they shouldn't be using it straight from their home
over the internet to your network.
They should only do it through a VPN.
Now, the third thing you want to consider
is how you want to configure IPv6.
Now, I recommend you either configure IPv6
to block all IPv6 traffic,
or you allow it only to authorize hosts and ports
if you're using IPv6 in your network.
The reason for this is because a lot of hosts
will run dual-stack TCP IP implementations
with IPv6 enabled by default.
And if you're not aware of that,
you're going to be having a lot of these things open
and you're letting people have unfettered access
to your network.
A lot of organizations are still running IPv4 only,
and if they're doing that, they definitely need to turn off
IPv6 on those hosts,
and they need to configure their firewall to block it.
If you don't do this, you could have a misconfiguration
that could allow adversaries unfiltered access
into your networks by using that IPv6 IP address area,
because a lot of administrators simply haven't locked down
IPv6 well enough yet.
So, keep this in mind as you're doing your configurations
on your firewalls and your access control list.
Alright, now that we have some basic rules out of the way,
let's take a look at an access control list
and walk through it together.
Now this one is an example from a Cisco firewall.
But that really doesn't matter for this exam,
because when we're talking about CompTIA exams,
they're device agnostic.
This could have come from a router,
it could have come from a firewall,
it could have come from Cisco or Juniper or Brocade,
it really doesn't matter.
The point is, I want you to be able to read
a basic firewall like this and understand it
because that will make sure you're doing well on the exam.
So, let's start out with the first line,
ip access-list extended From-DMZ.
This just says that this is an access list,
and in this case I'm using it for my DMZ.
The second line is a comment or remark line.
This is going to tell you what this section is about.
Basically it's saying that we're going to have responses
to HTTP requests and that we're going to get
a bunch of permit statements here.
Now, as we go through these permit statements,
we're going to look at them one at a time,
and it's going to tell us which things
are being permitted or denied.
Now, when we see the word permit,
that means we're going to allow something.
In this case, we're going to allow TCP traffic.
So we have permit TCP,
and then we have the IP address
that's going to be associated with it.
In this case, we're going to permit TCP traffic
coming from the IP address, 10.0.2.0.
The next thing we have is going to be our wild card mask,
which acts like a subnet mask.
Now, this looks a little funny because it's a wild card mask
and it's technically a reverse wild card,
and it's written as 0.0.0.255.
So, if you want to read this as a subnet mask,
you actually have to convert it
and essentially you're going to make it 255.255.255.0.
This is a Cisco thing.
When you see the zero in the reverse wild card,
treat that as a 255.
If you see a 255, treat it as a zero.
Don't let this get you confused.
Essentially, what we're saying here is that we're permitting
TCP traffic from any IP that is 10.0.2.something
because this is the 10.0.2.0 network,
and it has 256 possible IPs that we're going to use here.
Anything in this IP range will be permitted under this rule.
The next part you see is eq, which stands for equal.
So, the IP address has whatever is beyond this equal sign,
and that's going to be allowed.
In this case, we're equaling www.
Now what does that mean?
It means port 80.
Www is Cisco's way of saying this is web traffic.
Somebody can make a request over port 80
and we're going to allow it.
Next, we have the part that says any,
and this says that we're going to be going to
any IP address as our destination.
So we can go to any web server of the world over port 80
and we're going to allow it.
This will allow us to make an established connection there
and then start traffic.
So anytime we want to make an established connection
from 10.0.2.something to some website over port 80,
we're going to allow that using TCP.
Essentially, that's what we're saying.
People can go out and access a website
from our DMZ out to the internet.
And this is all we're saying with this particular line.
Now, as you go through
and you read all these different lines in the ACL,
you can start figuring out
what is permitted and what is denied.
In this case, everything shown here is permitted
because we're doing explicit allow permissions.
What we're saying is, yes, all these things are allowed,
permit them from this IP
and this port going to that IP and that port.
But as we go through to the bottom of this list,
you'll see one statement that looks a little different.
It says deny ip any any.
Now this is what's known as an implicit deny.
This says that anything that is not already allowed
above in my ACL rule set
is something we're just going to deny by default.
So if we get down this list
and you see things like www, 443, echo-reply, domain,
these are all things that we're allowing.
And then, when I talk about domain here,
I'm not really talking about domain in general,
but we're talking about DNS as a service,
because this is the way Cisco talks about DNS services.
When they say domain,
we are really talking about equaling port 53.
So, in this case everything you see listed here
is all these different permit statements
that are going to allow traffic from our DMZ to the internet.
The DMZ can go out and get web traffic
over port 80 or port 443.
It can reply to echo requests, which is ICMP.
It can use port 53, which is domain over UDP and TCP.
These are all things that we're going to be allowed to do
from this DMZ.
But when I get down to that last statement,
if any of those things didn't happen, we're going to deny it.
So for example, if somebody tries
to go to port 21 and access FTP,
we're going to reach that deny IP any any statement,
and it's going to be blocked.
This is because that statement will deny any IP
going from any IP to any IP.
It's only going to allow things that are being permitted
explicitly listed in this list,
and everything else is going to be blocked.
This is a good way of doing your security.
Now, we just mentioned the concept of explicit allow,
but we can also have firewall rules
that will use explicit deny or implicit deny.
Now when you have an explicit deny statement,
you're creating a rule to block
some kind of matching traffic.
In this example I showed you,
we didn't have any explicit deny statements,
but they would look exactly the same
as our permit statements,
except we would change the word permit to deny.
Now, this allows us to go from an explicit allow
to an explicit deny.
So, let's say I wanted to block traffic
going to the IP address of 8.8.8.8.
I could create a rule that says
deny ip 8.8.8.8 0.0.0.0 any any,
and it's going to block all ports and all protocols
going to the IP address of 8.8.8.8.
Now, notice my reverse card mass there was 0.0.0.0,
which tells me I only want to match this IP,
not a whole network, just the IP of 8.8.8.8.
On the other hand, I could also use an implicit deny,
which blocks traffic to anything not explicitly specified.
In the example ACL I showed you,
that last statement had that implicit deny.
Basically, anything not already explicitly allowed
by an allow statement is going to get blocked
because we had that deny ip any any statement
as the last statement at the end of our ACL.
Finally, we need to talk about role-based access.
Role-based access allows you to define the privileges
and responsibilities of administrative users
who control your firewalls and their ACLs.
With role-based access, we put different accounts
into groups based on their roles or job functions.
Then, based on those roles, we're going to assign permissions
to which devices they can configure and modify.
So for example, if I'm responsible
for updating and configuring the border gateway
or firewall for the network,
I would get access to add things to the ACL
that would open or restrict communication
between the internet and the internal network.
On the other hand, if I'm just a switch technician
who's responsible for adding and removing users
when they're assigned to a new office,
my role would not allow me to modify
a Layer 3 switch's ACLs,
but instead would only allow me to shut down
or re-enable switch ports and configure port security.