Scribd Logo
Upload

Welcome to Scribd!

  • 26 views

    2.1 Firewalls and ACLs

    Uploaded by

    kxe
    A firewall uses access control lists (ACLs) to control entry and exit of network traffic and filter unauthorized traffic. ACLs applied to router interfaces specify allow/deny rules for IP addresses, ports, protocols, and other conditions. For a network with private and DMZ subnets, the firewall would use ACLs to allow internal clients access only to public servers in the DMZ, by permitting connections to their IP addresses and ports for services like HTTP and DNS.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    2.1 Firewalls and ACLs

    Uploaded by

    kxe
    26 views16 pages
    A firewall uses access control lists (ACLs) to control entry and exit of network traffic and filter unauthorized traffic. ACLs applied to router interfaces specify allow/deny rules for IP addresses, ports, protocols, and other conditions. For a network with private and DMZ subnets, the firewall would use ACLs to allow internal clients access only to public servers in the DMZ, by permitting connections to their IP addresses and ports for services like HTTP and DNS.

    Original Description:

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    A firewall uses access control lists (ACLs) to control entry and exit of network traffic and filter unauthorized traffic. ACLs applied to router interfaces specify allow/deny rules for IP addresses, ports, protocols, and other conditions. For a network with private and DMZ subnets, the firewall would use ACLs to allow internal clients access only to public servers in the DMZ, by permitting connections to their IP addresses and ports for services like HTTP and DNS.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    26 views16 pages

    2.1 Firewalls and ACLs

    Uploaded by

    kxe
    A firewall uses access control lists (ACLs) to control entry and exit of network traffic and filter unauthorized traffic. ACLs applied to router interfaces specify allow/deny rules for IP addresses, ports, protocols, and other conditions. For a network with private and DMZ subnets, the firewall would use ACLs to allow internal clients access only to public servers in the DMZ, by permitting connections to their IP addresses and ports for services like HTTP and DNS.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 16

    Firewalls and ACLs

    Firewall and ACLs


    A firewall is a network equipment that allows controlling the entry and
    exit of information and, if necessary, filtering that which is not allowed

    Generally the configuration of an internal network has this structure

    Private Network

    DMZ stands for Demilitarized Zone


    DMZ Network It is the network where the servers
    accessible from the Internet are installed,
    such as the web server, mail server, DNS
    server, etc.
    Lucas Bazilio - Udemy
    Firewall and ACLs
    So that access to the two internal networks, the private one and the DMZ
    from the Internet must be controlled to avoid security failures.

    Specifically, the router needs to implement firewall functions to inspect


    all datagrams and discard those that are not allowed.
    Internet host in principle should not be able to
    access the private network

    Private Network

    Internet clients must be able to access the


    DMZ Network services available on the DMZ network
    Only and exclusively to these services

    Lucas Bazilio - Udemy


    Firewall and ACLs
    Control in the router is done with Access Control Lists (ACLs)

    ACLs apply to router interfaces and can be inbound or outbound.

    An ACL is a sequential list of accept or deny conditions according to


    @IP source and destination
    Ports source and destination
    Protocol (IP, TCP, UDP, ICMP, etc.)
    Status (any or answer)

    Lucas Bazilio - Udemy


    Firewall and ACLs
    To avoid complicating an ACL by mixing permissions with denies, one of
    these two approaches is generally used.

    In the first, a list of allowed conditions is created and concluded with a


    last line that denies all that remains.
    Accept condition_1

    Accept condition_2
    …
    Accept condition_n

    Deny all

    Lucas Bazilio - Udemy


    Firewall and ACLs
    The second approach is the opposite of the first: the list has a series of
    prohibited conditions and is concluded with one that allows everything.
    Deny condition_1
    Deny condition_2

    Deny condition_n

    Accept all

    Lucas Bazilio - Udemy


    Firewall and ACLs Example

    Private Network

    Web Server DMZ Network


    DNS Server

    Lucas Bazilio - Udemy


    Firewall and ACLs Example
    Private
    Network

    Web DMZ
    Server Network
    DNS Server

    Create a first ACL that controls access to the two public servers in the
    DMZ network.

    We have to define where to apply this ACL


    It is recommended to always apply it as close as possible to the area to be protected

    In this case, it should be applied to the exit Fa1/0 interface with respect to the router
    (that is, towards the DMZ network).

    Lucas Bazilio - Udemy


    Firewall and ACLs Example
    Private Network

    Web Server
    DNS Server

    We have to create a first ACL that controls access to the two public
    servers in the DMZ network.

    allow

    action
    Lucas Bazilio - Udemy
    Firewall and ACLs Example
    Private Network

    Web Server
    DNS Server

    We have to create a first ACL that controls access to the two public
    servers in the DMZ network.

    allow

    Transport protocol used by


    the web server
    Lucas Bazilio - Udemy
    Firewall and ACLs Example
    Private Network

    Web Server
    DNS Server

    We have to create a first ACL that controls access to the two public
    servers in the DMZ network.
    allow

    The source @IP can be any


    Lucas Bazilio - Udemy
    Firewall and ACLs Example
    Private Network

    Web Server
    DNS Server

    We have to create a first ACL that controls access to the two public
    servers in the DMZ network.
    allow

    We want to access the web service therefore the source port is


    an ephemeral port greater or equal than 1024
    Lucas Bazilio - Udemy
    Firewall and ACLs Example
    Private Network

    Web Server
    DNS Server

    We have to create a first ACL that controls access to the two public
    servers in the DMZ network.

    allow

    The destination @IP must be that of the web server


    Lucas Bazilio - Udemy
    Firewall and ACLs Example
    Private Network

    Web Server
    DNS Server

    We have to create a first ACL that controls access to the two public
    servers in the DMZ network.

    allow

    This server is accessed exclusively for its service 80, that is, HTTP web pages

    Lucas Bazilio - Udemy


    Firewall and ACLs Example
    Private Network

    Web Server
    DNS Server

    allow
    allow

    The same with the DNS service that uses UDP

    Lucas Bazilio - Udemy


    Firewall and ACLs Example
    Private Network

    Web Server
    DNS Server

    allow
    allow
    deny

    Everything is denied. As it is a sequential list, if one of the first two conditions is verified, it is allowed and the list is exited.
    This last prohibition would be made only if the first two conditions were not met, that is, it is as if it were a default rule that is made
    as a last resort.

    Lucas Bazilio - Udemy

    You might also like