What is an Access Control List (ACL)? – Brief Explanation

An Access Control List (ACL) refers to a set of rules usually used to filter network traffic. The rules specify which users are granted access to that object and the operations it is allowed to perform.  We can configure the Access Control List (ACL) on network devices with packet filtering compatibilities, such as routers and firewalls.

An Access Control List (ACL) contains a list of certain conditions and category which help you determine when to allow or deny network traffic. We can also apply these conditions on the interface basis to packets leaving or entering an interface. There are two types of Access Control List (ACL) available on a Cisco device:

• Standard Access Control List
• Extended Access Control List

An Access Control List (ACL) is the most commonly used features of Cisco IOS software and the ACL can perform the following tasks in our network:

Increase Network Performance

The ACLs increase network performance due to reducing the network load. For example, if company policy does not allow video traffic on the network, So the company use ACLs to block video traffic and increase their network performance.

Provide traffic flow control.

We can use ACLs to limit the delivery of routing updates when updates not required. This can preserved network bandwidth.

Network Security

An Access Control List (ACL) can also provide a basic level of network security. It can allow one host to access a part of the network and stop another host from accessing the same area.

Filtering Network Traffic

We can also use ACLs to filter network traffic based on the traffic type. For example, an ACL can permit email traffic but block all Telnet traffic.  We can also use ACL to permit or deny hosts access to network services. ACLs can permit or deny a user to access file types, such as FTP or HTTP.

By default, a router does not have ACLs configured, so a router does not filter traffic by default. Traffic enters to the router is routed exclusively using the information within the routing table.

But, when an ACL is configured and applied to an interface, the router filters and check each packet to determine if the packet can be forwarded or not. We can also use an ACLs to classify traffic to enable priority processing.  We can use ACL to permit or deny a specific type of network traffic

Packet Filtering with Access Control List (ACL)

ACL is a technique used to monitoring outgoing and incoming packets and allowing them to pass or halt based on the source and destination IP addresses protocols and ports. Packet filtering is also known as static filtering.

We can configure a filter rule on the network and then the router acts as a packet filter during sending, receiving, forwarding and denying packets according to filtering rules. Router configures with packet filtering rules open, read and extracts certain information from the packet header. The router makes routing decision from this information based on configured rules whether the packet can pass through or required to discard.

Packet filtering can work at transport layers and the network layer of the OSI model and the internet layer of the TCP/IP model. Rules configured on the router determine whether to permit or deny traffic. A router also performs packet filtering at the transport layer. The router can also filter packets based on the source and destination port of the TCP or UDP segment.

An ACL contains a list of permit or deny statements, also known as access control entries. Access Control Entries (ACEs) commonly known as ACL statements. We configure the ACL statements to filter traffic based on certain criteria, for example, the source address of the packet, destination address for the packet, the protocol, and also a port numbers.

When a packet passes through an interface configured with an ACL; the router compares the information within the packet with every ACE, in chronological order, to decide for statement matching. In case of a founding match, the router processed the packet accordingly. So, the ACLs control access to a network or subnet using the rules. The ACLs extracts the following information from the packet:

Layer 3 Information:

• Source IP address
• Destination IP address
• ICMP message type

Layer 4 Information:

• TCP/UDP source port
• TCP/UDP destination port