What is an Access Control List (ACL)? – Brief Explanation
An Access Control List (ACL) refers to a set of rules usually used to filter network traffic. The rules specify which users are granted access to that object and the operations it is allowed to perform. We can configure the Access Control List (ACL) on network devices with packet filtering compatibilities, such as routers and firewalls.
An Access Control List (ACL) contains a list of specific conditions and categories that help you determine when to allow or deny network traffic. We can also apply these conditions on the interface basis to packets leaving or entering an interface. There are two types of Access Control Lists (ACL) available on a Cisco device:
- Standard Access Control List
- Extended Access Control List
An Access Control List (ACL) is the most commonly used feature of Cisco IOS software, and the ACL can perform the following tasks in our network:
Increase Network Performance
The ACLs increase network performance due to reducing the network load. For example, if company policy does not allow video traffic on the network, it uses ACLs to block video traffic and increase its network performance.
Provide traffic flow control.
We can use ACLs to limit the delivery of routing updates when updates not required. This can preserved network bandwidth.
Network Security
An Access Control List (ACL) can also provide a basic level of network security. It can allow one host to access a part of the network and stop another host from accessing the same area.
Filtering Network Traffic
We can also use ACLs to filter network traffic based on the traffic type. For example, an ACL can permit email traffic but block all Telnet traffic. We can also use ACL to permit or deny hosts access to network services. ACLs can permit or deny a user to access file types, such as FTP or HTTP.
By default, a router does not have ACLs configured, so a router does not filter traffic by default. Traffic enters the router and is routed exclusively using the information within the routing table.
But, when an ACL is configured and applied to an interface, the router filters and checks each packet to determine if the packet can be forwarded or not. We can also use ACLs to classify traffic to enable priority processing. We can use ACL to permit or deny a specific type of network traffic.
Packet Filtering with Access Control List (ACL)
ACL is a technique that monitors outgoing and incoming packets and allows them to pass or halt based on the source and destination IP address protocols and ports. Packet filtering is also known as static filtering.
We can configure a filter rule on the network, and then the router acts as a packet filter during sending, receiving, forwarding, and denying packets according to filtering rules. The router is configured with packet filtering rules to open, read, and extract specific information from the packet header. The router makes routing decisions from this information based on configured rules on whether the packet can pass through or be required to be discarded.
Packet filtering can work at the transport layer, the network layer of the OSI model, and the internet layer of the TCP/IP model. Rules configured on the router determine whether to permit or deny traffic. A router also performs packet filtering at the transport layer. It can filter packets based on the source and destination port of the TCP or UDP segment.
An ACL contains a list of permit or deny statements, also known as access control entries. Access Control Entries (ACEs), commonly known as ACL statements. We configure the ACL statements to filter traffic based on specific criteria, such as the packet’s source address, destination address, protocol, and port numbers.
When a packet passes through an interface configured with an ACL, the router compares the information within the packet with every ACE in chronological order to decide on statement matching. In case of a founding match, the router processed the packet accordingly. So, the ACLs control access to a network or subnet using the rules. The ACLs extracts the following information from the packet:
Layer 3 Information:
- Source IP address
- Destination IP address
- ICMP message type
Layer 4 Information:
- TCP/UDP source port
- TCP/UDP destination port