The Packet University

A little while back, I wrote about the basic application of extended IP Access-lists.  There are a couple of points that I hope everyone fully grasped the significance of.  The first point is that nearly all traffic is bidirectional in nature.  Thus two-way communication is almost always required.  The second point is that when access-lists are applied, each packet is compared and evaluated.  This creates a bit of dilemma when we try to create a firewall using an IOS based router.  If we want to block all traffic coming into our network, a “deny ip any any” will do the trick.   However, when we consider the implications we soon realize that return will be blocked.  Let’s take a look.

This blog entry is a little bit different than other recent posts.  The original intent of Packetu.com was to help people understand how networks operate and function.  During my recent studies, it morphed into a CCIE blog.  This article is a bit more basic, but contains some really good foundational information that should be understood prior to implementing features including access-lists and CBAC (ip inspects). 

Access-lists come in many flavors, including standard and extended IP access-lists as well as access-lists capable of identifying other characteristics in non-IP traffic.  Access-lists, also known as ACLs, can be named or numbered.  Identification or matching of traffic is a key concept of access-lists and is performed with each line in the ACL.  These lines or entries are also known as ACEs or Access Control Entries.  It is easy to think of access-lists as filters, but they are really a way to match or identify characteristics of a packet.  How they are then applied can make them a filter or something else.  If an access-list is identified, any traffic not matching an ACE will have an implicit deny or negative match applied to it.  Therefore if the ACL is used for filtering, anything not matched will be dropped.  This article will focus on IP Extended access-lists and how they are used to filter traffic going through a router.   In the future, I may expand on the other uses for an access-list. 

I appeared for the CCIE Security lab on April 8^th in San Jose and am thrilled to announce that I am now CCIE #26009.  I would like to take a few minutes to give thanks where thanks are due.  I first want to thank God for the opportunities, the supportive family environment I have had throughout this process, and the many blessings through an otherwise tough year.  Without the exposure of many real world scenarios and support from those around me, this would have been an all but impossible task.  I wish to extend special thanks my family for putting up with me and for my lack of availability for the last twelve months as I went through this process.