IPv4 Access Control Lists (ACLs)

Planning an ACL Application

dictates that a match occurs only when the source address on such packets is identical to the address configured in the ACE.

This ACL (a standard ACL named “Fileserver”) includes an ACE (Access Control Entry) that permits matches only with the packets received from 10.28.252.117 (the SA). Packets from any other source do not match and are denied.

 

 

 

 

 

Source Address (SA)

 

 

 

ip access-list standard Fileserver

 

 

 

 

 

 

 

 

 

 

permit 10.28.252.117 0.0.0.0

 

 

ACE

 

 

 

 

 

 

Mask (All zeros mean that a match occurs

 

 

exit

 

only when an IP packet’s source address is

 

 

 

 

 

 

 

 

 

 

identical to the source address configured

 

 

 

 

 

in the ACE.

 

 

 

 

 

 

 

Inbound Packet “A” On VLAN 20

–Destination Address: 10.35.248.184

–Source Address: 10.28.252.117

Inbound Packet “B” On VLAN 20

– Destination Address: 10.35.248.184

– Source Address: 10.28.252.120

The VLAN permits packet “A” because its source address matches the source address in the ACE.

The VLAN denies packet “B” because its source address does not match the source address in the ACE.

Figure 9-5. Example of an ACL with an Access Control Entry (ACE) that Allows Only One Source Address

Examples Allowing Multiple IPv4 Addresses. Table 9-2provides exam­

ples of how to apply masks to meet various filtering requirements.

Table 9-2. Example of Using an IPv4 Address and Mask in an Access Control Entry

Address in the ACE

Mask

Policy for a Match Between a

Allowed Addresses

 

 

Packet and the ACE

 

 

 

 

 

A: 10.38.252.195

0.0.0.255

Exact match in first three

10.38.252.< 0-255 >

 

 

octets only.

(See row A in table 9-3, below.)

B: 10.38.252.195

0.0.7.255

Exact match in the first two

 

 

octets and the leftmost five bits

 

 

(248) of the third octet.

10.38.< 248-255 >.< 0-255 >

(In the third octet, only the rightmost three bits are wildcard bits. The leftmost five bits must be a match, and in the ACE, these bits are all set to 1. See row B in table 9-3, below.)

C: 10.38.252.195

0.0.0.0

Exact match in all octets.

10.38.252.195

(There are no wildcard bits in any of the octets. See row C in table 9-3, below.)

D: 10.38.252.195 0.15.255.255 Exact match in the first octet and the leftmost four bits of the second octet.

10.< 32-47 >.< 0-255 >.<0-255>

(In the second octet, the rightmost four bits are wildcard bits. See row D in table 9-3, below.)

9-32