Filter staff and guest traffic at a branch router with extended ACLs

Tasks

1. Write a named extended ACL GUEST-IN that implements the guest policy and only accepts guest source addresses.
2. Write a named extended ACL STAFF-IN that implements the staff policy and logs denied attempts to the servers.
3. Apply both inbound on the right subinterfaces of R1.
4. Restrict the VTY lines of R1 to SSH from the management subnet and the IT admin PC.
5. Prove each rule with a test and the ACL counters.

Solution

1. 1Guest ACLR1

   ip access-list extended GUEST-IN
    remark DHCP from clients that have no address yet
    10 permit udp any eq bootpc any eq bootps
    remark DNS to the HQ resolver only
    20 permit udp 10.1.30.0 0.0.0.255 host 10.2.50.53 eq domain
    30 permit tcp 10.1.30.0 0.0.0.255 host 10.2.50.53 eq domain
    remark No private address space, including this router
    40 deny ip any 10.0.0.0 0.255.255.255 log
    50 deny ip any 172.16.0.0 0.15.255.255
    60 deny ip any 192.168.0.0 0.0.255.255
    remark Internet, from real guest addresses only
    70 permit ip 10.1.30.0 0.0.0.255 any

   Line 10 comes first because a DHCP DISCOVER has source 0.0.0.0, which no subnet line matches. Line 70 names the guest subnet instead of any, so spoofed sources fall into the implicit deny.

2. 2Staff ACLR1

   ip access-list extended STAFF-IN
    10 permit udp any eq bootpc any eq bootps
    20 permit tcp 10.1.20.0 0.0.0.255 10.2.50.0 0.0.0.255 eq 443
    30 permit udp 10.1.20.0 0.0.0.255 host 10.2.50.53 eq domain
    40 permit tcp 10.1.20.0 0.0.0.255 host 10.2.50.53 eq domain
    50 permit tcp host 10.1.20.5 10.2.50.0 0.0.0.255 eq 22
    60 deny ip 10.1.20.0 0.0.0.255 10.2.50.0 0.0.0.255 log
    70 permit ip 10.1.20.0 0.0.0.255 any

   Order matters: the specific permits for the server subnet sit above the deny for the same subnet. Line 60 also blocks ping from staff to the servers, which matches the policy as written.

3. 3Apply the ACLs near the sourceR1

   interface GigabitEthernet0/0/0.20
    ip access-group STAFF-IN in
   interface GigabitEthernet0/0/0.30
    ip access-group GUEST-IN in

   Inbound on the user-facing subinterfaces: unwanted traffic is dropped before it reaches the WAN, and the WAN interface with its OSPF adjacency is never touched. Return traffic toward the users leaves these subinterfaces outbound and is not filtered.

4. 4VTY access with a standard ACLR1

   ip access-list standard VTY-MGMT
    10 permit 10.99.0.0 0.0.0.255
    20 permit host 10.1.20.5
    30 deny any log
   !
   line vty 0 15
    access-class VTY-MGMT in
    transport input ssh

   On VTY lines only the source matters, so a standard ACL is the right tool. If management runs in a VRF, add vrf-also to the access-class.

Verify

GUEST1# ping -c 2 10.2.50.10
PING 10.2.50.10 (10.2.50.10) 56(84) bytes of data.
From 10.1.30.1 icmp_seq=1 Packet filtered
From 10.1.30.1 icmp_seq=2 Packet filtered

--- 10.2.50.10 ping statistics ---
2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1001ms

STAFF1# ssh admin@10.2.50.10
ssh: connect to host 10.2.50.10 port 22: No route to host

R1# show logging | include IPACCESSLOG
%SEC-6-IPACCESSLOGP: list STAFF-IN denied tcp 10.1.20.30(50522) -> 10.2.50.10(22), 1 packet

R1# show ip access-lists GUEST-IN
Extended IP access list GUEST-IN
    10 permit udp any eq bootpc any eq bootps (14 matches)
    20 permit udp 10.1.30.0 0.0.0.255 host 10.2.50.53 eq domain (312 matches)
    30 permit tcp 10.1.30.0 0.0.0.255 host 10.2.50.53 eq domain
    40 deny ip any 10.0.0.0 0.255.255.255 log (2 matches)
    50 deny ip any 172.16.0.0 0.15.255.255
    60 deny ip any 192.168.0.0 0.0.255.255
    70 permit ip 10.1.30.0 0.0.0.255 any (5820 matches)

R1# show ip interface GigabitEthernet0/0/0.30 | include access list
  Outgoing Common access list is not set
  Outgoing access list is not set
  Inbound Common access list is not set
  Inbound  access list is GUEST-IN

Mistakes people make

• Forgetting the DHCP line. Clients without an address send from 0.0.0.0, which no subnet permit matches, so nobody gets a lease.
• Applying the ACL outbound on the subinterface. That filters traffic going to the users, the opposite of the intent.
• Forgetting that an inbound ACL also filters traffic to the router itself, such as pings to the gateway and SSH to R1.
• Ending the guest ACL with permit ip any any, which also lets spoofed source addresses out.
• Editing a live ACL by deleting and retyping it. Use sequence numbers to insert or remove single lines.

On other platforms

set firewall family inet filter GUEST-IN term dhcp from protocol udp
set firewall family inet filter GUEST-IN term dhcp from source-port 68
set firewall family inet filter GUEST-IN term dhcp from destination-port 67
set firewall family inet filter GUEST-IN term dhcp then accept
set firewall family inet filter GUEST-IN term dns from destination-address 10.2.50.53/32
set firewall family inet filter GUEST-IN term dns from protocol [ udp tcp ]
set firewall family inet filter GUEST-IN term dns from destination-port 53
set firewall family inet filter GUEST-IN term dns then accept
set firewall family inet filter GUEST-IN term private from destination-address 10.0.0.0/8
set firewall family inet filter GUEST-IN term private from destination-address 172.16.0.0/12
set firewall family inet filter GUEST-IN term private from destination-address 192.168.0.0/16
set firewall family inet filter GUEST-IN term private then discard
set firewall family inet filter GUEST-IN term internet from source-address 10.1.30.0/24
set firewall family inet filter GUEST-IN term internet then accept
set interfaces ge-0/0/0 unit 30 family inet filter input GUEST-IN