Routers with Layer 34 Stateless ACLs
Table 4-14 shows the summary information for routers with Layer 3/4 stateless ACLs.
|
Name |
Router with Layer 3/4 stateless ACLs |
|
Common example |
Cisco IOS Router |
|
Attack elements detected |
Network flooding |
|
Attack elements prevented |
Direct access Network manipulation IP spoofing IP redirect |
|
Difficulty in attacker bypass |
2 |
|
Ease of network implementation |
2 |
|
User impact |
3 |
|
Application transparency |
2 |
|
Maturity of technology |
5 |
|
Ease of management |
3 |
|
Performance |
3 |
|
Scalability |
3 |
|
Financial affordability |
5 |
|
Overall value of technology |
80 |
Routers with basic stateless ACLs are workhorses in network security. They deserve the name firewall just as much as a stateful appliance firewall does, even though they might lack certain features.
Basic ACLs, shown throughout this book, allow an administrator to control the flow of traffic at either L3, L4, or both. An ACL to permit only network 10.1.1.0/24 to Secure Shell (SSH) (TCP 22) to host 10.2.3.4 looks like this:
access-list 101 permit tcp 10.1.1.0 0.0.0.255 host 10.2.3.4 eq 22
Because the ACL is stateless, the following ACL is needed in the opposite direction to be as restrictive as possible:
access-list 102 permit tcp host 10.2.3.4 eq 22 10.1.1.0 0.0.0.255 established
Because the ACL is stateless, the router has no idea whether a persistent SSH session is in place. This leads to the principal limitation of basic ACLs: all a stateless ACL knows is to match incoming traffic against the ACLs applied to an interface. For example, even if there were no SSH session to 10.2.3.4 from network 10.1.1.0/24, host 10.2.3.4 could send traffic to the 10.1.1.0/24 network provided the source port is 22. The established flag on the ACL adds an additional requirement that the acknowledgment (ACK) or reset (RST) bit is set in the TCP header.
The ACLs on a router aren't the only security-related features available. A network manipulation attack is prevented by hardening the router (for example, using no ip source-route). IP redirection can be prevented with the proper authentication of your routing traffic.
Continue reading here: Content Filtering Summary
Was this article helpful?