ACL Operation

ACLs express the set of rules that give added control for packets that enter inbound interfaces, packets that relay through the router, and packets that exit outbound interfaces of the router. ACLs do not act on packets that originate from the router. Instead, ACLs are statements that specify conditions of how the router handles the traffic flow through specified interfaces.

ACLs operate in two ways:

■ Inbound ACLs: Incoming packets are processed before they are routed to an outbound interface. An inbound ACL is efficient because it saves the overhead of routing lookups if the packet will be discarded after it is denied by the filtering tests. If the packet is permitted by the tests, it is processed for routing.

■ Outbound ACLs: Incoming packets are routed to the outbound interface and then processed through the outbound ACL.

Figure 6-4 shows an example of an outbound ACL.

Figure 6-4 Outbound ACL Operation

Figure 6-4 Outbound ACL Operation

When a packet enters an interface, the router checks the routing table to see if the packet is routable. If the packet is not routable, it is dropped.

Next, the router checks to see whether the destination interface is grouped to an ACL. If the destination interface is not grouped to an ACL, the packet can be sent to the output buffer. Examples of outbound ACL operations are as follows:

■ If the outbound interface is S0, which has not been grouped to an outbound ACL, the packet is sent to SO directly.

■ If the outbound interface is S1, which has been grouped to an outbound ACL, the packet is not sent out on S1 until it is tested by the combination of ACL statements that are associated with that interface. Based on the ACL tests, the packet is permitted or denied.

For outbound lists, "to permit" means to send the packet to the output buffer, and "to deny" means to discard the packet.

With an inbound ACL, when a packet enters an interface, the router checks to see whether the source interface is grouped to an ACL. If the source interface is not grouped to an ACL, the router checks the routing table to see if the packet is routable. If the packet is not routable, the router drops the packet. Examples of inbound ACL operations are as follows:

■ If the inbound interface is S0, which has not been grouped to an inbound ACL, the packet is processed normally, and the router checks to see whether the packet is routable.

■ If the inbound interface is S1, which has been grouped to an inbound ACL, the packet is not processed, and the routing table is not consulted until it is tested by the combination of ACL statements that are associated with that interface. Based on the ACL tests, the packet is permitted or denied.

For inbound lists, "to permit" means to continue to process the packet after receiving it on an inbound interface, and "to deny" means to discard the packet.

ACL statements operate in sequential, logical order. They evaluate packets from the top down, one statement at a time. If a packet header and an ACL statement match, the rest of the statements in the list are skipped, and the packet is permitted or denied as determined by the matched statement. If a packet header does not match an ACL statement, the packet is tested against the next statement in the list. This matching process continues until the end of the list is reached. Figure 6-5 shows the logical flow of statement evaluation.

Figure 6-5 ACL Evaluation

A final implied statement covers all packets for which conditions did not test true. This final test condition matches all other packets and results in a "deny" instruction. Instead of proceeding into or out of an interface, the router drops all of these remaining packets. This final statement is often referred to as the "implicit deny any statement." Because of this statement, an ACL should have at least one permit statement in it; otherwise, the ACL blocks all traffic. This implicit deny all will not show up in the router configuration. In many of the examples in this text, it will be added as a reminder.

You can apply an ACL to multiple interfaces. However, only one ACL can exist per protocol, per direction, and per interface.

Continue reading here: ACL Identification

Was this article helpful?

+2 -2