Cisco IOS访问控制列表：实现网络策略的实用指南

需积分: 10 20 浏览量更新于2024-07-17 收藏 1.39MB PDF 举报

《Cisco IOS访问列表》是一本由Jeff Sedayao编著，由O'Reilly出版社于2001年6月首次出版的专业书籍。该书主要关注Cisco IOS中的核心概念——访问列表，这是确保路由器和网络安全的关键工具。作者强调，管理员在实施访问控制或路由策略时，无法离开访问列表。本书的组织结构清晰，共分为七章。第一章介绍网络政策和Cisco访问列表，阐述了政策集的概念，包括其特征以及在网络中的应用，同时概述了政策工具箱，解释了如何通过路由器控制数据包、路由选择和基于路由特性接受和分发路由。第二章深入讲解访问列表基础，包括标准访问列表的格式、掩码的使用以及维护访问列表的方法。此外，还讨论了访问列表的一些技巧和陷阱，如网络掩码与访问列表掩码的区别，以及避免常见错误和减少配置工作量的策略。第三章重点展示如何使用访问列表实施安全策略，涉及控制对路由器资源和主机的访问，以及不同类型的访问列表之间的权衡。这一章还解释了一些协议的工作原理，并探讨了访问列表的替代方案。第四章则关注访问列表在路由控制中的应用，管理员会用它们来保证网络的健壮性并实现业务决策，书中包含众多实际操作示例。第五章是关于调试访问列表，包括如何检查访问列表的正确性以及出现问题后的解决方法。第六章深入讨论更高级的访问列表形式，如社区列表、AS路径访问列表和路由映射，涵盖了策略路由，并以BGP（边界网关协议）中访问列表和路由的使用为例。第七章通过案例研究，展示了不同类型和应用场景下的访问列表组合，包括企业内部网络连接、防火墙和BGP路由实例。附录A提供扩展访问列表的关键词和限定符表格，附录B包括十进制与二进制转换表以及前缀长度与相应的网络掩码、访问列表掩码和有效网络的关系，而附录C列出了常用应用程序端口。这本书的目标读者是对Cisco路由器有一定基础的网络管理员，无论他们是在实施安全策略还是确保网络稳健。对于新手，建议从第一章开始学习，逐步深入。对于需要使用路由映射进行策略路由的网络管理员，应阅读第六章。所有读者都可以将此书作为政策实施、调试和一般性访问列表知识的参考资源。

Cisco IOS Access lists

Page 16

So far, I have focused only on policy sets, so you might be wondering how Cisco access lists

come into the picture. The function of Cisco access lists is to hold the specification of a policy

set. The term "access list" is somewhat deceptive in that it implies only a security function.

Though access lists are indeed used for security functions, they are properly understood as a

general mechanism used by Cisco routers to specify a set of network objects subject to policy.

Access lists are built of access list entries, which directly correspond with policy set entries.

The framework described here is useful because it helps us think about network policies in

ways that are almost directly translatable into Cisco access lists. In future chapters, I will

almost always define network policies in terms of a policy set and a policy imposed upon it.

1.2 The policy toolkit

What do we do with our policy sets once we define them? How can we use those policy sets

to prevent the described scenarios from happening? This section talks about the "policy

toolkit," a set of four "tools" that are general techniques for manipulating policy sets.

As we know, policy sets can be described as the "what" of a policy. The policy tools fit into

our conceptual framework as the "how." Once we define a policy set, we must do something

with it to implement a policy. There are four kinds of tools we can use with policy sets to

implement network policy. These tools control the following:

•

Router resources

• Packets passing through the router

•

Routes accepted and distributed

• Routes based on characteristics of those routes

It may not be obvious why a network administrator would use these tools. To understand this,

think about the functions that a router performs in a network. First, in many ways, a router

functions like a host in that there are certain services it provides—logins, network time,

SNMP MIB data. These are router resources that a network administrator can control.

Secondly, a router's key function is to forward packets from one network interface to another.

Hence the network administrator can do packet filtering, i.e., can control the packets passing

through the router. The last key function of a router is to accept and distribute routing

information. Thus, there must be a way to control routes that are accepted and distributed. The

most common way to do this is with the routes themselves: by filtering routes based on their

network numbers. A second, more complex way to filter routes is to use another characteristic

of the routes, like last hop or some other arbitrary route attribute. It can be argued that all

route filtering is done based on some route characteristic, be it the network number or some

other attribute, but we keep them in separate categories because route filtering based on route

characteristics tends to be much more complex than filtering using network numbers.

Controlling routes based on route properties also tends to use radically different access list

constructs.

For each of the four policy tools, I describe the typical policy set and provide an example of

how the tool is used. I'll come back to these examples in later chapters when I show how to

build and use access lists.

Cisco IOS Access lists

Page 17

1.2.1 Controlling router resources

In the original scenarios, we saw how letting unauthorized people log into a web server

created problems. Similar problems can arise when unauthorized people are allowed to log

into routers. Logins over the Internet can allow the theft of passwords and therefore the

penetration of networks. Problems occur when unqualified people are allowed to make

changes. For these reasons, as well as in a more general sense, network administrators need to

have control over the resources on a router. The main concern here is, of course, security, but

network robustness and business policy also play a large part.

Earlier in this chapter, I mentioned that policy sets are composed of one of three things: host

IP addresses, packets, or network addresses. When we control router resources, the policy set

we use consists of host IP addresses: the IP addresses of systems that can access the resource.

Let's look at a policy that defines which machines can access a certain router, restricting

router logins to the hosts at IP addresses 192.168.30.1 and 192.168.33.5. Figure 1.1 shows

how the network is configured with the router, the two hosts allowed to access it, and other

hosts and networks.

Figure 1.1. A router and hosts that could potentially access it

The first step in defining the access policy is to define the policy set of hosts that can access

the router. We do that as follows:

Policy Set #1: IP address 192.168.30.1

Policy Set #1: IP address 192.168.33.5

Policy Set #1: No other IP addresses

Each of the first two policy set entries adds a specific IP address to the policy set: Policy Set

#1 contains the IP addresses 192.168.30.1 and 192.168.33.5. The third entry explicitly denies

all other IP addresses.

Once the policy set is defined, we apply Policy Set #1 to router logins:

Router logins: Use Policy Set #1

The policy we have just defined says that only hosts with IP addresses 192.168.30.1 and

192.168.33.5 may log into the router.

Cisco IOS Access lists

Page 19

Finally, the policy set is applied to the router interface:

Ethernet interface 0: Apply Policy Set #101 to outgoing packets

The result is that the web server at 192.168.35.1 on interface Ethernet can be accessed only

with web protocols.

1.2.3 Controlling routes accepted and distributed

In a previous scenario, a typographic error by a network administrator at one site causes both

the site's own users and those at a remote site to lose network connectivity. Networks would

function perfectly if routers always distributed routes correctly and with the metrics and

directionality that the network designers intended. But as I said, operator mistakes do happen.

In another scenario, network traffic paths are not optimal to an organization in terms of cost.

Often the desire for traffic between networks to flow in certain paths goes against what would

naturally happen with no intervention. To prevent routing errors from causing problems and

to implement traffic-flow preferences, network implementers use the policy tool called route

filtering. Route-filtering policies specify what routes are accepted into a router and what

routes and routing metric values are distributed from a router. The policy sets used are

composed of network numbers and are applied to routing protocols to indicate what routes are

accepted and distributed from a router or what route metric values those routes should

contain.

The main motivations for using this policy tool are robustness and business policy. A network

administrator wants to make sure that a network operates despite the presence of

configuration mistakes, or a business may decide it wants traffic flowing over some paths

instead of others to make a cost-effective use of bandwidth. Security can also be a motivation

for implementing these policies since one way to attack a network is to inject bad routing

information. Route filtering can effectively stop this attack.

Let's look at a simple but very common application of route filtering. To implement such a

policy, we first need to define what networks we want to accept. We then declare that these

routes are the only routes accepted by a given routing protocol. In this example, we accept

only two routes, 192.168.30.0/24 and 192.168.33.0/24, into an EIGRP routing process 1000.

Figure 1.3 shows this network configuration.

Figure 1.3. A configuration where route acceptance and distribution must be controlled

Cisco IOS Access lists

Page 20

The policy set used with route filtering is composed of network numbers. For this example,

we have the following policy set:

Policy Set #2: Network 192.168.30.0/24

Policy Set #2: Network 192.168.33.0/24

Policy Set #2: No other networks

It contains the two networks we specified and excludes all other networks. We then use this

policy set to express the routes accepted for a given routing process:

Routing process EIGRP 1000 accepts only routes in Policy Set #2

Only routes for networks 192.168.30.0/24 and 192.168.33.0/24 are accepted by EIGRP

routing process 1000. All other routes are excluded, so only traffic for the two networks

included will be permitted through the router.

1.2.4 Controlling routes accepted and distributed based on route characteristics

Networks would be much easier to configure and manage if network numbers were the only

criteria we had for route policies, but there are other criteria for making routing decisions,

including route characteristics. For instance, in a previous scenario, a company connecting to

the Internet wants to prefer all routes coming from a particular Internet service provider. An

ISP may want to route traffic depending on preferences that its customers send along with

their route advertisements. In these cases, policy decisions must be made on some route

characteristic other than just the network number. Like the previous policy tool, the policy

sets themselves are still made up of network numbers, but membership in this type of policy

set is based on route characteristics. Although this kind of access policy is typically

implemented when dealing with Internet connectivity using the BGP-4 routing protocol, it can

be done with interior routing protocols as well. The main motivations for using this technique

are business drivers and robustness, but security (e.g., preventing denial-of-service routing

attacks) can also drive its use.

In the next example, we'll see how to control routing based on the properties of routes. In this

case, we route based on the path that routing information has taken. Organization A has a

policy to never route traffic through Organization B. Figure 1.4 shows how network

connectivity might look in this situation.

剩余226页未读，继续阅读

drjiachen

粉丝: 172
资源: 2138

Cisco IOS访问控制列表：实现网络策略的实用指南

Cisco.IOS.Chinese.Mar.eBook

SANS AUD 507 IOS IPv4 Access Lists.pdf

Cisco IOS Programing Guide.pdf

cisco3560基本命令.pdf

Cisco路由器的RAS的配置.pdf

Cisco IOS 所有命令

CISCO路由器如何实现用户对网络的定时访问.pdf

Cisco IOS 基本命令集

动态ACL.pdf

Cisco Packet_Tracer_5.0_使用手册

最新资源