-: Access control lists. 2 2
In this lesson, 3 3
we're going to discuss how we can best secure our network 4 4
using access control lists, firewall rule-sets, 5 5
and how to configure role-based access. 6 6
Now, an access control list, or ACL, 7 7
is a list of permissions associated 8 8
with a given system or network resource. 9 9
An ACL can be applied to any packet filtering device, 10 10
such as a router, a layer 3 switch, or a firewall. 11 11
In an ACL, you're going to have a list of rules 12 12
that are being applied based on an IP address, 13 13
a port, or an application, 14 14
depending on the type of device 15 15
you're applying this ACL onto. 16 16
Now, as the access control list 17 17
is being processed by the device, 18 18
it's going to start at the top of the list 19 19
and work through each line 20 20
until it reaches the end of that list. 21 21
So we're going to work from top to bottom. 22 22
Therefore, you always want to make sure 23 23
your most specific rules are at the top, 24 24
and your most generic rules are at the bottom. 25 25
For example, let's pretend I had an access control list. 26 26
as I'm working as a bouncer at a nightclub. 27 27
Now, at the top of the list, 28 28
I might have something very specific, 29 29
like somebody's name, John Smith. 30 30
He came in last week and he caused all sorts of trouble. 31 31
So John Smith cannot come in the club. 32 32
Now, as I move down the list, 33 33
I may get to something more generic. 34 34
So I might get to something that says anybody 35 35
whose driver's license says they live in Montana, 36 36
because I'm running a club in Florida. 37 37
If that was the case, 38 38
I might want to block that 39 39
because maybe we had a lot of people 40 40
coming with fake ideas from Montana, 41 41
so we're not going to accept those anymore. 42 42
Now, as we get to the end of that list, 43 43
we might see something very generic. 44 44
Something like no men allowed. 45 45
Maybe this is a woman's only club. 46 46
Now, this is a pretty generic rule, right? 47 47
Because half of the people on the planet are men. 48 48
So this is a very generic way of saying things. 49 49
So as we go from the top to the bottom, 50 50
we go from very specific, to more general, 51 51
to the most general. 52 52
Now, the same thing happens in our networks. 53 53
If I'm going to create a rule to block SSH 54 54
for a single computer based on its IP address, 55 55
that's going to be towards the top of my list. 56 56
If I want to block any IP address that's using port 110, 57 57
that's going to be a bit more generic. 58 58
So it'll be somewhere in the middle. 59 59
Finally, if I want to block any IP going to any port, 60 60
that is going to be something that is really generic, 61 61
and it should be at the end of my list. 62 62
So let's talk about some things 63 63
that we may want to block using our ACLs 64 64
in order to help secure our networks better. 65 65
Now, first we want to make sure 66 66
we're blocking incoming requests 67 67
from internal or private loop back addresses, 68 68
or multicast IP ranges, or experimental ranges, 69 69
if we have something that's coming from outside 70 70
of the network going into our network. 71 71
So if you have something that says 72 72
it's coming from 192.168 dot something, dot something, 73 73
and it's coming from the internet interface, 74 74
well, that's a non-routable IP, 75 75
and it shouldn't be coming from there. 76 76
So you should be blocking that. 77 77
That should never be allowed 78 78
to come into your network from the internet, 79 79
because usually it's an attacker trying to spoof their IP. 80 80
Similarly, 81 81
if you start seeing source IP addresses 82 82
coming from areas that are reserved for things 83 83
like loop back or experimental IP ranges, 84 84
those things should also be blocked immediately. 85 85
Second, 86 86
you want to block incoming requests 87 87
from protocols that should only be used locally. 88 88
For example, 89 89
if you have ICMP, DHCP, OSPF, SMB, 90 90
and other things like that, 91 91
you want to block those at the firewall 92 92
as things try to enter your network. 93 93
Now, if you have something like Windows file sharing, 94 94
for instance, which operates over SMB, 95 95
that should not be happening over the internet. 96 96
That is something that should happen 97 97
inside the local network only. 98 98
So again, 99 99
you should be blocking that at the firewall 100 100
at the border of your network. 101 101
If somebody has a VPN and they're working from home, 102 102
they'll be able to tunnel through your firewall, 103 103
access the local network, 104 104
and then use SMB that way. 105 105
But they shouldn't be using it straight from their home 106 106
over the internet to your network. 107 107
They should only do it through a VPN. 108 108
Now, the third thing you want to consider 109 109
is how you want to configure IPv6. 110 110
Now, I recommend you either 111 111
configure IPv6 to block all IPv6 traffic, 112 112
or you allow it only to authorize hosts and ports 113 113
if you're using IPv6 in your network. 114 114
The reason for this is because a lot of hosts 115 115
will run dual stack TCP/IP implementations 116 116
with IPv6 enabled by default. 117 117
And if you're not aware of that, 118 118
you're going to be having a lot of these things open, 119 119
and you're letting people have 120 120
unfettered access to your network. 121 121
A lot of organizations are still running IPv4 only, 122 122
and if they're doing that, 123 123
they definitely need to turn off IPv6 on those hosts, 124 124
and they need to configure their firewall to block it. 125 125
If you don't do this, 126 126
you could have a misconfiguration 127 127
that could allow adversaries unfiltered access 128 128
into your networks by using that IPv6 IP address area, 129 129
because a lot of administrators 130 130
simply haven't locked down IPv6 well enough yet. 131 131
So keep this in mind as you're doing 132 132
your configurations on your firewalls 133 133
and your access control lists. 134 134
All right. 135 135
Now that we have some basic rules out of the way, 136 136
let's take a look at an access control list, 137 137
and walk through it together. 138 138
Now, this one is an example from a Cisco firewall, 139 139
but that really doesn't matter for this exam, 140 140
because when we're talking about CompTIA exams, 141 141
they are device agnostic. 142 142
This could've come from a router. 143 143
It could've come from a firewall. 144 144
It could've come from Cisco, or Juniper, or Brocade. 145 145
It really doesn't matter. 146 146
The point is I want you be able to read 147 147
a basic firewall like this and understand it, 148 148
because that will make sure you're doing well on the exam. 149 149
So let's start out with the first line. 150 150
ip access-list extended From-DMZ. 151 151
This just says that this is an access list. 152 152
And in this case, I'm using it for my DMZ. 153 153
The second line is a comment or remark line. 154 154
This is going to tell you what this section is about. 155 155
Basically, it's saying that we're 156 156
going to have responses to HTTP requests, 157 157
and that we're going to get a bunch of permit statements here. 158 158
Now, as we go through these permit statements, 159 159
we're going to look at them one at a time, 160 160
and it's going to tell us which things 161 161
are being permitted or denied. 162 162
Now, when we see the word permit, 163 163
that means we're going to allow something, 164 164
and in this case, 165 165
we're going to allow TCP traffic. 166 166
So we have permit tcp, 167 167
and then we have the IP address 168 168
that's going to be associated with it. 169 169
In this case, we're going to permit TCP traffic 170 170
coming from the IP address 10.0.2.0. 171 171
The next thing we have is going to be our wildcard mask, 172 172
which acts like a subnet mask. 173 173
Now, this looks a little funny 174 174
because it's a wildcard mask 175 175
and it's technically a reverse wild card, 176 176
and it's written as 0.0.0.255. 177 177
So if you want to read this as a subnet mask, 178 178
you actually have to convert it. 179 179
And essentially you're going to make it 255.255.255.0. 180 180
This is a Cisco thing. 181 181
When you see the zero in the reverse wildcard, 182 182
treat that as a 255. 183 183
If you see a 255, treat it as a zero. 184 184
Don't let this get you confused. 185 185
Essentially what we're saying here 186 186
is that we're permitting TCP traffic 187 187
from any IP that is 10.0.2 dot something, 188 188
because this is the 10.0.2.0 network, 189 189
and it has 256 possible IPs that we're going to use here. 190 190
Anything in this IP range will be permitted under this rule. 191 191
The next part you see is eq, which stands for equal. 192 192
So the IP address has whatever is beyond this equal sign, 193 193
and that's going to be allowed. 194 194
In this case, we're equaling www. 195 195
Now, what does that mean? 196 196
It means port 80. 197 197
Www is Cisco's way of saying this is web traffic. 198 198
Somebody can make a request over port 80, 199 199
and we're going to allow it. 200 200
Next we have the part that says any, 201 201
and this says that we're going to be going 202 202
to any IP address as our destination. 203 203
So we can go to any web server in the world over port 80, 204 204
and we're going to allow it. 205 205
This will allow us to make an established connection there, 206 206
and then start traffic. 207 207
So any time we want to make an established connection 208 208
from 10.0.2 dot something to some website over port 80, 209 209
we're going to allow that using TCP. 210 210
Essentially that's what we're saying. 211 211
People can go out and access a website 212 212
from our DMZ out to the internet, 213 213
and this is all we're saying with this particular line. 214 214
Now, as you go through 215 215
and you read all these different lines in the ACL, 216 216
you can start figuring out 217 217
what is permitted and what is denied. 218 218
In this case, everything shown here is permitted 219 219
because we're doing explicit allow permissions. 220 220
What we're saying is yes, 221 221
all of these things are allowed. 222 222
Permit them from this IP and this port 223 223
going to that IP and that port. 224 224
But as we go through to the bottom of this list, 225 225
you'll see one statement that looks a little different. 226 226
It says deny IP any any. 227 227
Now, this is what's known as an implicit deny. 228 228
This says that anything 229 229
that is not already allowed above in my ACO rule-set 230 230
is something we're just going to deny by default. 231 231
So if we get down this list 232 232
and you see things like www, 443, echo reply, domain, 233 233
these are all things that we're allowing. 234 234
And then when I talk about domain here, 235 235
I'm not really talking about domain in general, 236 236
but we're talking about DNS as a service, 237 237
because this is the way Cisco talks about DNS services. 238 238
When they say domain, 239 239
we are really talking about equaling port 53. 240 240
So in this case, 241 241
everything you see listed here 242 242
is all these different permit statements 243 243
that are going to allow traffic from our DMZ to the internet. 244 244
The DMZ can go out 245 245
and get web traffic over port 80 or port 443. 246 246
It can reply to echo requests, which is ICMP. 247 247
It can use port 53, which is domain, over UDP and TCP. 248 248
These are all things 249 249
that we're going to be allowed to do from this DMZ. 250 250
But when I get down to that last statement, 251 251
if any of those things didn't happen, 252 252
we are going to deny it. 253 253
So for example, 254 254
if somebody tries to go to port 21 and access FTP, 255 255
we're going to reach that deny IP any any statement, 256 256
and it's going to be blocked. 257 257
This is because that statement 258 258
will deny any IP going from any IP to any IP. 259 259
Essentially, this ACL is configured as a white list. 260 260
It's only going to allow things 261 261
that are being permitted explicitly listed in this list, 262 262
and everything else is going to be blocked. 263 263
This is a good way of doing your security. 264 264
Now, we just mentioned the concept of explicit allow, 265 265
but we can also have firewall rules 266 266
that will use explicit deny or implicit deny. 267 267
Now, when you have an explicit deny statement, 268 268
you're creating a rule to block 269 269
some kind of matching traffic. 270 270
In this example I showed you, 271 271
we didn't have any explicit deny statements, 272 272
but they would look exactly the same 273 273
as our permit statements, 274 274
except we would change the word permit to deny. 275 275
Now, this allows us to go 276 276
from an explicit allow to an explicit deny. 277 277
So let's say I wanted to block traffic 278 278
going to the IP address of 8.8.8.8. 279 279
I could create a rule that says 280 280
deny IP 8.8.8.8 0.0.0.0 any any. 281 281
And it's going to block all ports 282 282
and all protocols going to the IP address of 8.8.8.8. 283 283
Now, notice my reverse card mask there was 0.0.0.0, 284 284
which tells me I only want to match this IP. 285 285
Not a whole network, just the IP of 8.8.8.8. 286 286
On the other hand, I can also use an implicit deny, 287 287
which blocks traffic to anything not explicitly specified. 288 288
In the example ACL I showed you, 289 289
that last statement had that implicit deny. 290 290
Basically anything not already explicitly allowed 291 291
by an allow statement is going to get blocked 292 292
because we had that deny IP any any statement 293 293
as the last statement at the end of our ACL. 294 294
Finally, we need to talk about role-based access. 295 295
Role-based access allows you to define the privileges 296 296
and responsibilities of administrative users 297 297
who control your firewalls and their ACL's. 298 298
With role-based access, 299 299
we put different accounts into groups 300 300
based on their roles or job functions. 301 301
Then based on those roles, 302 302
we're going to assign permissions 303 303
to which devices they can configure and modify. 304 304
So for example, 305 305
if I'm responsible for updating 306 306
and configuring the border gateway 307 307
or firewall for the network, 308 308
I would get access to add things to the ACL 309 309
that would open or restrict communication 310 310
between the internet and the internal network. 311 311
On the other hand, 312 312
if I'm just a switch technician 313 313
who's responsible for adding and removing users 314 314
when they're assigned to a new office, 315 315
my role would not allow me 316 316
to modify a layer 3 switch's ACLs, 317 317
but instead would only allow me 318 318
to shut down or reenable switchports 319 319
and configure port security.