Inalp Networks SmartWare Release 2.10, Software Configuration Manual

Page: 161 / 357

Access Control List Configuration 161
Figure 19-1: Using Traffic Filters to Prevent Traffic From Being Routed to a Network
You can also use access lists to decide which types of traffic are forwarded or blocked at the router
interfaces. For example, you can permit e-mail traffic to be routed but at the same time block all
Telnet traffic.
19.1.3 When to Configure Access Lists
Access lists should be used in “firewall” routers, which are often positioned between your internal
network and an external network such as the Internet. You can also use access lists on a router
positioned between two parts of your network, to control traffic entering or exiting a specific part of
your internal network.
To provide the security benefits of access lists, you should configure access lists at least on border
routers, i.e. those routers situated at the edges of your networks. This provides a basic buffer from
the outside network or from a less controlled area of your own network into a more sensitive area of
your network.
On these routers, you should configure access lists for each network protocol configured on the
router interfaces. You can configure access lists so that inbound traffic or outbound traffic or both are
filtered on an interface.
19.1.4 Features of Access Control Lists
The following features apply to all IP access control lists:
•
A list may contain multiple entries. The order access of control list entries is significant. Each
entry is processed in the order it appears in the configuration file. As soon as an entry
matches, the corresponding action is taken and no further processing takes place.
•
All access control lists have an implicit “deny ip any any” at the end. A packet that does not
match the criteria of the first statement is subjected to the criteria of the second statement
and so on until the end of the access control list is reached, at which point the packet is
dropped.
•
Filter types include IP, Internet Control Message Protocol (ICMP), Transmission Control
Protocol (TCP), User Datagram Protocol (UDP), and Stream Control Transmission Protocol
(SCTP).
Software Configuration Guide Release 2.10, Revision 1.00