Cabletron Systems SmartSwitch 8-slot, Руководство пользователя

Страница: 135 / 150

Chapter 9: Security Configuration Guide
SSR User Reference Manual 9 - 11
When a TCP packet comes from subnet 10.2.0.0/16, it finds a match with the first rule.
This causes the packet to be dropped. A TCP packet coming from other subnets will
not match the first rule. Instead, it matches the second rule which allows the packet to
go through.
If you were to reverse the order of the two rules:
acl 101 permit tcp any any any any
acl 101 deny tcp 10.2.0.0/16 any any any
then all TCP packets will be allowed to go through, including traffic from subnet
10.2.0.0/16. This is because TCP traffic coming from 10.2.0.0/16 will match the first
rule and be allowed to go. The second rule will not looked at since the first match
determines the action on the packet.
Implicit Deny Rule
At the end of each ACL, the system automatically appends an implicit deny rule. This
implicit deny rule denies all traffic. For a packet that doesn't match any of the user
specified rules, the implicit deny rule acts as a catch all rule. All packets match
correctly with this rule. The default behavior for a packet that doesn't match any rules
in an ACL can be either to permit or to deny. The SSR chooses to deny a packet as the
default behavior. This is done for security reasons. If an ACL is misconfigured and a
packet that should be allowed to go through is now blocked because of the implicit
deny rule, the worse that could happen is inconvenience. On the other hand, if a packet
that should not be allowed to go through is instead sent through, there is now a security
breach. Basically, the implicit deny rule is the last line of defense against accidental
mis-configuration of ACLs that could result in a security breach.
To describe how the implicit deny rule is used, considering the following example.
Suppose someone created the following ACL:
acl 101 permit ip 1.2.3.4/24
acl 101 permit ip 4.3.2.1/24 any nntp
With the implicit deny rule, this ACL actually has three rules:
acl 101 permit ip 1.2.3.4/24 any any any
acl 101 permit ip 4.3.2.1/24 any nntp any
acl 101 deny any any any any any
If a packet comes in and doesn't match the first two rules, the packet will be dropped.
This is because the third rule (implicit deny) will match all packets.