ACL with IP, TCP, UDP, ICMP and others
workfrom925
Member Posts: 196
in CCNA & CCENT
I'm studying ACL. A common example that I read is to block www access (TCP), or TFTP (UDP), or Ping (ICMP), or all of them, then allow everything else with a "permit IP any any". Does this mean TCP, UDP, ICMP are just part of IP?
The chapter did not get too deep into it, so I'm wondering what specific protocol to block for email? FTP? Telnet? and SSH?
Does "deny IP any any" deny email, ftp, telnet, and ssh too?
The chapter did not get too deep into it, so I'm wondering what specific protocol to block for email? FTP? Telnet? and SSH?
Does "deny IP any any" deny email, ftp, telnet, and ssh too?
Comments
-
Zartanasaurus Member Posts: 2,008 ■■■■■■■■■□IP is capable of carrying multiple protocols. The IP Protocol field is used to identify the exact protocol IP is encapsulating.
IP Protocol 1 = ICMP
IP Protocol 6 = TCP
IP Protocol 17 = TCP
So generically, IP can be "any of the above". Or it can specifically be protocol 6, or protocol 17 or one of dozens of other protocols.
So if you say "deny IP any any" what do you think is the result?
TCP/UDP does the same thing, but with port numbers.
TCP port 22 = SSH
TCP port 23 = telnet
UDP port 69 = TFTP
So you can very specifically deny SSH with TCP port 22 or specifically permit DNS with UDP port 53 (you should do TCP port 53 too, but let's not get into that). There's technically thousands of TCP/UDP ports.
So if you say "deny tcp any any" what do you think is the result?
And if you want to get really involved, ICMP is similar. It has protocol types and codes that identify specific ICMP messages. Type 8 = echo, Type 0 = reply. So you can deny all ICMP, or just certain types of ICMP.
So... does deny ip any any deny email, ftp, telnet and ssh too?
Before going into ACLs, you have to understand the component parts:
IP addressing & subnetting
TCP/UDP communicationCurrently reading:
IPSec VPN Design 44%
Mastering VMWare vSphere 5 42.8% -
DCD Member Posts: 475 ■■■■□□□□□□What book are you using?workfrom925 wrote: »The chapter did not get too deep into it, so I'm wondering what specific protocol to block for email? FTP? Telnet? and SSH?
Does "deny IP any any" deny email, ftp, telnet, and ssh too?
You really should re-study your protocols and port numbers. -
smcclenaghan Member Posts: 139Yes, "deny ip any any" will block email (smtp tcp/25), ftp (tcp/20 & tcp/21) telnet (tcp/23) and ssh (tcp/22) are all part of TCP which is part of IP.
TCP is the stateful, connection-oriented protocol of IP.
UDP is the stateless, connectionless protocol of IP.
ICMP is for diagnostics (still part of IP).
If you plan to take the ICND1 or ICND2 (or CCNA) you'll need to know the above, but possibly you're studying for a different test and were just asking about ACLs because CCNA covers them too? -
workfrom925 Member Posts: 196From the TCP/UDP port list:
20
TCP
UDP
FTP data transfer
Official
21
TCP
FTP control (command)
Official
22
TCP
UDP
Secure Shell (SSH) — used for secure logins, file transfers (scp, sftp) and port forwarding
Official
23
TCP
UDP
Telnet protocol—unencrypted text communications
Official
24
TCP
UDP
Priv-mail : any private mail system.
Official
25
TCP
Simple Mail Transfer Protocol (SMTP)—used for e-mail routing between mail servers
Official
For me to block FTP access, do I have to block both port 20 and port 21? What if I just block one of the ports? -
workfrom925 Member Posts: 196smcclenaghan wrote: »If you plan to take the ICND1 or ICND2 (or CCNA) you'll need to know the above, but possibly you're studying for a different test and were just asking about ACLs because CCNA covers them too?
Thanks for your answer. I'm going for CCNA:) -
Zartanasaurus Member Posts: 2,008 ■■■■■■■■■□Man, I don't even know if I want to introduce you to FTP since that one is a little more complicated, but it's important to know.
FTP Active Mode
The original way of doing FTP before the days of stateful firewalls.
Client initiates control connection to server on TCP port 21.
Connection completes.
Server initiates data connection to client on TCP port 20.
C ---- TCP 21 ---- > S
C <--- TCP 20
S
Now these days you can't do that because of all the stateful firewalls.
FTP Passive Mode
Generally the way things are done now.
Client initiates control connection to server on TCP port 21.
Connection completes.
Server tells Client to initiate a data connection on a 2nd TCP port.
Client initiations data connection to server on the specified TCP port.
C ---- TCP 21
> S
C
TCP XXX ----> S
The 2nd TCP port is generally configured as a range on the server and since the range is known, you can allow those incoming TCP ports on the firewall.
Things get really complicated when you start doing implicit|explicit mode FTPS. My recommendations is to do SFTP since it's much simpler and only one port.Currently reading:
IPSec VPN Design 44%
Mastering VMWare vSphere 5 42.8% -
xXErebuS Member Posts: 230Zartanasaurus wrote: »Man, I don't even know if I want to introduce you to FTP since that one is a little more complicated, but it's important to know.
FTP Active Mode
The original way of doing FTP before the days of stateful firewalls.
Client initiates control connection to server on TCP port 21.
Connection completes.
Server initiates data connection to client on TCP port 20.
C ---- TCP 21 ---- > S
C <--- TCP 20
S
Now these, days you can't do that because of all the stateful firewalls.
FTP Passive Mode
Generally the way things are done now.
Client initiates control connection to server on TCP port 21.
Connection completes.
Server tells Client to initiate a data connection on a 2nd TCP port.
Client initiations data connection to server on the specified TCP port.
C ---- TCP 21
> S
C
TCP XXX ----> S
The 2nd TCP port is generally configured as a range on the server and since the range is known, you can allow those incoming TCP ports on the firewall.
Things get really complicated when you start doing implicit|explicit mode FTPS. My recommendations is to do SFTP since it's much simpler and only one port.
ALG's in FW's now also allow for FTP Active mode behind the scenes so that is also confusing lol.....