Restricting virtual terminal access

Restricting virtual terminal access 

 11.2.6

This page will explain how ACLs are created for virtual ports.

Standard and extended access lists apply to packets that travel through a router. They are not designed to block packets that originate within the router. An outbound Telnet extended access list does not prevent router initiated Telnet sessions, by default.

Just as there are physical ports or interfaces, such as Fa0/0 and S0/0 on the router, there are also virtual ports. These virtual ports are called vty lines. There are five vty lines, which are numbered 0 through 4, as shown in Figure . For security purposes, users can be denied or permitted virtual terminal access to the router but denied access to destinations from that router.

The purpose of restricted vty access is increased network security. The Telnet protocol can also be used to create a nonphysical vty connection to the router. There is only one type of vty access list. Identical restrictions should be placed on all vty lines since it is not possible to control the line on which a user will connect.

The process to create the vty access list is the same as described for an interface. However, applying the ACL to a terminal line requires the access-class command instead of the access-group command.

The following should be considered when configuring access lists on vty lines:

• A name or number can be used to control access to an interface.
• Only numbered access lists can be applied to virtual lines.
• Identical restrictions should be set on all the virtual terminal lines, because a user can attempt to connect to any of them.

In the second Lab Activity, students will use ACLs to control IP traffic.

This page concludes this lesson. The next page will summarize the main points from this module.

Firewalls

Firewall

11.2.5 A firewall is an architectural structure that exists between the user and the outside world to protect the internal network from intruders. In most circumstances, intruders come from the global Internet and the thousands of remote networks that it interconnects. Typically, a network firewall consists of several different machines that work together to prevent unwanted and illegal access.

In this architecture, the router that is connected to the Internet, referred to as the exterior router, forces all incoming traffic to go to the application gateway. The router that is connected to the internal network, the interior router, accepts packets only from the application gateway. The gateway controls the delivery of network-based services both into and from the internal network. For example, only certain users might be allowed to communicate with the Internet, or only certain applications might be permitted to establish connections between an interior and exterior host. If the only application that is permitted is e-mail, then only e-mail packets should be allowed through the router. This protects the application gateway and avoids overwhelming it with packets that it would otherwise discard.

ACLs should be used in firewall routers, which are often positioned between the internal network and an external network, such as the Internet. This allows control of traffic entering or exiting a specific part of the internal network. The firewall router provides a point of isolation so that the rest of the internal network structure is not affected.

A configuration of ACLs on border routers, which are routers situated on the boundaries of the network, is necessary to provide security benefits. This provides basic security from the outside network, or from a less controlled area of the network, into a more private area of the network. On these border routers, ACLs can be created for each network protocol configured on the router interfaces.

The next page will describe virtual ports.

Placing ACLs

Placing ACLs

11.2.4 The placement of ACLs is an important consideration.
Proper ACL placement will filter traffic and make the network more efficient. The ACL should be placed where it has the greatest impact on efficiency.
In Figure the administrator wants to deny Telnet or FTP traffic from the Router A Ethernet LAN segment to the switched Ethernet LAN Fa0/1 on Router D. At the same time, other traffic must be permitted. There are several ways to do this. The recommended solution is an extended ACL that specifies both source and destination addresses. Place this extended ACL in Router A. Then, packets do not cross the Router A Ethernet segment or the serial interfaces of Routers B and C, and do not enter Router D. Traffic with different source and destination addresses will still be permitted.
The general rule is to put the extended ACLs as close as possible to the source of the traffic denied. Standard ACLs do not specify destination addresses, so they should be placed as close to the destination as possible. For example, a standard ACL should be placed on Fa0/0 of Router D to prevent traffic from Router A.
Administrators can only place access lists on devices that they control. Therefore access list placement must be determined in the context of where the network administrator's control extends.
The Interactive Media Activity will teach students where to place ACLs.
The next page will discuss firewalls