Rules

Rules on a layer 3 device

When we're setting up a router or firewall or whatever layer 3 device, we want to set up controls between these different networks — access control entries, or rules. We want to set these rules up to be able to control the traffic that's flowing from one network to another.

The first thing you need to understand is that we're going to be talking more about the principle of things, although we'll talk about this as a command. The command is going to look different depending on what device you're entering it into. This is really close to what it would look like on a Cisco router, but not necessarily exactly what it would look like on a Cisco router. It is loosely correlated to what you would see on a Cisco router and many other types of devices out there, but not exactly the same. I also realize that if you're using some sort of GUI interface, then the components are all here, it's just that you're not entering it as a command — you're just going to plug this information into maybe some sort of web interface or something to that effect. Really, we're looking at the different components. The goal of this is to understand the different parts of this command, so that way we understand what exactly it's doing and how it's doing it.

The first thing to note is that not everything calls this a rule. For instance, if we're dealing with a Cisco router, we're going to set up access control entries, which go into an access control list, which we apply to an interface. But most of the devices that I've seen will call these rules.

The parts of the command

The different parts to this: first of all, we have the command. This is just setting up an access list. And then we're going to give this a name. So essentially, we're creating an access list. This is an access control entry and it's going to go into a list. Well, how does it know what list it's going into? We're going to specify it right here — this is the list name. Then we've got to give it what kind of action it is going to take. In this case right here, it's going to permit it, or possibly we're going to deny it. And then we'll give it the source, what the source it's coming from is, and then what is the destination, and then what port is it going to.

Once we've created all of our entries — for this case right here, it's the outbound network access control list — then we'd be applying it to an interface on a router. So as the packet is going into the router from one of the devices here, it will take a look at this packet and determine, does it measure up against this rule? If so, then it will follow whatever action that rule states.

There really only are two actions that it can carry out. Well, there is kind of a third, where it can log some information, but for the purpose of this, we're just going to say that it will either permit or deny that traffic. If it permits that traffic, then it will allow it to go through. If it denies it, it will just drop it — there's no notification, it's just going to drop it, and then that packet no longer exists.

How the packet is matched

It of course needs to match before it knows whether it needs to permit or deny. So how is it going to match the traffic, the packet that's coming in, against each one of these entries? What it's going to do is take a look at the source and the destination and the ports, and that's what it's going to match against.

This is an IP version 4 header. This is what a router uses in order to understand where it needs to send this packet to next, so the router can do its function, which is routing. So what it will do is look at some pieces of information. Specifically, it needs to know the destination IP address to figure out where to route it to. But before it does its routing, what it does is compare this against that access control list. It looks at the source IP address and the destination IP addresses and matches it up against what the actual access control list is and sees if it can find a match. It's also going to try to match it against the TCP header — it's going to take a look at the source port and destination port. Now, we don't need to match against everything, but it's going to take one or both of these and match against it to understand if it needs to send it along its way or not.

Sources, destinations and ports

So here's where the source is at. It's matching that source IP address against this right here. What it could do is match against a single host, and this would be one example of how we'd match it against a single host. This is saying 1010.10, and we need to match all 32 bits there. Or what we could do is match it against a network, so in this case it's the 1010.10.0/24 network that we're matching it against. Or if we want to specify everything, then this is what we call a quad zero, and we'd match it against that and just say anything. Or sometimes we use shorthands for doing this, and there's other shorthands to do it as well — but anytime you see "any", just think of the quad zero, or just anything; it's going to match anything against that. So, any source in this case right here.

And then we can have the same breakdown for the destination. The destination could look very similar to this. In this case right here, we just have the destination of "any" for every one of these entries, but just know it could be different there.

And then here again, the same thing for the port. For this one, we're looking at the destination port. We can specify a source port as well, so that is something that we could filter off of. Or we could just say it's any port, so we don't really care. Or we could say it's TCP, or we could say it's UDP. The point here is that we can start being able to pick out exactly what traffic, exactly what is the source and exactly what is the destination.

Now, there are other types of ACL that we can use as well out there — things that happen on firewalls or switches or other types of devices, where we can base things off of MAC addresses or URLs, or we could do stateful or stateless packet inspection. We'll get into more of those later on, but for now we're specifically talking about rules that are based off of source and destination IP addresses and source or destination port addresses.