TechKnowSurge
Cisco CCNA 5.6 Cisco CCNA 1.5 Cisco CCNA 2.1
TechKnowSurge Catalog Videos DEMO: Established Traffic
VideoNetworkFree

DEMO: Established Traffic

Access control lists (ACLs) can be configured with the established keyword to allow only return traffic that was initiated from inside the network, blocking unsolicited inbound connections while permitting requested responses. This approach creates a basic stateful-style filtering mechanism on a Layer 3 switch without requiring a dedicated firewall.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Controlling inbound traffic on a network requires more than simply blocking everything at the perimeter — internal hosts still need to receive responses to the connections they initiate. Cisco ACLs address this with the established keyword, which instructs the router or Layer 3 switch to permit TCP traffic only when it is part of a session that originated from inside the network. Without this keyword, a strict deny-all policy would prevent legitimate return traffic from reaching internal hosts, breaking normal operations like web browsing and remote access. In practice, this type of ACL is applied to a switch virtual interface (SVI) in the outbound direction, meaning it filters traffic as it flows from the switch toward the internal VLAN rather than as it arrives from outside. The access list first preserves SSH connectivity to avoid locking out administrative access, then uses the established parameter to allow TCP return traffic to a specific host, and relies on the implicit deny any any at the end to block everything else. The result is that unsolicited pings and connections from outside the network are dropped, while HTTP responses, SSH sessions, and other outbound-initiated traffic pass through normally. This configuration functions similarly to basic stateful filtering and is sometimes called a crude firewall because it replicates one key behavior of a firewall — allowing return traffic for established sessions — without the full feature set that dedicated firewall appliances provide. It should be understood as a supplemental access control measure rather than a replacement for a purpose-built firewall, and it is especially not a substitute for a next-generation firewall capable of deep packet inspection and application-layer filtering.

What you'll learn

What's covered

Established Traffic ACLs

Aligned to

Cisco CCNA
5.6 Configure and verify access control lists
1.5 Compare TCP to UDP
2.1 Configure and verify VLANs (normal range) spanning multiple switches

Key terms

Access Control List
ACL
A set of rules that defines which users or systems are granted or denied access to a resource.
Transmission Control Protocol
TCP
A connection-oriented transport protocol that ensures reliable, ordered, and error-checked delivery of data.
Virtual LAN
VLAN
A logical grouping of network devices that behave as if they are on the same network regardless of physical location.
Packet Filtering
A firewall technique that inspects packets and allows or blocks them based on source, destination, and protocol.
Switch Virtual Interface
SVI
A virtual layer 3 interface on a switch associated with a VLAN. On a layer 2 switch a single SVI provides the management IP address; on a layer 3 switch, SVIs also route between VLANs.
Established Keyword
An ACL parameter used in extended ACLs that permits return TCP traffic belonging to an already-initiated session, identified by the ACK or RST flag, while blocking unsolicited inbound connections.

Transcript

Imagine if I was trying to safeguard my network, and so I was blocking all the traffic from being able to enter the network. That's great, although sometimes the machines on the inside of the network are trying to get information from outside the network. In fact that's quite often, right? Anytime we browse the internet, information needs to come back to our computer. So there is a way to do that, to allow just that traffic that's been requested, and it's established traffic.

The setup and the crude firewall

Here is my network right here. I'm on this demo laptop and I have three different IP addresses configured on it, and from each of those IP addresses I'm pinging this switch over here.

So what I'm going to do is configure a new access list on here. I'm calling it the crude firewall. The reason why I'm calling it a crude firewall is because it doesn't have all the features that a real firewall would have, but it can be used to block some traffic and configure some traffic. So we're going to use it to create this crude firewall, or something that will act similar to the firewall, but don't think that it's a replacement for an actual firewall, especially not a replacement for a next generation firewall.

Building the access list

So then I've got the remark here, as I typically do. The first thing that I'm going to do is permit traffic coming from any source to my host on port 22. This is just for selfish reasons. I'm only including this because I'm connected into each one of the devices and I don't want to lose connectivity on my SSH connectivity, so I've got that on there.

Then next what I have is I'm permitting TCP traffic from any host out there to the demo laptop, and so any TCP traffic would come back to that demo laptop. In fact what I can do is I can do a ping of that demo laptop and see that yes, in fact I can get traffic from outside. This is from the switch clear on the other side of the network, and it can get into VLAN 10 and can ping my demo laptop. But I don't want that. I don't want any traffic to be able to get back to my demo laptop; I want only traffic that I've requested.

So on here what I'm going to do is permit TCP any host 10.1.10.34, and I'm going to include the word established. When I include the word established here, what that's saying is that as traffic comes back, if I were to generate traffic from somewhere on this network, it couldn't get into the demo laptop unless this demo laptop went and requested that traffic, and then it could come back into that network.

So what I'm going to do is jump on to my layer 3 switch. I'm going to get into the global configuration mode, I'm going to copy this access list here and paste it into here, and then I'll exit out of the access list. Remember there's that implicit deny any any, so all other traffic is going to be blocked that I haven't established right here.

Where to place it

So the next thing is, where am I going to place this? This is going into VLAN 10. Now it gets a little tricky. Think of a router and a port on a router: if you want it to come in, if you're using that interface and you're putting an ACL on the in, it's traffic coming from outside into the router, and then vice versa, if you have it going out it's coming from the router outside. Well, with a switch virtual interface it's the same way. So with the switch virtual interface I have VLAN 10, and I want it to go into the network, which is actually out of the interface. So I'm going to put this on VLAN 10 going out.

So I'm going to type in ip access-group and then my crude firewall, and it's going out of the interface, so I'm going to type in out, and that's what's actually going into that network.

As soon as I do this it's going to take effect. You can see that my pings down here have all stopped, because I haven't allowed anything to get back to my network. You can see my connection to these networks is allowed, because I'm having a connection to those, or because I've permitted that traffic, and then anything that goes out from a TCP perspective will come back in.

Seeing established traffic work

So a good example would be if we brought up a web browser and go to our demo pie that we can access with a page on it, and that IP is 10.1.30.23. So we hit there, and notice that this is port 80 and we aren't allowing port 80 to come back, but it's established traffic, so this one right here is allowing that response to come back to the demo laptop.

Backing it out

So now we've put these in, and similar to what I've been doing with the rest of them, if I want to remove this I just put a no in front of my statement. So I'm going to put a no in front of this, and then I should start pinging here down below. There we can see that our pings are successful now. The next thing I'm going to do is a no on our crude firewall access list.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →