0

my topology is shown below: My topology

I would like the networks that are connected to Hermes-Router to be accessible from all the other stations only when I use ping and traceroute. I tried to do this using an ACL(access-list 122) on the se2/0 interface of Bono-Router(this is the serial interface that connects Hermes and Bono). The execution of the "show running-config" command on the Bono-Router is shown below:

Router#show running-config Building configuration... Current configuration : 1255 bytes ! version 12.2 no service timestamps log datetime msec no service timestamps debug datetime msec no service password-encryption ! hostname Router ! ! ip cef no ipv6 cef ! ! interface FastEthernet0/0 ip address 172.16.128.1 255.255.224.0 duplex auto speed auto ! interface FastEthernet1/0 ip address 143.233.173.2 255.255.255.252 ip access-group 121 out duplex auto speed auto ! interface Serial2/0 ip address 174.166.1.1 255.255.255.252 ip access-group 122 out ! interface Serial3/0 ip address 192.168.1.2 255.255.255.252 clock rate 2000000 ! interface FastEthernet4/0 no ip address shutdown ! interface FastEthernet5/0 no ip address shutdown ! router ospf 500 log-adjacency-changes network 172.16.128.0 0.0.31.255 area 0 network 174.166.1.0 0.0.0.3 area 0 network 192.168.1.0 0.0.0.3 area 0 default-information originate ! ip classless ip route 192.168.1.0 255.255.255.248 143.233.173.1 ip route 143.233.173.0 255.255.255.252 143.233.173.1 ip route 0.0.0.0 0.0.0.0 143.233.173.1 ! ip flow-export version 9 ! ! access-list 121 permit tcp any any eq www access-list 121 deny ip any any access-list 122 permit icmp any any ! ! line con 0 ! line aux 0 ! line vty 0 4 login ! ! ! end

After applying access-list 122 to se2/0 of Bono-Router, I successfully used ping and traceroute from PC-E to PC-A and from PC-A to PC-E. Unfortunately when I'm trying to access the webpage of Server0 from PC-E using its web browser I get the "Request Time Out" message shown below: enter image description here

I would appreciated if someone could share his idea about this problem with me. Thank you all in advance for your help!!!

Improve this question
5
  • Basically, ACLs are stateless - you need to permit both directions. Commented Feb 3, 2020 at 18:11
  • Do you mean that I have to include the command ip access-group 122 in? Commented Feb 3, 2020 at 18:29
  • No. First, you should apply ACLs on ingress whenever possible which is more efficient and more logical most of the time. Second, when you apply a permit tcp any any eq www towards a web server you need to apply a permit tcp any eq www any away from the server (unless you simply allow everything). The same goes for ICMP. This is exactly what Ron is pointing out. Commented Feb 3, 2020 at 19:53
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer. Commented Dec 16, 2020 at 23:58
  • Please check inbound traffic on serial interface of Hermes, where an acl can be placed in order to permit icmp, ospf and tcp protocols. Commented Jan 26, 2021 at 21:09

2 Answers 2

Reset to default
2

First, I'd prefer to apply the ACL inbound on Hermes rather than outbound on Bono. That way "the network protects itself" rather than "I depend on the upstream network to defend this network". But that's just my preference. Your ACL at least blocks traffic before it fills up that serial line.

Second, there are several different implementations of traceroute. The unix and mac variant uses UDP outbound to a high UDP port, and relies on ICMP error messages coming in the other way (on my mac the ports start at 33435 and increase. Per "TCP IP Illustrated Volume 1" by Richard Stevens that is the traditional Unix implementation). Since your traceroute succeeds with an icmp permit, it must be a variant using icmp (I believe windows traceroute uses icmp, I don't have a packet capture so I can't see the exact message used).

Capture of unix tcpdump:

droot@Darrell-Roots-Potato ~ % sudo tcpdump -n udp or icmp tcpdump: data link type PKTAP tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on pktap, link-type PKTAP (Apple DLT_PKTAP), capture size 262144 bytes 14:46:42.103395 IP 192.168.0.27.42637 > 4.2.2.1.33435: UDP, length 24 14:46:42.107453 IP 192.168.0.1 > 192.168.0.27: ICMP time exceeded in-transit, length 36 14:46:42.108577 IP 192.168.0.27.42637 > 4.2.2.1.33436: UDP, length 24 14:46:42.109736 IP 192.168.0.1 > 192.168.0.27: ICMP time exceeded in-transit, length 36 14:46:42.109799 IP 192.168.0.27.42637 > 4.2.2.1.33437: UDP, length 24 14:46:42.110945 IP 192.168.0.1 > 192.168.0.27: ICMP time exceeded in-transit, length 36

Note that the last ICMP reply might be "ICMP destination port unreachable" rather than time exceeded.

I also don't like allowing traceroute into my network. I prefer to allow traceroute out and permit the responses in. But your requirement is to allow traceroute in, so for windows you need to permit the icmp and for unix/mac you need to permit the udp ingress.

Your second requirement is to permit icmp inbound. I don't like allowing reconnaissance of my network, but if that's your requirement it makes that part of the ACL easy. I'd prefer to allow ICMP responses in but block ICMP echo requests.

Your third requirement is to be able to web surf (using TCP) and get replies. I'll expand that to making outbound tcp connections in general and get replies.

That makes your ACL as follows: (you can apply this outbound on bono or inbound on hermes)

access-list 122 remark permit tcp replies to outbound connections access-list 122 remark but do not allow tcp connections initiated inbound access-list 122 permit tcp any any established access-list 122 remark permit icmp inbound per requirement and for windows tcpdump access-list 122 permit icmp any any access-list 122 remark permit unix traceroute inbound access-list 122 remark warning this allows udp scanning of your network access-list 122 permit udp any any range 33435 33535 access-list 122 remark deny by default explicitly at end, add logging during troubleshooting access-list 122 deny ip any any ! log

Note that "range 33435 33535" uses an "expensive" LOU TCAM on high-end hardware-forwarding routers. You typically get only 30-50 of those per high-end router. So use them sparingly for important rules (such as minimizing ingress udp scanning, as I did here). Reusing the exact same range in different ACLs typically allows reuse of the same TCAM.

Even after all this, your network will not be "operational". At the very least you need to permit UDP replies from your DNS server (you already permit tcp replies thanks to the "permit tcp any any established").

EDIT: Taking off my network engineer hat and putting on my information security hat, I'd like you to decide which network you want to protect. If you are protecting the Hermes network, don't let the internet ping or traceroute inbound. Pinging and tracerouting outbound (and allowing minimal replies) makes more sense.

Improve this answer
-1

You need to modify access-list 122 to also allow web traffic from server0.

access-list 122 permit icmp any any access-list 122 permit tcp any eq www any

This means the only traffic that will be sent from Bono to Hermes is ICMP and HTTP replies. That may not be exactly what you want. In that case, you will need to add more lines to the access list.

Improve this answer
3
  • That acl permits all tcp traffic into your protected network if they set the source port equal to 80, constituting a security weakness. I’ll write up an alternative answer in a minute. Commented Feb 3, 2020 at 22:38
  • @DarrellRoot I'm well aware of the security shortcomings of this example, but I believe it's helpful to start simply to provide a learner with basic understanding of how ACLs work, especially in this contrived example. I don't want to complicate things so that the basic principle gets lost in the security details. Commented Feb 4, 2020 at 13:38
  • I agree my answer is too long. But we must never teach acls that result in security penetrations. Use the established flag to allow tcp responses. Not tcp source port. Commented Feb 4, 2020 at 16:39

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.