Cisco Reflexive Access Lists Configuration Guide: User Manual PDF (EN)

Information About Reflexive Access Lists

Configuring Reflexive Access Lists Restrictions on Using Reflexive Access Lists, on page 1 Information About Reflexive Access Lists, on page 1 How to Configure Reflexive Access Lists, on page 7 Configuration Examples for Reflexive Access List, on page 10 Feature History for Reflexive Access Lists, on page 12 Restrictions on Using Reflexive Access Lists • Reflexive access lists do not work with some applications that use port numbers that change during a session. For example, if the port numbers for a return packet are different from the originating packet, reflexive access list denies the return packet. Even if the return packet is actually a part of the same session.

The TCP application of FTP is an example of an application with changing port numbers. If you start an FTP request from within your network, reflexive access lists will not complete the request. Instead, use passive FTP when sending requests from within your network. • Wireshark functionality will not work for packets that are filtered through reflexive access lists. • Netflow-based features (such as NetFlow, Encrypted Traffic Analytics [ETA], Wired Application Visibility and Control [WDAVC], Security Group Tag Caching [SGT-C]) and reflexive access lists can’t be configured on the same interface. • Reflexive access list configuration supports only 5-tuple with port range.

• Only Layer3 interfaces (L3 interfaces, L3 subinterfaces, SVIs, L3 port channel, and port-channel subinterfaces) support reflexive access list configuration. Information About Reflexive Access Lists Reflexive access lists allow filtering of IP packets based on upper-layer session information. You can use reflexive access lists to permit IP traffic for sessions originating within your network. You can also deny IP traffic for sessions originating outside your network. Reflexive access lists accomplish this by using reflexive filtering, a kind of session filtering. Reflexive access lists can be defined with extended, named IP access lists only.

You cannot define reflexive access lists with numbered or standard, named IP access lists or with other protocol access lists. Configuring Reflexive Access Lists 1

Стр. 1

Session Filtering with Basic Access Lists

You can use reflexive access lists along with other standard access lists and static, extended access lists. Note Reflexive access lists supports both ingress NetFlow and egress NetFlow. The default size of egress NetFlow with custom SDM template is zero, and with custom SDM template the NetFlow table size can be set to zero for both directions. In such cases, reflexive ACL does not work as NetFlow cannot be installed in the hardware flow table. Benefits of Reflexive Access Lists Reflexive access lists are an important part of securing your network against network hackers, and can be included in a firewall defense.

Reflexive access lists provide a level of security against spoofing and certain denial-of-service attacks. Reflexive access lists are simple to use, and, compared to basic access lists, provide greater control over which packets enter your network. Overview of Reflexive Access Lists Reflexive access lists are similar in many ways to other access lists. Reflexive access lists contain condition statements that define criteria for permitting IP packets. These entries are evaluated in the order in which they are entered in the list. When a match occurs, no more entries are evaluated. However, reflexive access lists have significant differences from other types of access lists.

Reflexive access lists contain only temporary entries. These entries are automatically created when a new IP session begins. The entries are removed when the session ends. Reflexive access lists aren’t themselves applied directly to an interface. They are nested within an extended, named IP access list that is applied to the interface. For more information about this, see How to Configure Reflexive Access Lists, on page 7 . Also, reflexive access lists don’t have the usual implicit deny all traffic statement at the end of the list because they are nested lists.

Implementing Session Filtering with Reflexive Access Lists The following section provides information on how reflexive access lists are better at implementing session filtering. Session Filtering with Basic Access Lists With standard and extended access lists, you can implement a basic version of session filtering by using the established keyword with the permit command. The established keyword filters TCP packets based on whether the ACK or RST bits are set. Set ACK or RST bits indicate that the packet isn’t the first in the session. Therefore, the packet belongs to an established session. This filter criterion is a part of an access list applied permanently to an interface.

This method of using the established keyword is available only for the TCP upper-layer protocol. For the other upper-layer protocols, such as UDP, ICMP, you have to either permit all the incoming traffic or define all the possible permissible source/destination host/port address pairs for each protocol. This is an unmanageable task and might exhaust the NVRAM space. Configuring Reflexive Access Lists Benefits of Reflexive Access Lists Configuring Reflexive Access Lists 2

Стр. 2

Temporary Access List Entry Characteristics

Session Filtering with Reflexive Access Lists Reflexive access lists provide a truer form of session filtering. This filtering is much harder to spoof because more filter criteria must be matched before a packet is permitted through. For example, source and destination addresses and port numbers are checked, and not just the ACK and RST bits. Also, session filtering uses temporary filters that are removed after a session is over. This limits a hacker’s attack opportunity to a smaller time window. Location at which to Configure Reflexive Access Lists Configure reflexive access lists on border devices and devices that pass traffic between an internal and external network.

Note In this chapter, the phrases 'within your network' and 'internal network' refer to a controlled and secured network, for example, the intranet of your organization. They also refer to a part of the internal network of your organization that has higher security requirements than another part. 'Outside your network' and 'external network' refer to a network that is uncontrolled and unsecured, for example the internet. They also refer to a part of your organization's network that isn’t highly secured.

How Reflexive Access Lists Work A reflexive access list is triggered when a new IP upper-layer session (such as TCP or UDP) is initiated from inside your network, with a packet traveling to the external network. When triggered, the reflexive access list generates a new, temporary entry. This entry permits traffic to enter your network if the traffic is a part of the session. The entry won’t permit traffic to enter your network if the traffic isn’t a part of the session. For example, when the first outbound packet of a TCP session is forwarded outside of your network, a new temporary reflexive access list entry is created.

This entry is added to the reflexive access list, that applies to inbound traffic. The number of configurable reflexive access list groups is limited to 100. Each group can have 100 ACL entries. Theoretically, while the number of ACLs can be 10,000, the actual number depends on the TCAM size supported by your device. The sequence number of the Reflexive ACEs can't exceed 65530. When the limit is exceeded, the forwarding manager logs an error message on the console indicating the same. The temporary reflexive access list entries are learned using the NetFlow hash table in the hardware. If the flow table is full when a new entry is detected, the traffic for the failed flow is dropped.

Dynamic reflexive entries aren't synced to the standby. When Stateful Switchover takes place in a StackWise Virtual system, notifications are sent to clear the dynamic entries from the hardware when the system role changes from standby to active. The temporary reflexive access list entries are relearnt. Temporary Access List Entry Characteristics • The entry is always a permit entry. • The entry specifies the same protocol, such as TCP, as the original outbound packet. • The entry specifies the same source and destination addresses as the original outbound TCP packet, except that the addresses are swapped.

Configuring Reflexive Access Lists Session Filtering with Reflexive Access Lists Configuring Reflexive Access Lists 3

Стр. 3

Choosing an Interface Internal or External

• The entry specifies the same source and destination port numbers as the original outbound TCP packet, except that the port numbers are swapped. This entry characteristic applies only for TCP and UDP packets. Other protocols, such as ICMP and IGMP, don't have port numbers, and other criteria are specified. For example, for ICMP, type numbers are used. • Inbound TCP traffic is evaluated against the entry until the entry expires. If an inbound TCP packet matches the entry, the inbound packet is forwarded into your network. • The entry expires after the last packet of the session passes through the interface.

• If no packets belonging to the session are detected for the timeout period, the entry expires. • The per entry timeout minimum value should align with the global timeout value. Per entry timeout value that is lower than the global timeout value won't be honored. Temporary reflexive access list entries are removed at the end of the session. For TCP sessions, the entry is removed 5 seconds after two set FIN bits are detected, or immediately after a TCP packet is matched with the RST bit set. Two set FIN bits in a session indicate that the session is about to end; the 5-second window allows the session to close gracefully. A set RST bit indicates an abrupt session close.

The temporary entry is removed when no packets of the session are detected for the timeout period. For UDP and other protocols, the end of the session is determined differently than for a TCP session. Because other protocols are considered to be sessionless services, no session-tracking information is embedded in packets. Therefore, a session is considered to have ended when no packets of the session are detected for the timeout period. Choosing an Interface Internal or External Before you configure reflexive access lists, you must decide whether to configure reflexive access lists on an internal or external interface.

You should also be sure that you have a basic understanding of the IP protocol and of access lists. Specifically, you should know how to configure extended named IP access lists. To learn about configuring IP extended access lists, refer to the “Configuring IP Services” chapter of the Cisco IOS IP Configuration Guide . Reflexive access lists are most commonly used with one of two basic network topologies. Determining which of these topologies is most like your own helps you decide whether to use reflexive access lists with an internal interface or with an external interface. An internal interface is the interface connecting to an internal network.

An external interface is the interface connecting to an external network. In the first topology, reflexive access lists are configured for the external interface. This prevents IP traffic from entering the device and the internal network, unless the traffic is part of a session already established from within the internal network. Configuring Reflexive Access Lists Configuring Reflexive Access Lists 4

Стр. 4