Where to place extended ACLs?

[MikeVan90]

Having the network of the photo below, I want to permit HTTP and deny all access to the server from every device of the network (except the Inter router). I also want to deny all access to Hermes' subnets from all other devices unless ping or traceroute is used.

I don't have a problem writing the ACLs, but I would like to know where is the appropriate place to put them. I read that placing the extended ACL as close to the source as possible saves some bandwidth. So which is the best place to put ACLS to achieve what I described above?

[Georg Pauwen]

Hello,

in general, you want to place the access list as close to the source(s) as possible. In your case, that would be inbound on interface FastEthernet1/0 on router Bono...

[MikeVan90]

FastEthernet 1/0 is the interface of Bono with the router Inter. The interface of Bono with Edge is the serial 3/0 which is covered by another label and is not visible. So you mean the interface of Bono with Edge with the goal of filtering packets both from the devices connected to Edge and from Edge himself?

[Georg Pauwen]

Hello,

I think you need two access lists:

Having the network of the photo below, I want to permit HTTP and deny all access to the server from every device of the network (except the Inter router). --> FastEthernet1/0 inbound Bono
I also want to deny all access to Hermes' subnets from the other devices unless ping or traceroute is used. --> Serial 3/0 inbound Bono (serial interface going to Hermes)

[MikeVan90]

Hello, I edited me initial post as I think the example i put in was slightly confusing about the overall goal of the ACLs. You could give it another look if you want.

Now, about the HTTP ACL: isn't the source(s) all the devices except Inter and the server? I thought that source is the device(s) which is more possible to initiate communication between itself and another device. So having that in mind, I thought that all the other devices are sources and the server S1 is considered the destination. So putting the ACL in fastEthernet 1/0 inbound to router Inter would be the closest possible place to all the source(s),no? I am not defying your opinion as I am new to Networks, I am just trying to understand better.

As for the second ACL, I think the example I gave was confusing. Except for Edge's PCs and Edge himself, I also want to deny Bono and D1 access to Hermes' networks unless ping and traceroute is used. With that in mind, where should I place the ACL? Serial 2/0 inbound Hermes?

[Joseph W. Doherty]

As you correctly note, from a "bandwidth" perspective, you want to drop traffic as close to the source of the traffic as possible, however from a maintenance standpoint, you often place ACLs where you only need to maintain one instance of it and/or it makes the most sense.

So, for example, in your diagram, from a "bandwidth" perspective, you might have an ingress ACL on all the routers facing your hosts, but that appears to require you to maintain six instances.

From a "logical" and ease of maintenance perspective, you would likely one to have ingress and egress ACL on the interface connecting to your server.

If you wanted to slightly improve performance, you might maintain an ingress ACL on your link to the server; and an ingress ACL on your "Inter" routers connection to "Bono", or even a bit better, use an egress ACL on "Bono"'s interface to "Inter".

That said, most engineers, I suspect, would just maintain ACLs on the "Inter" router's server interface because when you need to hunt down and maintain how the server's access is permitted, that one interface would be the "easiest" to find, and identify, controlling access to your server.

[MikeVan90]

@Joseph W. Doherty 
Thanks for the valuable insight. 

 "you might have an ingress ACL on all the routers facing your hosts, but that appears to require you to maintain six instances".

That was my initial purpose but then I thought that I also need to deny all the routers' access to any S1 services except HTTP,  because I don't want any device of the network having access to the service of the server and that is when things became complicated. Can a router have access to the HTTP service of the server?

"even a bit better, use an egress ACL on "Bono"'s interface to "Inter". "

I read somewhere that a router does not filter packets that the router itself creates with an outbound ACL, so I can not do that if want all the devices being able to access only the servers' HTTP service, as Bono would have access to other server's services as well. Is that correct?

---

[Joseph W. Doherty]

Ah, yes, overlooked you wanted to block access to all devices, but router "Inter", correct?

BTW, routers are often not as restricted as "ordinary" hosts, as they are considered part of the infrastructure, and I don't recall most routers supporting a WEB browser (although you could do HTTP via telnet).

That said, if you still want to secure your server from router "Bono", you could block it's access on router "Inter". You could block all non-router "Inter" traffic on it, or just block "Bono"'s traffic, while still having "Bono" block other hosts (a little closer to their sources). (Doing the latter is possible, and more "efficient", but makes for a maintenance headache.)

(Yes, I recall [?] you're correct about ACLs not applying to locally sourced traffic.)

[Vishnu Vardhan S]

Hi as the source of the packet can be anything to the server hence we cannot decide on which router to put the ACL hence we have to apply it on router close to the server. 

1) I want to permit HTTP and deny all access to the server from every device of the network (except the Inter router).

     Ans) Apply an ACL allowing the port 80 of HTTP and thats it we have implicit deny which will take care of rest. Use it on interface fa1/0 (Inter) inbound 

          The Inter router would be able to send and receive packets to server so no issues. 

2)I also want to deny all access to Hermes' subnets from all other devices unless ping or traceroute is used.

    Permit the ICMP alone in an acl and burn it on the interface se2/0 of Hermes inbound direction.