mit cheatsheet
This commit is contained in:
Max Blendowski
323
Klausur/CheatSheet.md
Normal file
323
Klausur/CheatSheet.md
Normal file
@@ -0,0 +1,323 @@
|
||||
# ACL CheatSheet - Standard und Extended ACLs
|
||||
|
||||
## Übersicht
|
||||
|
||||
| Merkmal | Standard ACL | Extended ACL |
|
||||
|---------|-------------|------------|
|
||||
| **Nummernbereich** | 1-99, 1300-1399 | 100-199, 2000-2699 |
|
||||
| **Named Range** | Standard ACL 1-99 | Extended ACL 100-199 |
|
||||
| **Filter-Kriterien** | Nur Quell-IP-Adresse | Quelle, Ziel, Protokoll, Port |
|
||||
| **Position** | Interface-nah oder entfernt | Quelle-nah empfohlen |
|
||||
| **Anwendung** | Einfaches Filtern | Granulare Kontrolle |
|
||||
|
||||
---
|
||||
|
||||
## Standard ACLs (Numbered)
|
||||
|
||||
### Grundsyntax
|
||||
|
||||
```
|
||||
access-list <nummer> [permit | deny] <quell-ip> [wildcard-maske]
|
||||
```
|
||||
|
||||
### Beispiele
|
||||
|
||||
**Einzelne IP-Adresse zulassen:**
|
||||
```
|
||||
access-list 10 permit host 192.168.1.5
|
||||
```
|
||||
|
||||
**Netzwerk zulassen:**
|
||||
```
|
||||
access-list 10 permit 192.168.1.0 0.0.0.255
|
||||
```
|
||||
|
||||
**Alle Adressen zulassen:**
|
||||
```
|
||||
access-list 10 permit any
|
||||
```
|
||||
|
||||
**Alle verweigern (implizit vorhanden):**
|
||||
```
|
||||
access-list 10 deny any
|
||||
```
|
||||
|
||||
### Anwendung auf Interface
|
||||
|
||||
```
|
||||
Router(config)# interface FastEthernet 0/0
|
||||
Router(config-if)# ip access-group 10 in
|
||||
Router(config-if)# ip access-group 10 out
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Extended ACLs (Numbered)
|
||||
|
||||
### Grundsyntax
|
||||
|
||||
```
|
||||
access-list <nummer> [permit | deny] <protokoll> <quelle> <quelle-wildcard>
|
||||
<ziel> <ziel-wildcard> [operatoren] [log]
|
||||
```
|
||||
|
||||
### Protokollangaben
|
||||
|
||||
- `ip` - Alle IP-Protokolle
|
||||
- `tcp` - Transmission Control Protocol
|
||||
- `udp` - User Datagram Protocol
|
||||
- `icmp` - Internet Control Message Protocol
|
||||
|
||||
### Portnummern und Operatoren
|
||||
|
||||
| Operator | Bedeutung | Beispiel |
|
||||
|----------|-----------|----------|
|
||||
| `eq` | equal (gleich) | `eq 80` |
|
||||
| `neq` | not equal (ungleich) | `neq 22` |
|
||||
| `gt` | greater than (größer) | `gt 1023` |
|
||||
| `lt` | less than (kleiner) | `lt 1024` |
|
||||
| `range` | Bereich | `range 1000 2000` |
|
||||
|
||||
### Häufige Service-Ports
|
||||
|
||||
| Service | Port | Protokoll |
|
||||
|---------|------|-----------|
|
||||
| HTTP | 80 | TCP |
|
||||
| HTTPS | 443 | TCP |
|
||||
| SSH | 22 | TCP |
|
||||
| Telnet | 23 | TCP |
|
||||
| SMTP | 25 | TCP |
|
||||
| POP3 | 110 | TCP |
|
||||
| IMAP | 143 | TCP |
|
||||
| DNS | 53 | TCP/UDP |
|
||||
| DHCP | 67, 68 | UDP |
|
||||
| NTP | 123 | UDP |
|
||||
| SNMP | 161, 162 | UDP |
|
||||
|
||||
### Beispiele Extended ACLs
|
||||
|
||||
**HTTP-Traffic zulassen:**
|
||||
```
|
||||
access-list 100 permit tcp any host 192.168.1.10 eq 80
|
||||
access-list 100 permit tcp any host 192.168.1.10 eq 443
|
||||
access-list 100 deny ip any any
|
||||
```
|
||||
|
||||
**SSH von bestimmtem Netzwerk erlauben:**
|
||||
```
|
||||
access-list 101 permit tcp 192.168.2.0 0.0.0.255 host 10.0.0.1 eq 22
|
||||
access-list 101 deny ip any any
|
||||
```
|
||||
|
||||
**ICMP blockieren (Ping), alles andere erlauben:**
|
||||
```
|
||||
access-list 102 deny icmp any any
|
||||
access-list 102 permit ip any any
|
||||
```
|
||||
|
||||
**DNS und HTTP für Internetzugang:**
|
||||
```
|
||||
access-list 103 permit tcp 192.168.1.0 0.0.0.255 any eq 53
|
||||
access-list 103 permit udp 192.168.1.0 0.0.0.255 any eq 53
|
||||
access-list 103 permit tcp 192.168.1.0 0.0.0.255 any eq 80
|
||||
access-list 103 permit tcp 192.168.1.0 0.0.0.255 any eq 443
|
||||
access-list 103 deny ip any any
|
||||
```
|
||||
|
||||
### Anwendung auf Interface
|
||||
|
||||
```
|
||||
Router(config)# interface Serial 0/0
|
||||
Router(config-if)# ip access-group 100 in
|
||||
Router(config-if)# ip access-group 100 out
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Named ACLs
|
||||
|
||||
### Standard Named ACL - Syntax
|
||||
|
||||
```
|
||||
Router(config)# ip access-list standard <name>
|
||||
Router(config-std-nacl)# [permit | deny] <quell-ip> [wildcard-maske]
|
||||
Router(config-std-nacl)# exit
|
||||
```
|
||||
|
||||
### Extended Named ACL - Syntax
|
||||
|
||||
```
|
||||
Router(config)# ip access-list extended <name>
|
||||
Router(config-ext-nacl)# [permit | deny] <protokoll> <quelle> <quelle-wc>
|
||||
<ziel> <ziel-wc> [operatoren]
|
||||
Router(config-ext-nacl)# exit
|
||||
```
|
||||
|
||||
### Beispiele Named ACLs
|
||||
|
||||
**Standard Named ACL:**
|
||||
```
|
||||
Router(config)# ip access-list standard ALLOW_ADMIN
|
||||
Router(config-std-nacl)# permit host 192.168.1.1
|
||||
Router(config-std-nacl)# permit host 192.168.1.2
|
||||
Router(config-std-nacl)# deny any
|
||||
Router(config-std-nacl)# exit
|
||||
```
|
||||
|
||||
**Extended Named ACL:**
|
||||
```
|
||||
Router(config)# ip access-list extended WEB_ACCESS
|
||||
Router(config-ext-nacl)# permit tcp any 192.168.1.0 0.0.0.255 eq 80
|
||||
Router(config-ext-nacl)# permit tcp any 192.168.1.0 0.0.0.255 eq 443
|
||||
Router(config-ext-nacl)# deny ip any any
|
||||
Router(config-ext-nacl)# exit
|
||||
```
|
||||
|
||||
### Anwendung Named ACL auf Interface
|
||||
|
||||
```
|
||||
Router(config)# interface FastEthernet 0/1
|
||||
Router(config-if)# ip access-group ALLOW_ADMIN in
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Wildcard Masking - Kurzreferenz
|
||||
|
||||
### Grundprinzip
|
||||
|
||||
- `0` = Bit muss übereinstimmen
|
||||
- `1` = Bit wird ignoriert
|
||||
|
||||
### Häufige Wildcard Masken
|
||||
|
||||
| Wildcard | Bedeutung | Host-Anzahl |
|
||||
|----------|-----------|------------|
|
||||
| `0.0.0.0` | Genau diese IP | 1 |
|
||||
| `0.0.0.255` | /24 Subnetz | 256 |
|
||||
| `0.0.255.255` | /16 Subnetz | 65.536 |
|
||||
| `0.0.0.3` | Letzte 2 Bits = 4 Adressen | 4 |
|
||||
| `0.0.0.7` | Letzte 3 Bits = 8 Adressen | 8 |
|
||||
| `0.0.15.255` | Bereich von 16 Subnetzen | 4.096 |
|
||||
| `255.255.255.255` | Alle Adressen (any) | - |
|
||||
|
||||
### Beispiele
|
||||
|
||||
**Einzelner Host:**
|
||||
```
|
||||
host 192.168.1.100
|
||||
```
|
||||
oder
|
||||
```
|
||||
192.168.1.100 0.0.0.0
|
||||
```
|
||||
|
||||
**Gesamtes /24 Subnetz:**
|
||||
```
|
||||
192.168.1.0 0.0.0.255
|
||||
```
|
||||
|
||||
**Alle Adressen:**
|
||||
```
|
||||
any
|
||||
```
|
||||
oder
|
||||
```
|
||||
0.0.0.0 255.255.255.255
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## ACL-Logik und Verarbeitung
|
||||
|
||||
### Grundsätze
|
||||
|
||||
1. **First-Match-Prinzip**: Erstes zutreffende Regelwerk wird angewendet
|
||||
2. **Implizites Deny**: Ohne explizite Erlaubnis wird verweigert
|
||||
3. **Zeilenreihenfolge**: Spezifische Regeln vor allgemeinen Regeln platzieren
|
||||
4. **Inbound/Outbound**: Separate Regeln für Datenverkehr in beide Richtungen
|
||||
|
||||
### Verarbeitungsschritte
|
||||
|
||||
1. Paket kommt am Interface an
|
||||
2. ACL wird Zeile für Zeile geprüft
|
||||
3. Erste zutreffende Regel wird ausgeführt (Permit/Deny)
|
||||
4. Verarbeitung stoppt
|
||||
5. Falls keine Regel zutrifft → implizites **Deny**
|
||||
|
||||
### Established-Schlüsselwort (stateful)
|
||||
|
||||
```
|
||||
access-list 100 permit tcp 192.168.1.0 0.0.0.255 any established
|
||||
```
|
||||
|
||||
Dies erlaubt Rückantworten auf bereits initiierte Verbindungen.
|
||||
|
||||
---
|
||||
|
||||
## Verwaltung und Debugging
|
||||
|
||||
### ACLs anzeigen
|
||||
|
||||
```
|
||||
Router# show access-lists
|
||||
Router# show access-lists 100
|
||||
Router# show ip access-lists
|
||||
```
|
||||
|
||||
### ACL auf Interface anzeigen
|
||||
|
||||
```
|
||||
Router# show ip interface <interface> | include access list
|
||||
```
|
||||
|
||||
### ACLs löschen
|
||||
|
||||
```
|
||||
Router(config)# no access-list 100
|
||||
Router(config)# ip access-list extended WEB_TRAFFIC
|
||||
Router(config-ext-nacl)# no 10
|
||||
```
|
||||
|
||||
### ACLs mit Logging
|
||||
|
||||
```
|
||||
access-list 100 permit tcp any any eq 80 log
|
||||
```
|
||||
|
||||
Ermöglicht das Protokollieren von Paket-Matches.
|
||||
|
||||
---
|
||||
|
||||
## Häufige Fehler vermeiden
|
||||
|
||||
| Fehler | Lösung |
|
||||
|--------|--------|
|
||||
| Zu restriktive Regeln am Anfang | Spezifische Regeln vor allgemeinen Regeln positionieren |
|
||||
| Vergessene implizite Deny | Explizites `deny any` am Ende ergänzen |
|
||||
| Wildcard-Maske invertiert | Wildcard-Maske = Inverse der Subnetzmaske |
|
||||
| Falsche Interface-Richtung | Zwischen `in` und `out` unterscheiden |
|
||||
| Port ohne Protokoll | Immer TCP/UDP vor Ports angeben |
|
||||
|
||||
---
|
||||
|
||||
## Checkliste für ACL-Konfiguration
|
||||
|
||||
- [ ] Numbernbereich korrekt gewählt (Standard: 1-99; Extended: 100-199)
|
||||
- [ ] Protokoll definiert (tcp, udp, icmp, ip)
|
||||
- [ ] Quell- und Ziel-IPs mit Wildcard-Masken richtig angegeben
|
||||
- [ ] Ports bei Extended ACLs gesetzt
|
||||
- [ ] Spezifische Regeln vor allgemeinen Regeln
|
||||
- [ ] Implizite oder explizite Deny-Regel am Ende
|
||||
- [ ] ACL auf Interface (inbound/outbound) angewendet
|
||||
- [ ] Mit `show access-lists` überprüft
|
||||
- [ ] Mit `show ip interface <interface> | include access list` verifiziert
|
||||
|
||||
---
|
||||
|
||||
## Weiterführende Ressourcen
|
||||
|
||||
- **CISCO Skills for All**: Network Defense Kurs
|
||||
- **Cisco Documentation**: ACL Configuration Guide
|
||||
- **PacketTracer**: Praktische Übungen und Simulationen
|
||||
- **Wildcard Mask Calculator**: Online-Tools zur Berechnung
|
||||
Reference in New Issue
Block a user