Cisco IOS Access Lists

Chapter 3. Implementing Security Policies

In Chapter 1, you learned that security, robustness, and business drivers are the primary motivations for implementing network traffic policies, and in Chapter 2 you learned how to format, build, and maintain standard and extended access lists. With this background, you are now ready to implement policies for the first key motivation: security. There are three sections in this chapter. Since security policies most often use two different tools in the network administrator’s policy tool kit—router resource control and packet filtering—there is a section on each. These router resources include services on the router, such as Telnet or SNMP access that should be closely managed by any network administrator. Packet filtering, or regulating what kind of packets can flow through the router, is commonly used in firewall applications. Since access lists consume resources on the router, I have included Section 3.3 in this chapter, which describes some alternatives to access lists you might want to consider when implementing security policies.

Router resource control

As I have said, creating router resource policies requires building policy sets of host IP addresses and giving those policy sets permission to use a router resource. The most common examples, discussed later in this chapter, are policy sets of hosts allowed to log into a router, but other examples might include controlling SNMP access to router information or permission to use the router ...