{"id":275,"date":"2009-12-03T22:24:02","date_gmt":"2009-12-03T21:24:02","guid":{"rendered":""},"modified":"2019-01-31T12:45:49","modified_gmt":"2019-01-31T11:45:49","slug":"configuring-complex-dynamic-acl-lock-and-key","status":"publish","type":"post","link":"https:\/\/nil.uniza.sk\/en\/configuring-complex-dynamic-acl-lock-and-key\/","title":{"rendered":"Configuring complex dynamic ACL (Lock-and-Key)"},"content":{"rendered":"

In this article I will configure dynamic complex ACL (Lock and Key). This technique is described during CCNA4 Exploration.<\/p>\n

\n\tAbout Lock and Key<\/h2>\n

Description from the cisco web<\/a><\/p>\n

Lock-and-key is a traffic filtering security feature that dynamically filters IP protocol traffic. Lock-and-key is using IP dynamic extended access lists. When lock-and-key is configured, designated users whose IP traffic is normally blocked at a router can gain temporary access through the router. When triggered, lock-and-key reconfigures the interface’s existing IP access list to permit designated users to reach their designated host(s). Afterwards, lock-and-key reconfigures the interface back to its original state.<\/cite><\/p>\n

For a user to gain access to a host through a router with lock-and-key configured, the user must first open a Telnet session to the router. When a user initiates a standard Telnet session to the router, lock-and-key automatically attempts to authenticate the user. If the user is authenticated, they will then gain temporary access through the router and be able to reach their destination host.<\/cite><\/p>\n

 <\/p>\n

\n\tTopology<\/strong><\/h2>\n

In this example I will use following topology emulated inside of the GNS3\/Dynagen. Routers will have only basic configuration (IP adresses, names, RIP routing).<\/p>\n

 <\/p>\n

|—-FA0\/0-(192.168.1.0\/24)—-|Left<\/b>|—-fa1\/0—-(1.0.0.0\/24)—-sfa0\/0—-|Right<\/b>|—-Fa1\/0-(2.0.0.0\/8)—-|<\/p>\n

 <\/p>\n

\n\tGNS3 config<\/strong><\/h2>\n
autostart = True\n[qemu localhost]\n    workingdir = C:\\Program Files\\GNS3\\labs\\secure-lab_working\n    udp = 20000\n[localhost:7200]\n    workingdir = C:\\Program Files\\GNS3\\labs\\secure-lab_working\n    udp = 10000\n    [[2621XM]]\n        chassis = 2621XM\n        image = C:\\Program Files\\Dynamips\\images\\c2600-adventerprisek9-mz.124-17.image\n        ram = 128\n        ghostios = True\n        sparsemem = True\n        idlepc = 0x80248674\n    [[2691]]\n        image = C:\\Program Files\\Dynamips\\images\\c2691-i-mz.123-22.image\n        idlepc = 0x60559bc8\n        ghostios = True\n        sparsemem = True\n    [[ROUTER R1]]\n        model = 2691\n        console = 2007\n        f0\/1 = R7 f0\/0\n        slot1 = NM-1FE-TX\n        x = -107.0\n        y = -38.0\n    [[ROUTER R2]]\n        model = 2621XM\n        console = 2008\n        f0\/0 = R6 f0\/1\n        x = 43.0\n        y = -106.0\n[GNS3-DATA]\n    configs = secure-lab_configs\n    workdir = secure-lab_working\n<\/pre>\n
Basic router configuration<\/strong><\/p>\n
Configuration of the IP addressing and RIP v2 routing, everything works.<\/p>\n
 <\/p>\n
Router Left<\/strong><\/p>\n
interface FastEthernet0\/0\n ip address 192.168.1.11 255.255.255.0\n duplex auto\n speed auto\n!\ninterface FastEthernet0\/1\n ip address 1.0.0.1 255.255.255.0\n speed auto\n half-duplex\n!\n\nrouter rip\n version 2\n network 1.0.0.0\n network 192.168.1.0\n!<\/pre>\n
 <\/p>\n
Router Right<\/strong><\/p>\n
interface FastEthernet0\/0\n ip address 1.0.0.2 255.255.255.0\n speed auto\n half-duplex\n!\ninterface FastEthernet0\/1\n ip address 2.0.0.1 255.0.0.0\n duplex auto\n speed auto\n no keepalive\n!\nrouter rip\n version 2\n network 1.0.0.0\n network 2.0.0.0\n!\n<\/pre>\n
\n\tConfiguring Lock and Key ACL<\/h2>\n
The example target is to unlock traffic for any traffic after telnet login.<\/p>\n
 <\/p>\n
I need to define the name of the user which may unlock the ACL<\/p>\n
username palo password my_password<\/span><\/pre>\n
Then I will define ACL which consist of three entries, first entry will help pass RIP updates through the interface, next entry defines from which nets users may  do telnet login to unlock ACL. Third entry define dynamic ACL entry (template) which will be temporary installed after sucesfull login and executing access autocommand. It allows all IP traffic from any net to pass through the Left router. This entry is ignored tilll lock-and-key is not triggered.<\/span><\/p>\n
access-list 111 permit udp any any<\/span> \naccess-list 111 permit tcp any host 1.0.0.1 eq telnet<\/span>\naccess-list 111 dynamic my_dynamic permit ip any any<\/span><\/pre>\n
\n\t <\/div>\n
 There should be defined time period for which the temporary dynamic ACL created like :<\/p>\n
access-list 111 dynamic my_dynamic timeout 120 permit ip any any\n<\/pre>\n
Next I will configure VTY line to use local authentication and autocommand execution, which will install Dynamic ACL entry after sucesfull telnet login.<\/p>\n
line vty 0 4\n autocommand  access-enable timeout 5    <\/span>\n login local <\/span><\/pre>\n
and at last do not forget apply the ACL on the interface<\/p>\n
 <\/p>\n
From the web:<\/strong><\/p>\n
 <\/p>\n
\n\tIn the autocommand<\/span> command, the timeout is the idle timeout. In this example, each time the user logs in or authenticates there is a 5-minute session. If there is no activity, the session closes in 5 minutes and the user has to reauthenticate. If the user uses the connection, the absolute time takes affect and the session closes in 120 minutes. <\/cite><\/p>\n
\n\tAfter a user opens a Telnet session into the router, the router will attempt to authenticate the user. If authentication is successful, the autocommand<\/b> executes and the Telnet session terminates. The autocommand<\/b> creates a temporary inbound access list entry at the Ethernet 0 interface, based on the second access-list entry (mytestlist). This temporary entry will expire after 5 minutes, as specified by the timeout. <\/cite><\/p>\n
 <\/p>\n
 <\/p>\n
Verifying the ACL<\/strong><\/p>\n
Left#sh access-lists <\/span>\n\nExtended IP access list 111\n    5 permit udp any any\n    10 permit tcp any host 1.0.0.1 eq telnet\n    20 Dynamic my_dynamic permit ip any any\n<\/pre>\n
Deleting dynamic ACL entries<\/strong><\/p>\n
Router# clear access-template<\/b> [access-list-number <\/em>| name<\/em>] [dynamic-name<\/em>] [source<\/em>] [destination<\/em>] <\/span><\/pre>\n
or exactly in this example<\/p>\n
Left#clear access-template 111 my_dynamic 1.0.0.0 0.255.255.255 any\n<\/pre>\n
\n\tFunctionality testing<\/h2>\n
 <\/p>\n
    \n
  1. \n\t\tNo ACL applied, we will ping the fa 0\/0 interface of the Left router<\/li>\n<\/ol>\n
    Right#ping 192.168.1.11\n\nType escape sequence to abort.\nSending 5, 100-byte ICMP Echos to 192.168.1.11, timeout is 2 seconds:\n!!!!!\n\n<\/pre>\n
     <\/p>\n
      \n
    1. \n\t\tWithout telnet login no connection from the Right router<\/li>\n<\/ol>\n
      First we will apply the ACL 111 on the fa0\/1 interface of the Left router<\/p>\n
      Left(config-if)#int fa 0\/1\nLeft(config-if)#ip access-group 111 in\n<\/pre>\n
      there is no ping reply.<\/p>\n
      Right#ping 192.168.1.11\n\nType escape sequence to abort.\nSending 5, 100-byte ICMP Echos to 192.168.1.11, timeout is 2 seconds:\n.....\nSuccess rate is 0 percent (0\/5)\n\n<\/pre>\n
      Left#sh ip access-lists\nExtended IP access list 111\n    5 permit udp any any\n    10 permit tcp any host 1.0.0.1 eq telnet\n    20 Dynamic my_dynamic permit ip any any\n<\/pre>\n
      3. now i will do telnet login from Right to unlock the ACL. The telnet session will be closed, but dynamic acl entry will be installed.<\/p>\n
      Right#1.0.0.1\nTrying 1.0.0.1 ... Open\n\nUser Access Verification\n\nUsername: palo\nPassword:\n\n[Connection to 1.0.0.1 closed by foreign host]\n<\/pre>\n
      the dynamic entry is installed (yellow)<\/p>\n
      Left#sh ip access-lists\nExtended IP access list 111\n    5 permit udp any any (12 matches)\n    10 permit tcp any host 1.0.0.1 eq telnet (81 matches)\n    20 Dynamic my_dynamic permit ip any any\n       permit ip 1.0.0.0 0.255.255.255 any <\/span><\/pre>\n
      ping will be sucesfull<\/p>\n
      Right#ping 192.168.1.11\n\nType escape sequence to abort.\nSending 5, 100-byte ICMP Echos to 192.168.1.11, timeout is 2 seconds:\n!!!!!\nSuccess rate is 100 percent (5\/5), round-trip min\/avg\/max = 8\/39\/73 ms\nRight#\n<\/pre>\n
      Left#sh ip access-lists\nExtended IP access list 111\n    5 permit udp any any (30 matches)\n    10 permit tcp any host 1.0.0.1 eq telnet (81 matches)\n    20 Dynamic my_dynamic permit ip any any\n       permit ip 1.0.0.0 0.255.255.255 any (15 matches) (time left 264)\n<\/pre>\n
      if I will clear dynamic entry now, the ping will fail<\/p>\n
      Left#clear access-template 111 my_dynamic 1.0.0.0 0.255.255.255 any\n<\/pre>\n
      Right#ping 192.168.1.11\n\nType escape sequence to abort.\nSending 5, 100-byte ICMP Echos to 192.168.1.11, timeout is 2 seconds:\n.....\nSuccess rate is 0 percent (0\/5)\n<\/pre>\n
      \n\t The command review<\/h2>\n
      username palo password my_password\n\naccess-list 111 permit udp any any\naccess-list 111 permit tcp any host 1.0.0.1 eq telnet\naccess-list 111 dynamic my_dynamic permit ip any any\naccess-list 111 dynamic my_dynamic timeout 120 permit ip any any\n\nline vty 0 4\n autocommand  access-enable timeout 5   \n login local\nexit\nint fa 0\/0\nip access-group 111 in\n<\/pre>","protected":false},"excerpt":{"rendered":"
      \n\tIn this article I will configure dynamic complex ACL (Lock and Key). This technique is described during CCNA4 Exploration.<\/p>\n
      \n\tAbout Lock and Key<\/h2>\n
      \n\tDescription from the cisco web<\/a><\/p>","protected":false},"author":9,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","_kad_blocks_custom_css":"","_kad_blocks_head_custom_js":"","_kad_blocks_body_custom_js":"","_kad_blocks_footer_custom_js":"","_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"footnotes":""},"categories":[697,765],"tags":[],"class_list":["post-275","post","type-post","status-publish","format-standard","hentry","category-ccna-en","category-security-en"],"taxonomy_info":{"category":[{"value":697,"label":"CCNA"},{"value":765,"label":"Security"}]},"featured_image_src_large":false,"author_info":{"display_name":"palo73","author_link":"https:\/\/nil.uniza.sk\/en\/author\/palo73\/"},"comment_info":6,"category_info":[{"term_id":697,"name":"CCNA","slug":"ccna-en","term_group":0,"term_taxonomy_id":695,"taxonomy":"category","description":"","parent":695,"count":12,"filter":"raw","cat_ID":697,"category_count":12,"category_description":"","cat_name":"CCNA","category_nicename":"ccna-en","category_parent":695},{"term_id":765,"name":"Security","slug":"security-en","term_group":0,"term_taxonomy_id":763,"taxonomy":"category","description":"","parent":747,"count":3,"filter":"raw","cat_ID":765,"category_count":3,"category_description":"","cat_name":"Security","category_nicename":"security-en","category_parent":747}],"tag_info":false,"_links":{"self":[{"href":"https:\/\/nil.uniza.sk\/en\/wp-json\/wp\/v2\/posts\/275","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nil.uniza.sk\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nil.uniza.sk\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nil.uniza.sk\/en\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/nil.uniza.sk\/en\/wp-json\/wp\/v2\/comments?post=275"}],"version-history":[{"count":0,"href":"https:\/\/nil.uniza.sk\/en\/wp-json\/wp\/v2\/posts\/275\/revisions"}],"wp:attachment":[{"href":"https:\/\/nil.uniza.sk\/en\/wp-json\/wp\/v2\/media?parent=275"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nil.uniza.sk\/en\/wp-json\/wp\/v2\/categories?post=275"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nil.uniza.sk\/en\/wp-json\/wp\/v2\/tags?post=275"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}