achille's lists...

i hate ACL's, firewalls, filters and especially window's stupid firewall...  as a network guy i figure it to be my sworn duty to allow access to the wire, to give john Q user  the unmitigated freedom of  byte exploration... a perfect world... of course it becomes evident that john Q user will eventually get himself or the network in some kind of trouble with this very freedom...  so we first open the door, then slam it shut...

the standard ACL is concerned with the source... not a lot of flexibility there...  however, standard acl's shine  when used with NAT for a quick, painless solution to get the private network users released into the wild...

extended and named acl's are another universe, providing more elegant examples of slamming the door on john Q user...

stepping back...  why are standard acl's best utilized nearest the destination, and extended acl's best utilized nearest the source, besides the fact that cisco and odom and lammle, et al, have been pounding this into our collective minds for years? processing and WAN overhead, that's why... stopping hitler at Munich, like Clemenza said...  filter that shit where it lives (extended) and block that shit before it gets in (standard)

filtering telnet is easy; just turn it off and use SSH and/or VPN instead...

disallowing ICMP onto your private network is another matter...

r2620_01(config)#ip access-list extended no_outside_pings
r2620_01(config-ext-nacl)#deny icmp any any echo log
r2620_01(config-ext-nacl)#permit ip any any
r2620_01(config-ext-nacl)#exit
r2620_01(config)#int s0/1
r2620_01(config-if)#ip access-group no_outside_pings in
r2620_01(config-if)#

then:

r2620_03#ping 10.0.30.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.30.1, timeout is 2 seconds:
U.U.U
Success rate is 0 percent (0/5)
r2620_03#

stardate log 2620_01:

r2620_01#
Dec 10 08:13:56.815: %SEC-6-IPACCESSLOGDP: list no_outside_pings denied icmp 10.
0.30.2 -> 10.0.30.1 (8/0), 5 packets
r2620_01#

but do yourself a favor... keep ping  alive on the LAN

ICMP is your lover...

ICMP

Part of the network layer; instrumental in controlling and managing, troubleshooting.  There is no transport header, the ICMP message resides inside an IP packet.  Rfc 792

Echo request/reply

Sent and received by ping.  Pinging means sending an echo request.  Any data sent in echo request is returned in echo reply.  See extended ping.

Destination unreachable

1) network unreachable-no match in routing table at destination- sent by router

2) host unreachable- routes to destination network but no host response- sent by router

3)  can’t fragment- don’t fragment bit is set and a router must fragment in order to forward the packet (packet too large)- sent by router

4) protocol unreachable(unlikely, TCP or UDP)- delivered to host but layer 4 (transport) protocol is not available- sent by host

5) port unreachable- delivered to host, but destination port is not open- sent by host

ping codes: ! = echo received

                   . = nothing received before ping time out

                 U = unknown host

                 N = unknown network

                 P = unreachable port

                Q = source quench

                M = can’t fragment code

                 ? = packet unknown

Time exceeded

TTL (time to live) field in IP header has expired, therefore discarded (decremented by a router before forwarding; at zero, see ya) TRACE uses time exceeded

Redirect 

Used to tell the host there is a better local router to ship the packet to

a poor man's routing...

routing rudiments... 

given: hosts are directly connected, host_A pings host_B

with a nod to lammle, odom, et al

1) host_A creates an echo request for host_B (ICMP)

2) ICMP hands the request to IP, which makes a packet that contains the IP source address, the IP destination address and a protocol field

3) IP determines whether the destination is a local or remote network

4) in this case it is remote, so the packet needs to go to the remote network determined by host_A’s OS (default gateway 172.16.10.1)

5) the MAC address of 172.16.10.1 (E0) is known by host_A. this supposes the arp cache has resolved E0’s IP address to a hardware address. (the output of arp -a will display E0’s MAC address) the packet will be framed by the datalink layer and shipped to the MAC address of E0. hosts only communicate with MAC addresses on the local network

6) if not already resolved, the host sends an arp broadcast to the local network. Upon receipt of the resolution, the host cache’s the MAC address of E0 and encapsulates the packet in a frame with control information.

In both the above cases (hardware address known, hardware address resolved) the framed destination MAC address (E0) and source MAC address (host_A), an ether-type field (network layer IP), the packet, and FCS (frame check sequence which holds the result of a cyclic redundancy check CRC) are shipped to the MAC address of the default gateway, not the MAC address of the remote host

7) the frame thusly prepared, is ready to traverse the physical layer bit by bit

8) at the router, the packet is taken from the frame and off loaded to IP. The remainder of the frame is discarded.

a good place to jump