Packet Filtering with ACLs

Access control lists (ACLs) provide a basic level of security for network access. Without any ACLs
configured on a router, all packets pass through the router and onto the network. ACLs can be
configured on a router that is positioned between two parts of the network to control traffic that is
entering or exiting a specific part of the internal network. An ACL on the router, for example, can
allow one host to access a part of the network while, at the same time, preventing another host from
accessing that same area.

In the figure, the ACL allows Host A to access the human resources network but prevents Host B
from accessing the human resources network.

To provide the security benefits of ACLs, at a minimum, configure ACLs at the network perimeter.
This configuration provides a basic buffer from the outside network, or from a less controlled area of
the network, onto network segments requiring more security. On these network edge routers, an
ACL should be configured for each network protocol that is configured on the router interfaces.