- If you're a Sys Admin, shielding sensitive, critical data
as well as your network resources from every possible
evil exploit is a top priority of yours.
Cisco has some really effective security solutions
to equip you with the tools you'll need to make this
happen in a very real way.
The first power tool is known as
the Access Control List, or ACL.
Access lists give network managers a huge amount of control
over traffic flow throughout the enterprise.
With access lists we can gather basic statistics
on packet flow and we can implement security policies.
These dynamic tools enable us to protect sensitive devices
from the dangers of unauthorized access.
An access lists is essentially a list of conditions
that categorize packets to be either permitted or denied.
They really come in handy when you need to exercise
control over network traffic.
One of the most common and easiest to understand uses
of access lists is to filter unwanted packets when
implementing security policies.
For example, you can set them up to make very specific
decisions about regulating traffic patterns so they'll only
allow certain hosts to access web resources on the Internet
while restricting others.
In medium to large enterprise networks,
the strategies for security are based on some mix
of internal, perimeter routers, plus firewall devices.
In this graphic, you can see where each of these types
of devices would be found.
Internal routers provide additional security by screening
traffic to various parts of the protected corporate network.
They achieve this using access lists.
I'll use the terms trusted network and untrusted network
throughout this chapter so it's important that you see
where they're found in a typical secured network.
The demilitarized zone, or DMZ,
can be either global or real Internet addresses
or private addresses,
depending on how you configure your firewall.
But this is typically where you'll find the HTTP, DNS,
email and other other Internet-type corporate servers.
Instead of using routers, we can create VLANs with switches
on the inside trusted network and multiple layer switches
containing their own security features can sometimes
replace internal LAN routers to provide higher performance
in VLAN architectures.
With the right combination of access lists,
network managers arm themselves with the power to enforce
nearly any security policy they can invent.