Dynamic (Lock-and-Key) Access Lists

Dynamic (Lock-and-Key) Access Lists

Assume the network is secured with ACLs regulating traffic in, out, and through the network. Decisions were made to be conservative in allowing traffic to access the resources. So everything that can be blocked is being dealt with. What if you need some flexibility to deal with some necessary exceptions? Dynamic access lists, often called lock-and-key access lists, can literally create temporary openings to your network for specific IP traffic.

Figure 5-3 shows an example of a company network that might have limited TCP access to the internal networks to those sessions that originated from within the LAN. To accomplish this, they might have used the TCP ACL established option. The organization still wants to allow the network administrators access from the outside to reduce the number of evening and weekend callouts, particularly for forgotten passwords, locked accounts, and so forth.

Figure 5-3: Simple example of lock-and-key access

The point of lock-and-key is to grant temporary IP access to specific hosts that would normally be blocked. The process works like this:

1. A user Telnets to the router configured with the dynamic ACL. The router can be a perimeter router protecting the entire network or an internal router protecting certain segments.

2. The router challenges the user to authenticate. The authentication method used is whatever security has been applied to Telnet sessions (line vty settings) in the router configuration. Options include using standard passwords, local user name/ password entries, or AAA.

3. Once successfully authenticated, the Telnet session is terminated and the router creates a temporary ACL that allows traffic between the specific host(s) and resources defined in the ACL statements.

4. The user(s) can then have temporary access through the router.

5. When the time limit defined in the ACL is reached, the temporary ACL list is removed and a new authentication is required to continue.

Properly configured, dynamic access lists provide the same benefits as standard and static extended access lists with the additional security benefit of authenticating users, thereby reducing the opportunity for network break-ins by hackers.