Put-Technology-to-Work/ACL/Access-Control-List.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Access Control List"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## What is Access Control Lists?"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Based on your business needs, you may have to permit or deny the access of users and devices in or out of your network. With Access Control List (ACL) you can restrict the traffic in a network."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "ACL uses rules to determine whether to permit or deny traffic based on source and destination IP addresses, source port and destination port, and the protocol of the packet.\n",
    "\n",
    "Use ACL to:\n",
    "* Filter incoming or outgoing packets on an interface\n",
    "* Filter packets for mirroring\n",
    "* Redirect traffic as required\n",
    "* Restrict the contents of routing updates\n",
    "* Limit debug output based on an address or protocol. \n",
    "* Identify or classify traffic for advanced features, such as congestion avoidance, congestion management, and priority and custom queueing. "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Configuration Steps"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "\n",
    "* [Bring Up Emulator](#step1)\n",
    "* [Create and Apply ACL](#step2)\n",
    "* [Verify the ACL configuration](#step3)\n",
    "* [Modify the ACL configuration](#step4)\n",
    "\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### <a name=\"step1\"></a>Bring up Your Emulator\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "In the cell below, the python module acl contains the code to set up the python environment, the simulated 2-router topology. The sim.start() API brings up the emulator as per the network topology. Refer the acl.py file in this repository to have a look at the python module.\n",
    "\n",
    "You have to execute the cell below by clicking the play button."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "from acl import *\n",
    "sim = Vxr()\n",
    "sim.no_image_copy=True\n",
    "sim.clean()\n",
    "print(\"Sim clean: Done\")\n",
    "print(\"Simulation starting. Please wait for the Sim status message. This may take 3-10 minutes.\")\n",
    "\n",
    "try:\n",
    "    sim.start(cfg)\n",
    "    ports=sim.ports()\n",
    "    print(ports)\n",
    "    status = sim.status()\n",
    "    print(\"Sim status: \", status)\n",
    "except Exception as err:\n",
    "    print(\"Sim launch failed (%s)\" % str(err))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    ">Play the cell below to obtain the telnet and ssh IP-addresses and ports to access the devices."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Consoles can be reached by:\n",
      "telnet 172.17.0.2 41147 \n",
      " telnet 172.17.0.2 44917\n",
      "or better:\n",
      "ssh cisco@172.17.0.2 -p62147 \n",
      " ssh cisco@172.17.0.2 -p63048\n",
      "The password is cisco123\n"
     ]
    }
   ],
   "source": [
    "print('Consoles can be reached by:')\n",
    "print(get_telnet_cmd(sim, 'r1'), '\\n', get_telnet_cmd(sim, 'r2'))\n",
    "print('or better:')\n",
    "print(get_ssh_cmd(sim, 'r1'), '\\n', get_ssh_cmd(sim, 'r2'))\n",
    "print('The password is cisco123')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    ">The cell below accesses the telnet consoles of the routers so that we can apply the required ACL configuration from this notebook."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [],
   "source": [
    "import telnetlib\n",
    "ports = sim.ports()\n",
    "loginr1 = telnetlib.Telnet(str(ports['r1']['HostAgent']) , str(ports['r1']['serial0']))\n",
    "loginr2 = telnetlib.Telnet(str(ports['r2']['HostAgent']) , str(ports['r2']['serial0']))\n",
    "\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Create and Apply ACL <a name=\"step2\"></a> "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    ">In this notebook, let's see how to add rules using ACL to permit or deny traffic from a particular IP address. In this example, we will first allow traffic from 198.51.100.2.  Play the cell below to create the access list, then define the rules to permit trafffic from 198.51.100.2. Finally, apply the rules to an interface FourHundredGigE0/0/0/0."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "***** VIEW FROM TELNET CONSOLE *****\n",
      "\n",
      "RP/0/RP0/CPU0:P1#configure\n",
      "Fri Apr 23 05:56:17.264 UTC\n",
      "RP/0/RP0/CPU0:P1(config)#ipv4 access-list myacl\n",
      "RP/0/RP0/CPU0:P1(config-ipv4-acl)#1 permit ipv4 host 198.51.100.2 any\n",
      "RP/0/RP0/CPU0:P1(config-ipv4-acl)#exit\n",
      "RP/0/RP0/CPU0:P1(config)#interface FourHundredGigE0/0/0/0\n",
      "RP/0/RP0/CPU0:P1(config-if)#ipv4 access-group myacl ingress\n",
      "RP/0/RP0/CPU0:P1(config-if)#commit\n",
      "Fri Apr 23 05:56:17.763 UTC\n",
      "RP/0/RP0/CPU0:P1(config-if)#root\n",
      "RP/0/RP0/CPU0:P1(config)#exit\n",
      "RP/0/RP0/CPU0:P1#\n",
      "RP/0/RP0/CPU0:P1#\n"
     ]
    }
   ],
   "source": [
    "loginr1.write(('''\n",
    "configure\n",
    "ipv4 access-list myacl\n",
    "1 permit ipv4 host 198.51.100.2 any\n",
    "exit\n",
    "interface FourHundredGigE0/0/0/0\n",
    "ipv4 access-group myacl ingress\n",
    "commit\n",
    "root\n",
    "exit\n",
    "\n",
    "''').encode('ascii'))\n",
    "line = loginr1.read_until(b'/r/n',2)\n",
    "print(\"***** VIEW FROM TELNET CONSOLE *****\")\n",
    "print(line.decode())"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Verify ACL Configuration <a name=\"step3\"></a> "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    ">Play the below cell to verify if the ACL configuration applied on the router."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "***** VIEW FROM TELNET CONSOLE *****\n",
      "\n",
      "RP/0/RP0/CPU0:P1#show ip access-lists\n",
      "Fri Apr 23 05:56:19.434 UTC\n",
      "ipv4 access-list myacl\n",
      " 1 permit ipv4 host 198.51.100.2 any\n",
      "RP/0/RP0/CPU0:P1#\n"
     ]
    }
   ],
   "source": [
    "loginr1.write(('''\n",
    "show ip access-lists\n",
    "''').encode('ascii'))\n",
    "line = loginr1.read_until(b'/r/n',2)\n",
    "print(\"***** VIEW FROM TELNET CONSOLE *****\")\n",
    "print(line.decode())"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "> Let's see if the traffic is allowed from 198.51.100.2 using the Ping command."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "***** VIEW FROM TELNET CONSOLE *****\n",
      "\n",
      "RP/0/RP0/CPU0:P1#ping ipv4 198.51.100.2 count 20\n",
      "Fri Apr 23 05:56:21.438 UTC\n",
      "Type escape sequence to abort.\n",
      "Sending 20, 100-byte ICMP Echos to 198.51.100.2, timeout is 2 seconds:\n",
      "!!!!!!!!!!!!!!!!!!!!\n",
      "Success rate is 100 percent (20/20), round-trip min/avg/max = 10/12/34 ms\n",
      "RP/0/RP0/CPU0:P1#\n"
     ]
    }
   ],
   "source": [
    "loginr1.write(('''\n",
    "ping ipv4 198.51.100.2 count 20\n",
    "''').encode('ascii'))\n",
    "line = loginr1.read_until(b'/r/n',2)\n",
    "print(\"***** VIEW FROM TELNET CONSOLE *****\")\n",
    "print(line.decode())"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Yes, Ping is successful and the traffic is permitted."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Modify the ACL Configuration <a name=\"step3\"></a> "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Now, let's restrict the traffic from 198.51.100.2 by modifying the ACL configuration."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "***** VIEW FROM TELNET CONSOLE *****\n",
      "\n",
      "RP/0/RP0/CPU0:P1#configure\n",
      "Fri Apr 23 05:56:25.559 UTC\n",
      "RP/0/RP0/CPU0:P1(config)#ipv4 access-list myacl\n",
      "RP/0/RP0/CPU0:P1(config-ipv4-acl)#1 deny ipv4 host 198.51.100.2 any\n",
      "RP/0/RP0/CPU0:P1(config-ipv4-acl)#exit\n",
      "RP/0/RP0/CPU0:P1(config)#interface FourHundredGigE0/0/0/0\n",
      "RP/0/RP0/CPU0:P1(config-if)#ipv4 access-group myacl ingress\n",
      "RP/0/RP0/CPU0:P1(config-if)#commit\n",
      "Fri Apr 23 05:56:26.079 UTC\n",
      "RP/0/RP0/CPU0:P1(config-if)#root\n",
      "RP/0/RP0/CPU0:P1(config)#exit\n",
      "RP/0/RP0/CPU0:P1#\n",
      "RP/0/RP0/CPU0:P1#\n"
     ]
    }
   ],
   "source": [
    "loginr1.write(('''\n",
    "configure\n",
    "ipv4 access-list myacl\n",
    "1 deny ipv4 host 198.51.100.2 any\n",
    "exit\n",
    "interface FourHundredGigE0/0/0/0\n",
    "ipv4 access-group myacl ingress\n",
    "commit\n",
    "root\n",
    "exit\n",
    "\n",
    "''').encode('ascii'))\n",
    "line = loginr1.read_until(b'/r/n',2)\n",
    "print(\"***** VIEW FROM TELNET CONSOLE *****\")\n",
    "print(line.decode())"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Veriy the configuration with a show command."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "***** VIEW FROM TELNET CONSOLE *****\n",
      "\n",
      "RP/0/RP0/CPU0:P1#show ip access-lists\n",
      "Fri Apr 23 05:56:27.564 UTC\n",
      "ipv4 access-list myacl\n",
      " 1 deny ipv4 host 198.51.100.2 any\n",
      "RP/0/RP0/CPU0:P1#\n"
     ]
    }
   ],
   "source": [
    "loginr1.write(('''\n",
    "show ip access-lists\n",
    "''').encode('ascii'))\n",
    "line = loginr1.read_until(b'/r/n',2)\n",
    "print(\"***** VIEW FROM TELNET CONSOLE *****\")\n",
    "print(line.decode())"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "> Let's see if the traffic is allowed from 198.51.100.2 using the Ping command."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "***** VIEW FROM TELNET CONSOLE *****\n",
      "\n",
      "RP/0/RP0/CPU0:P1#ping ipv4 198.51.100.2 count 5\n",
      "Fri Apr 23 05:56:32.121 UTC\n",
      "Type escape sequence to abort.\n",
      "Sending 5, 100-byte ICMP Echos to 198.51.100.2, timeout is 2 seconds:\n",
      "\n"
     ]
    }
   ],
   "source": [
    "loginr1.write(('''\n",
    "ping ipv4 198.51.100.2 count 5\n",
    "''').encode('ascii'))\n",
    "line = loginr1.read_until(b'/r/n',2)\n",
    "print(\"***** VIEW FROM TELNET CONSOLE *****\")\n",
    "print(line.decode())"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "> Router R1 is unable to connect to 198.51.100.2. So the traffic is denied from 198.51.100.2. You can again modify the ACL configuration to permit traffic from 198.51.100.2."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Once you finished you can shutdown the topology and clean up."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {},
   "outputs": [],
   "source": [
    "# close our telnet\n",
    "loginr1.close()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "INFO:pyvxr.vxr:Stopping sim on host localhost (dir /nobackup/vxr/pyvxr/68ot1y7amv)\n",
      "INFO:pyvxr.sim:Stopping previous simulation (if any)\n",
      "INFO:pyvxr.vxr:Cleaning sim on host localhost (dir /nobackup/vxr/pyvxr/68ot1y7amv)\n",
      "INFO:pyvxr.sim:Stopping previous simulation (if any)\n",
      "INFO:pyvxr.sim:Cleaning previous simulation (if any)\n"
     ]
    }
   ],
   "source": [
    "# Close the sim\n",
    "sim.stop()\n",
    "sim.clean()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "> Clean up the sim scratch-space - delete the sim directory "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {},
   "outputs": [],
   "source": [
    "shutil.rmtree(sim_dir)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.8.8"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}