Project Update: HSRP and Access Control Lists

HSRP
As I thought I had already configured HSRP, I ran into issues when configuring ACLs where the HSRP configuration wasn't finished and needed some attention. I booted up Packet Tracer and configured a topology containing one of the two building networks. From there, I discovered my issues with the HSRP configuration.

First of all, as I had just configured HSRP running on only the Student and Staff networks of a single building, copying the configs and modifying to suit wasn't too bad, however DHCP and the VLANs needed to be altered as Building A only houses access to the Student LAN, Staff LAN, Staff Wireless and Guest Wireless. All that needed doing was adding a base config on top of the already configured VLAN interfaces. As an example of the final configuration for HSRP on Building B Switch 1, for the Students VLAN:

#BBS1
interface vlan 10
 description STUDENTS-B #describing the VLAN network
 ip address 10.3.255.252 255.255.0.0 #allocating a static IP address
 standby version 2 #configuring the HSRP version.
 standby 10 ip 10.3.255.254 #configuring HSRP virtual IP address.
 standby 10 preempt #enabling preemption, see below for more details.
 standby 10 priority 110 #increasing the priority over the alternative link.

 ip helper 10.0.2.22 #DHCP helper address.

I have changed the older configuration to include 'standby 10 preempt' and 'standby 10 priority 110'. The keyword 'preempt' enables preemption which will allow a device to automatically go to ACTIVE state alongside it's peer, which will go to the STANDBY state. Basically, if the priority command was not issued, the first device to boot would become the ACTIVE virtual forwarder. Based on the output above, BBS1 will become the ACTIVE virtual forwarder for HSRP group 10, due to the higher priority. BBS2 will become the STANDBY virtual forwarder for the group.

Access Control Lists (ACLs)

I found a fair bit of issue when thinking about how to go about configuring ACLs. As I don't know what to block and what to allow, it was difficult coming up with a baseline to follow in the future. However, with the help of packet tracer I have managed to configure the ACLs on Building A, and partially on Building B. In order to finalize the configuration, a list of protocols allowed to use the network must be obtained and configured correctly before adding to the ACL.

ip access-list extended BLK_STUDENTS
10 permit udp any eq bootpc any eq bootps #allow DHCP messages
20 permit udp host 10.2.255.253 eq 1985 host 224.0.0.102 eq 1985 #allow HSRP messages.
30 permit ip 10.0.3.0 0.0.0.127 any #allow traffic from management network
        40 permit tcp 10.2.0.0 0.0.255.255 any ack #allow acks from student network.
        50 deny tcp 10.2.0.0 0.0.255.255. any syn #disallow syn from student network.
1000 deny ip any any log #disallow anything not explicitly allowed above.

The above allows the devices to receive DHCP allocated address, and also allow the two multi-layer switches to do HSRP. The management network is allowed into the student network, but student devices are only able to respond to TCP ack messages, not initiate syn messages.

A bit of experimental ICMP protection that I've covered is to prevent devices from snooping the network is to block echo responses that are in response to unreachable peers. The ICMP ACL is as follows:

ip access-list extended BLK_ICMP
remark ICMP-SECURITY #remark to show what the following commands suggest.
970 deny icmp any any net-unreachable #block net-unreachable messages.
980 deny icmp any any port-unreachable #block port-unreachable messages.

990 deny icmp any any host-unreachable #block host-unreachable messages.

It's a work in progress but I hope it will prevent snooping of devices based on the response from pinging other devices in other networks.