Details
This command places the router in access-list configuration mode, where you must define the denied or permitted access conditions by using the deny and permit commands.
Rationale:
Configuring access controls can help prevent spoofing attacks. To reduce the effectiveness of IP spoofing, configure access control to deny any traffic from the external network that has a source address that should reside on the internal network. Include local host address or any reserved private addresses (RFC 1918).
Ensure the permit rule(s) above the final deny rule only allow traffic according to your organization’s least privilege policy.
Impact:
Organizations should plan and implement enterprise security policies explicitly permitting and denying access based upon access lists. Using the ‘ip access-group’ command enforces these policies by explicitly identifying groups permitted access.
Solution
Apply the access-group for the external (untrusted) interface
hostname(config)#interface {external_interface}
hostname(config-if)#ip access-group {name | number} in
Default Value:
No access-group defined
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: System and Communications Protection.This control applies to the following type of system Cisco.