| 3.2 |  | Types of IP ACLs |
| 3.2.5 |  | Lock-and-key, dynamic ACLs |

| Lock-and-key configuration starts with applying an extended ACL to block traffic through the router. Users wanting to traverse the router are blocked by the extended ACL until they Telnet to the router and are authenticated . The Telnet connection then drops and a single entry dynamic ACL is added to the existing extended ACL. This will permit traffic for a particular time period. Idle and absolute timeouts are possible.

Figure is the command syntax format for configuring lock-and-key with local authentication. The single entry ACL in the Figure command will be dynamically added to the existing ACL after authentication.

The following is a basic example of lock-and-key . After the user at 10.1.1.2 makes a Telnet connection to 10.1.1.1, the dynamic ACL is applied. The connection is then dropped, and the user can go to the 172.16.1.x network.

When is it appropriate to use lock-and-key? Two general scenarios warrant a dynamic access list configuration:

1. Permission for a user, or group of users, to securely access a host within a protected network via the Internet is necessary. Lock-and-key authenticates the user and then permits limited access through a firewall router, but only for that individual's host or subnet, and only for a finite period of time.
2. Certain users on a remote network need to access a host on the corporate network protected by a firewall. Lock-and-key requires users to authenticate before allowing them to access the protected hosts.

The following steps summarize lock-and-key operation:

1. A user opens a Telnet session to a firewall router configured for lock-and-key. The user connects via one of the VTYs on the router.
2. The Cisco IOS receives the Telnet packet, opens a Telnet session, prompts the user for a username and password, and performs the authentication process. The authentication can be done by the router or by a security server such as a TACACS+ or RADIUS box. When a user passes authentication, he or she is logged out of the Telnet session, and the software creates a temporary entry in the dynamic access list. Depending on the configuration, this temporary entry can limit the range of networks to which the user is given temporary access.
3. The user exchanges data through the hole in the firewall.
4. The IOS deletes the temporary access list entry when a configured timeout is reached, or when the system administrator manually clears it. The configured timeout can be either an idle timeout or an absolute timeout. The temporary access-list entry is not automatically deleted when the user terminates a session. It remains until the timeout is reached or until it is cleared by the system administrator.

Cisco IOS releases prior to Release 11.1 are not compatible with dynamic access lists. Therefore, if a configuration file that includes a dynamic access list with IOS software older than Release 11.1 is used, the resulting access list will not be interpreted correctly. This could cause severe security problems.

| Web Links Configuring Lock-and-Key Security, Dynamic Access Lists http://www.cisco.com/en/US/products/sw/ iosswrel/ps1831/products_configuration _guide_chapter09186a00800d9814.html

| Lab Activity Lab Exercise : Lock-and-Key ACLs In this lab, students will configure a dynamic access list for lock-and-key security.