Information
This command places the router in access-list configuration mode, where you must define the denied or permitted access conditions by using the deny and permit commands.
Rationale:
Configuring access controls can help prevent spoofing attacks. To reduce the effectiveness of IP spoofing, configure access control to deny any traffic from the external network that has a source address that should reside on the internal network. Include local host address or any reserved private addresses (RFC 1918).
Ensure the permitrule(s) above the final denyrule only allow traffic according to your organization's least privilege policy.
Solution
Apply the access-group for the external (untrusted) interface
hostname(config)#interface {external_interface}
hostname(config-if)#ip access-group {name | number} in
Impact:
Organizations should plan and implement enterprise security policies explicitly permitting and denying access based upon access lists. Using the 'ip access-group' command enforces these policies by explicitly identifying groups permitted access.
Default Value:
No access-group defined
References:
http://www.cisco.com/en/US/docs/ios-xml/ios/interface/command/ir-i1.html#GUID-0D6BDFCD-3FBB-4D26-A274-C1221F8592DF
http://www.cisco.com/en/US/docs/ios-xml/ios/security/d1/sec-cr-i1.html#GUID-D9FE7E44-7831-4C64-ACB8-840811A0C993