By default in Cisco SD-WAN, each VPN0’s transport interface on every vEdge router has an implicit access list applied. Each implicit ACL allows or denies a specific type of network traffic referred to as a service. Only three services are permitted by default - DHCP, DNS, and ICMP. All other services are denied. We can enable additional services using the allowed-service command under the transport interface’s tunnel configuration, as shown in the output below: 

vEdge-1(config-tunnel-interface)# allow-service ?
Possible completions:
  all       Allow all traffic.
  bgp       Allow/deny BGP
  dhcp      Allow/deny DHCP
  dns       Allow/deny DNS
  https     Allow/deny HTTPS
  icmp      Allow/deny ICMP
  netconf   Allow/deny NETCONF
  ntp       Allow/deny NTP
  ospf      Allow/deny OSPF
  sshd      Allow/deny SSH
  stun      Allow/deny STUN

Why are implicit ACLs important?

The implicit access control lists that are applied on all transport interfaces by default are an essential part of Cisco SD-WAN's control-plane security portfolio. WAN edge routers have protection against DDoS attacks out of the box using a combination of control-plane policing and implicit ACL on the underlay, as shown in figure 1 below. 

Cisco SD-WAN vEdge DDoS Protection
Figure 1. Cisco SD-WAN vEdge DDoS Protection

What are Implicit ACLs?

Each transport interface of a vEdge router has an implicit access list applied by default. Some network engineers who have just started with Cisco SD-WAN tend to assume that every interface in VPN 0 is a transport one. However, a transport interface is a tunnel endpoint and has a local TLOC configuration - color and encapsulation. We can see in the output below that there are four interfaces in VPN 0, but only two of them are transport ones:

vEdge-1# show interface | t
                                            IF      IF      IF               
                      AF                    ADMIN   OPER    TRACKER          
0      ge0/0          ipv4     Up      Up      NA      transport
0      ge0/1          ipv4    Up      Up      NA      transport
0      ge0/6          ipv4    Up      Up      NA      service  
0      system         ipv4      Up      Up      NA      loopback 

Another essential point to emphasize is that an implicit access list on a transport interface only affects the traffic that comes in VPN 0 from the underlay network and is destined to the transport interface’s IP address. We see this illustrated in figure 2 below. 

Cisco SD-WAN Implicit ACLs
Figure 2. Cisco SD-WAN Implicit ACLs

The implicit ACL does not match the traffic that traverses the overlay tunnels established to this transport interface.

Allowing SSH to a vEdge router from the underlay 

In this lab example, we will enable SSH access to WAN edge routers 1 and 4 from the underlay network. To achieve this objective, we will allow the ssh service in the implicit access lists applied to the transport interfaces marked with the MPLS color on vEdge 1 and 4. 

Full Content Access is for Registered Users Only (it's FREE)...

  • Learn any CCNA, DevNet or Network Automation topic with animated explanation.
  • We focus on simplicity. Networking tutorials and examples written in simple, understandable language for beginners.