Professional Documents
Culture Documents
CCNA2 Lab Inst 11-2-1b en
CCNA2 Lab Inst 11-2-1b en
Objective
Plan, configure, and apply a standard ACL to permit or deny specific traffic and test the ACL to
determine if the desired results were achieved.
Scenario
The company home office in Gadsden (GAD) provides services to branch offices such as the
Birmingham (BHM) office. These offices have some minor security and performance concerns. A
Standard ACL needs to be implemented as a simple and effective tool to control traffic
340 - 833
Infrastructure
Host #3 represents the kiosk station that needs to have its access limited to the local network.
Host #4 represents another host in the BHM office and the Loopback 0 interface on the GAD router
represents the Internet.
341 - 833
c.
From this logic the actual ACL will be written. Using the tables below, document the information
for each statement.
Source address
192.168.3.2
Wildcard mask
0.0.0.0
Source address
0.0.0.0
Wildcard mask
255.255.255.255
d. What would be the result of not including a statement to permit all other source addresses?
Every packet going into that interface would be denied due to the implicit deny any any
statement.
e. What would be the result of reversing the order of the 2 statements in the list?
The ACL tests packets in the order in which the ACL was written. Therefore, if the packet is sent
past the permit any any statement first, the deny statement does not take place.
f.
g. The final step in the planning process is to determine the best location for the access list and the
direction the list should be applied. Examine the internetwork diagram and choose the
appropriate interface and direction. Document this in the table below:
Router
Interface
Direction
BHM
E0
in*
Note:* This may also be applied to S0 out to stop traffic to the GAD.
b. Add to this text file the configuration statements to apply the list.
The configuration statements take the form of:
342 - 833
c.
Now the text file configuration needs to be applied to the router. Enter the configuration mode on
the appropriate router and copy and paste the configuration. Observe the CLI display to ensure
no errors were encountered.
Finally, test the functionality of the ACL by trying to send packets from the source host and verify
that is to be permitted or denied as appropriate. In this case, ping will be used to test this.
[ x ] verify that host 3 CAN ping host 4
[ x ] verify that host 3 CANNOT ping host 1
[ x ] verify that host 3 CANNOT ping host 2
[ x ] verify that host 3 CANNOT ping GAD Fa0/0E0
[ x ] verify that host 3 CANNOT ping GAD LO0
[ x ] verify that host 4 CAN ping host 1
[ x ] verify that host 4 CAN ping host 2
[ x ] verify that host 4 CAN ping GAD Fa0/0E0
[ x ] verify that host 4 CAN ping GAD LO0
344 - 833
Once finished, erase the start-up configuration on routers, remove and store the cables and
adapter. Also logoff and turn the router off.
345 - 833
Ethernet
Interface #1
Ethernet 0 (E0)
Ethernet 0 (E0)
FastEthernet 0 (FA0)
Ethernet 0 (E0)
FastEthernet 0/0
(FA0/0)
Ethernet
Interface #2
Ethernet 1 (E1)
Ethernet 1 (E1)
FastEthernet 1 (FA1)
Ethernet 1 (E1)
FastEthernet 0/1 (FA0/1)
Serial
Interface #1
Serial
Interface #2
Serial 0 (S0)
Serial 0 (S0)
Serial 0 (S0)
Serial 0/0 (S0/0)
Serial 1 (S1)
Serial 1 (S1)
Serial 1 (S1)
Serial 0/1
(S0/1)
Interface
#5
In order to find out exactly how the router is configured, look at the interfaces. This will identify the type of router
as well as how many interfaces the router has. There is no way to effectively list all of the combinations of
configurations for each router class. What is provided are the identifiers for the possible combinations of interfaces
in the device. This interface chart does not include any other type of interface even though a specific router may
contain one. An example of this might be an ISDN BRI interface. The string in parenthesis is the legal abbreviation
that can be used in IOS command to represent the interface.
346 - 833
BHM#show running-config
Building configuration...
Current configuration:
!
version 12.0
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname BHM
!
ip subnet-zero
!
ip audit notify log
ip audit po max-events 100
!
process-max-time 200
!
interface Ethernet0
ip address 192.168.3.1 255.255.255.0
ip access-group 1 in
no ip directed-broadcast
!
interface Serial0
ip address 192.168.2.2 255.255.255.0
no ip directed-broadcast
no ip mroute-cache
no fair-queue
clockrate 64000
!
interface Serial1
no ip address
no ip directed-broadcast
shutdown
!
router rip
network 192.168.2.0
network 192.168.3.0
!
ip classless
no ip http server
!
access-list 1 deny
192.168.3.2
access-list 1 permit any
!
line con 0
transport input none
line aux 0
line vty 0 4
!
no scheduler allocate
end
347 - 833
GAD#show running-config
Building configuration...
Current configuration:
!
version 12.0
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname GAD
!
memory-size iomem 10
ip subnet-zero
!
ip audit notify log
ip audit po max-events 100
!
process-max-time 200
!
interface Loopback0
ip address 172.16.1.1 255.255.255.0
no ip directed-broadcast
!
interface Ethernet0
ip address 192.168.1.1 255.255.255.0
no ip directed-broadcast
!
interface Serial0
ip address 192.168.2.1 255.255.255.0
no ip directed-broadcast
no ip mroute-cache
no fair-queue
!
interface Serial1
no ip address
no ip directed-broadcast
shutdown
!
router rip
network 172.16.0.0
network 192.168.1.0
network 192.168.2.0
!
ip classless
no ip http server
!
!
line con 0
transport input none
line aux 0
line vty 0 4
!
!
no scheduler allocate
end
348 - 833
Objective
Plan, configure, and apply a standard ACL to permit or deny specific traffic and test the ACL to
determine if the desired results were achieved.
Scenario
The company home office in Gadsden (GAD) provides services to branch offices such as the
Birmingham (BHM) office. These offices have some minor security and performance concerns. A
Standard ACL needs to be implemented as a simple and effective tool to control traffic
762 - 833
Infrastructure
Host #3 represents the kiosk station that needs to have its access limited to the local network.
Host #4 represents another host in the BHM office and the Loopback 0 interface on the GAD router
represents the Internet.
763 - 833
c.
From this logic the actual ACL will be written. Using the tables below, document the information
for each statement.
Source address
192.168.3.2
Wildcard mask
0.0.0.0
Source address
0.0.0.0
Wildcard mask
255.255.255.255
d. What would be the result of not including a statement to permit all other source addresses?
Every packet going into that interface would be denied due to the implicit deny any any
statement.
e. What would be the result of reversing the order of the 2 statements in the list?
The ACL tests packets in the order in which the ACL was written. Therefore, if the packet is sent
past the permit any any statement first, the deny statement does not take place.
f.
g. The final step in the planning process is to determine the best location for the access list and the
direction the list should be applied. Examine the internetwork diagram and choose the
appropriate interface and direction. Document this in the table below:
Router
Interface
Direction
BHM
FA0/0
in*
b. Add to this text file the configuration statements to apply the list.
The configuration statements take the form of:
764 - 833
c.
Now the text file configuration needs to be applied to the router. Enter the configuration mode on
the appropriate router and copy and paste the configuration. Observe the CLI display to ensure
no errors were encountered.
Finally, test the functionality of the ACL by trying to send packets from the source host and verify
that is to be permitted or denied as appropriate. In this case, ping will be used to test this.
[ x ] verify that host 3 CAN ping host 4
[ x ] verify that host 3 CANNOT ping host 1
[ x ] verify that host 3 CANNOT ping host 2
[ x ] verify that host 3 CANNOT ping GAD Fa0/0
[ x ] verify that host 3 CANNOT ping GAD LO0
[ x ] verify that host 4 CAN ping host 1
[ x ] verify that host 4 CAN ping host 2
[ x ] verify that host 4 CAN ping GAD Fa0/0
[ x ] verify that host 4 CAN ping GAD LO0
766 - 833
Once finished, erase the start-up configuration on routers, remove and store the cables and
adapter. Also logoff and turn the router off.
BHM#show running-config
Building configuration...
Current configuration:
!
version 12.0
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname BHM
!
ip subnet-zero
!
ip audit notify log
ip audit po max-events 100
!
process-max-time 200
!
interface FastEthernet0/0
ip address 192.168.3.1 255.255.255.0
ip access-group 1 in
no ip directed-broadcast
!
interface Serial0/0
ip address 192.168.2.2 255.255.255.0
no ip directed-broadcast
no ip mroute-cache
no fair-queue
clockrate 64000
!
interface Serial0/1
no ip address
no ip directed-broadcast
shutdown
!
router rip
network 192.168.2.0
network 192.168.3.0
!
ip classless
no ip http server
!
access-list 1 deny
192.168.3.2
access-list 1 permit any
!
line con 0
transport input none
line aux 0
line vty 0 4
!
no scheduler allocate
end
767 - 833
GAD#show running-config
Building configuration...
Current configuration:
!
version 12.0
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname GAD
!
memory-size iomem 10
ip subnet-zero
!
ip audit notify log
ip audit po max-events 100
!
process-max-time 200
!
interface Loopback0
ip address 172.16.1.1 255.255.255.0
no ip directed-broadcast
!
interface FastEthernet0/0
ip address 192.168.1.1 255.255.255.0
no ip directed-broadcast
!
interface Serial0/0
ip address 192.168.2.1 255.255.255.0
no ip directed-broadcast
no ip mroute-cache
no fair-queue
!
interface Serial0/1
no ip address
no ip directed-broadcast
shutdown
!
router rip
network 172.16.0.0
network 192.168.1.0
network 192.168.2.0
!
ip classless
no ip http server
!
!
line con 0
transport input none
line aux 0
line vty 0 4
!
!
no scheduler allocate
end
768 - 833