MIT Questions Bark — Commands Help (Dexamanswers -net Ebooks flIP Calculators » Donation Contact, BP Donations Somer he ste5.4.12 Packet Tracer — Configure Extended IPv4 ACLs — Scenario 1 (Answers) ‘¥aug 23, 2020 | GLast Updated: Sep 16, 2020 | WCCNAYT Course #3 | MNo Comments 5.4.12 Packet Tracer — Configure Extended IPv4 ACLs = Scenario 1 (Instructor Version) Instructor Note: Red font color or gray highlights indicate text that appears in the instructor copy only. CCNA V7.0 Exam Answers CONA1-v7 CONA2-v7CCNAS-v7 ‘System Test Exam Modules 1 - 3: Basic Network ror Connectivity and Communications maw vests Exam Answers 5.4.12 Packet Tracer — Configure Extended IPv4 ACLs — Scenario 1 Modules 4 - 7: Ethernet Concepts: Exam Answers Addressing Table Modules 8 10: Communicating Between Networks Exam Answers Device | intertace | Address SubnetMask | efautGatoway | [jogos sia ipAusong oun Rt GIO 172.22.34.65 | 255.255.255.224 NIA Arve Modules 14-15: Network Application con | 1722.24.97 | 255.255.256.240 Moses 1418 Neto Pole co | 1722.41 | 255.255.256.192 you ov Sunes Server | NIC 172.22.3462 | 255.255.256.192 | 172.22.941 Securing a Small Network Exam Answers pcr | nic | 172223466 | 255.255.255.224 | 172.272.3465 (PT Stile] Pracice PT Skis Pc2 | NIC 172.22.94.98 | 255.255.255.240 | 172.22.9497 ‘Assanaroent PTSA) cas [Final Skills] ITN Final Skils Exam Objectives (TSA) + Part 1: Configure, Apply and Verify an Extended Numbered ACL ITWW7 Practice Final Exam net 2: Configure, Apply and Verify an Extended Named ACL igure, APY ‘CCNA v7 FINAL Exam Answors Bb. ground / Scenario ‘Two employees need access to services pravided by the server. PC1 only needs FTP access while PC2 only needs web access. Both computers need to be able to ping the server, but not each other.Instructions Part 1: Configure, Apply and Verify an Extended Numbered ACL ‘Step 1: Configure an ACL to permit FTP and ICMP from PC1 LAN. ‘a. From global configuration mode on R1, enter the following command to determine the first valid number for an extended access list. Ri(config)# access-tist ? 41-99 IP standard access list «100-199» IP extended access list b. Add 100 to the command, followed by a question mark. Ri(config)# access-list 100? deny Specify packets to reject permit Specify packets to forward remark Access list entry comment ©. To permit FTP trafic, enter permit, followed by a question mark. Ri(config)# access-list 100 permit ? ahp Authentication Header Protocol teigrp Cisco's EIGRP routing protocol esp Encapsulation Security Payload gre Cisco's GRE tunneling iemp Internet Control Message Protocol ip Any Internet Protocol ‘ospt OSPF routing protocol tep Transmission Control Protocol, udp User Datagram Protocol 4d. When configured and applied, this ACL should permit FTP and ICMP. ICMP is listed above, but FTP is not. This is because FTP is an application layer protocol that uses TCP at the transport layer, Enter TOP to further refine the ACL help. Ri(contig)# access-list 100 permit tep ? ABCD Source address any Any source host Related Posts host A single source host 8.4.2 Module Quiz VPN and IPsec Concepts (Answers) «. The source address can represent a single device, such as PC1, by using the host keyword and then the IP address of PC1. Using the keyword any permits 6.8.4 Module Quiz— NAT for |Pv4 (Answers) any host on any network Firing can also be done by a network adress. In this 515 pacgo cer ~Coniqu Exerc case, itis any host that has an address belonging to the 172.22 34.64/27 network. (ora acts SeonaioSimrence) Er’ Sis network address, followed by a question mark CCNA 3 v7.0 Cureulum: Module 3 ~ Nett Securly Cancapts Riontig)# access-list 100 permit tep 172.22.34.66 ? ‘ABCD Source wildcard bits CCNAS V7 Modules 3~ 5: Netwark Security Test Online {. Calculate the wildcard mask by determining the binary opposite of the (27 (CCNAS V7.0 Curriculum: Module 12 ~ Network ‘subnet mask, Troubleshootingmnnmmianmimammanooo00 « 255.255.255.224 ‘00000000.00000000.00000000.000Nm = 0.0.0.31 4. Enter the wildcard mask, followed by a question mark. Ri(config)# access-list 100 permit tep 172.22.34.64 0.00.31? ABCD Destination address any Any destination host eq Match only packets on a given port number gt Match only packets with a greater port number host A single destination host lt Match only packets with a lower port number neq Match only packets not on a given port number range Match only packets in the range of port numbers. h. Configure the destination address. In this scenario, we are fitering traffic for a single destination, which is the server. Enter the host keyword followed by the server's IP address, Ri(config)# access-list 100 dscp Match packets with given dscp value eq Match only packets on a given port number established established mit tep 172.22.34,64 0,0.0.31 host 172.22.34.62? gt Match only packets with a greater port number, lt Match only packets with a lower port number neq Match only packets not on a given port number precedence Match packets with given precedence value range Match only packets in the range of port numbers i. Notice that one of the options is (carriage return). In other words, you can press Enter and the statement would permit all TCP traffic. However, we are only permitting FTP traffic; therefore, enter the eq keyword, followed by a question mark to display the available options. Then, enter ftp and press Enter. Ri(config)# access-list 100 permit tcp 172.22.34.64 0.0.0.1 host 172.22.34.62 eq? <0-65535> Port number ftp File Transfer Protocol (21) pan3 Post Office Protocol v3 (110) ‘Simple Mail Transport Protocol (25) Telnet (23) vewwW World Wide Web (HTTP, 80) Ri(contig)# access-list 100 permit tep 172.22.34.64 0.0.0.31 host 172.22.34.62 eq ft 3.10.10 Check Your Understanding ~ Cryptography Answers Hands On Skil Exam - CCNAVT ENSA Skis, Assessment (Answers) CCNAS V7.0 Curiculum: Module 7 ~ WAN Concepts 10.6.13 Lab - Research Paseword Recovery Procedures (Answers) Recent Comments ‘med3 on 16.1.5 Lab — Implement IPsec VTI Site-e-Site VPNs (Answers) Joshua on What isthe function of a hub-and- spoke WAN topology? shay on Hands On Skis Exam— CCNAVT 'SRWE Skils Assessment (Answers) “OR 1=1 —on CyberOps Associate (Version 1.0) = FINAL Exam (Answers) Akira on CCNA 1 v7 Modules 11 ~ 13:1P Addressing Exam Answers Full|. Create a second access list statement to permit ICMP (ping, etc.) traffic from PC1 to Server. Note that the access list number remains the same and a specific type of ICMP traffic does not need to be specified Ri(config)# access-list 100 permit icmp 172.22,34.64 0.0.0.31 host 172.22.34.62 k.Allother traffic is denied, by default, |. Execute the show access-list command and verify that access list 100 contains the correct statements. Notice that the statement deny any any does not appear at the end of the access list. The default execution of an access list is that if a packet does not match a statement in the access lis, itis not permitted through the interface. Riftshow access-lists Extended IP access list 100 10 permit tcp 172,22,34,64 0.0031 host 172.22.34,62 eq ftp 20 permit icmp 172.22.34.64 0.0.031 host 1722.34.62, Step 2: Apply the ACL on the correct interface to filter traffic. From R1’'s perspective, the traffic that ACL 100 applies to is inbound from the network connected to the Gigabit Ethernet 0/0 interface. Enter interface configuration made and apply the ACL. Note: On an actual operational network, itis not a good practice to apply an untested access Iist to an active interface, Ri(config)# interface gigabitEthernet 0/0 Ri(config-if)# ip access-group 100 in Step 3: Verify the ACL implementation. ‘a. Ping from PC1 to Server. If the pings are unsuccessful, verify the IP addresses before continuing, b. FTP from PC1 to Server. The username and password are both cisco.o> ftp 172.22.34.62 . Exit the FTP service, fp quit 4d. Ping from PC1 to PC2. The destination host should be unreachable, because the ACL did not explicitly permit the traffic. Part 2: Configure, Apply and Verify an Extended Named ACL Step 1: Configure an ACL to permit HTTP access and ICMP from PC2 LAN a, Named ACLs start with the ip keyword. From global configuration mode of R1, enter the following command, followed by a question mark, Ri(config)# ip access-list ? extended Extended Access List standard Standard Access List, b. You can configure named standard and extended ACLS. This access list fiters both source and destination IP addresses; therefore, it must be extended. Enter HTTP_ONLY as the name. (For Packet Tracer scoring, the name is case-sensitive and the access Ist statements must be the correct order.) Ri(config)# ip access-list extended HTTP_ONLY cc. The prompt changes. You are now in extended named ACL configuration mode. All devices on the PC2 LAN need TCP access. Enter the network address, followed by a question mark. Ri(config-ext-nacl)# permit tep 172.22.34.96 ? ABCD Source wildcard bits 4. An alternative way to calculate a wildcard is to subtract the subnet mask from 255.255.255.256. 255.255.255.255 ~ 255.255.255.240 0.0 0.15 Ri(config-ext-nacl)# permit tep 172.22.34.96 0.0.0.5, €. Finish the statement by specifying the server address as you did in Part 1 and ft www traffic,Ri(config-ext-nacl)# permit tep 172.22.34.96 0.0.0.5 host 172.22.34.62 {. Create a second access list statement to permit ICMP (ping, etc.) traffic from PC2 to Server, Note: The prompt remains the same and a specific type of ICMP traffic does not need to be specified Ri(config-ext-nacl)# permit icmp 172.22:34.96 0.0.015 host 172,22.36.62 4g. All other traffic is denied, by default. Exit extended named ACL configuration mode. h. Execute the show access-list command and verify that access list HTTP_ONLY contains the correct statements, Rift show access-tisis Extended IP access list 100 10 permit tep 172.22.34.64 0.0.0.31 host 172.22.34.62 eq ftp 20 permit icmp 172,22,34,64 0.00.31 host 172,22.34,62 Extended IP access list HTTP_ONLY 10 permit tcp 172.22.34.96 0.0.0.5 host 172.22.34.62 eq www. 20 permit icmp 172,22.34,96 0,0.0.15 host 172.22.34,62 Step 2: Apply the ACL on the correct interface to filter traffic. From R1’s perspective, the trafic that access list HTTP_ONLY applies tois inbound from the network connected to the Gigabit Ethemet 0/1 interface, Enter interface configuration mode and apply the ACL. Note: On an actual operational network, itis not a good practice to apply an untested access list fo an active interface. It should be avoided if possible. ig) interface gigabitEthernet 0/1 aiconfig-if)# ip access-group HTTP_ONLY in ‘Step 3: Verify the ACL implementation,1. Ping from PC2 to Serv before continuing, Ifthe ping is unsuccessful, verify the IP addresses »b. From PC2 open a web browser and enter the IP address of the Server. The web page of the Server should be displayed FTP from PC2 to Server. The connection should fail. f not, troubleshoot the access list statements and the access-group configurations on the interfaces. Answer Script Router R1 enable configure terminal access-list 100 permit tep 1722.34.64 0.0.0.31 host 172.22.34.62 eq ftp access-list 100 permit icmp 172.22.94,64 0.0.0.31 host 172.22.34.62 interface gigabitEthernet 0/0 ip access-group 100 in ip access-list extended HTTP_ONLY permit tep 17222:34.96 0.00.15 permit tep 172,22.34,96 0.0.0.5 host 172.22.34.62 eq www permit icmp 172.22 34.96 0.00.15 host 172.22:34.62 interface gigabitEthernet 0/1 ip access-group HTTP_ONLY in Download Packet Tracer Completed File {sociallocker Jo 5412 Packet Tracer - Configure Extended IPvs ACLs-Sconario t.paf s74r0xs 107 cw Download 54558") Download ] Usociallocker] @Previous Lab Next Lab 5.2.7 Packet Tracer— Configure and _§.4.13 Packet Tracer — Configure Modify Standard IPv4 ACLS. Extended IPv4 ACLs — Scenario 2Previous Article Next Article —+ 5.2.7 Packet Tracer — Configure and 5.4.13 Packet Tracer — Configure Modify Standard IPv4 ACLS Extended IPv4 ACLs ~ Scenario 2 (Answers) (Answers) | Be the First to Comment! BIUuSsE” a 0 COMMENTS ITExamAnswers.net Copyright ©2023, septs Prvaoy Policy | Contact a