Scribd Logo
Upload

Welcome to Scribd!

  • 48 views

    Lab Activity - Access List

    Uploaded by

    vicods23
    The document describes tasks for configuring standard and extended access control lists (ACLs) on routers: Task 1 involves assigning IP addresses to router interfaces and configuring routing protocols. Task 2 demonstrates how to use a standard ACL to block a specific subnet from communicating with another subnet. Task 3 requires using an extended ACL to block access based on source/destination IP addresses and ports according to defined policies. Task 4 shows how to configure a standard ACL to control telnet access to router vty lines by only permitting connections from a permitted subnet.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Lab Activity - Access List

    Uploaded by

    vicods23
    48 views6 pages
    The document describes tasks for configuring standard and extended access control lists (ACLs) on routers: Task 1 involves assigning IP addresses to router interfaces and configuring routing protocols. Task 2 demonstrates how to use a standard ACL to block a specific subnet from communicating with another subnet. Task 3 requires using an extended ACL to block access based on source/destination IP addresses and ports according to defined policies. Task 4 shows how to configure a standard ACL to control telnet access to router vty lines by only permitting connections from a permitted subnet.

    Original Description:

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document describes tasks for configuring standard and extended access control lists (ACLs) on routers: Task 1 involves assigning IP addresses to router interfaces and configuring routing protocols. Task 2 demonstrates how to use a standard ACL to block a specific subnet from communicating with another subnet. Task 3 requires using an extended ACL to block access based on source/destination IP addresses and ports according to defined policies. Task 4 shows how to configure a standard ACL to control telnet access to router vty lines by only permitting connections from a permitted subnet.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    48 views6 pages

    Lab Activity - Access List

    Uploaded by

    vicods23
    The document describes tasks for configuring standard and extended access control lists (ACLs) on routers: Task 1 involves assigning IP addresses to router interfaces and configuring routing protocols. Task 2 demonstrates how to use a standard ACL to block a specific subnet from communicating with another subnet. Task 3 requires using an extended ACL to block access based on source/destination IP addresses and ports according to defined policies. Task 4 shows how to configure a standard ACL to control telnet access to router vty lines by only permitting connections from a permitted subnet.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 6

    Lab Activity Access-list : Basic Access Control Lists

    Topology Diagram

    Learning Objectives
    • Configure standard and extended ACL
    • Filtering remote access
    • Verify ACL

    Task 1 : Assign ip to all router’s interfaces and configure routing protocol


    In this task, you are expected to assign useable ip to interfaces according to topology and configure
    routing protocol

    Task 2 : Configuring a Standard ACL


    In this task, you are expected to block network 172.16.3.0/24 so that only
    172.16.3.0/24 that can not communicate with 10.0.0.0/22 in R3

    Step 1 - In R3 global configuration mode, create a standard named ACL called block-standard
    to block 172.16.3.0/24 with following command :
    Router(config)#ip access-list standard [ACL-name]

    Router(config-std-nacl)#permit/deny [network-address/host/any] [wild-


    card mask]

    Step 2 - Apply the ACL block_standard as a filter on packets entering R3 through interface
    E0/1 with following command :

    Router(config)#interface E0/1

    Router(config-if)#ip access-group [ACL-number/name] [in/out]

    Step 3 - Test the ACL by pinging with ping extended from interface loop 3 in R1 to all int loop in
    R3. Since the ACL is designed to block traffic with source addresses from the 172.16.3.0
    /24 network, the ping should not successful.

    Step 4 – Verify ACL configuration


    Use following command to verify acl configuration :

    Router#show access-lists
    Router#show running-config

    Here are the snapshots :

    R3
    Task 3: Configuring an Extended ACL
    In this task, you are required to block access not only based in source ip address but
    also based on destination ip address. To do this, you need access-list extended that can
    do filtering based on source ip, destination ip, souce port and destination port.

    For this task, here are some policy that you must apply in R1 with access-list extended :

    - Ip interface loopback 0 R1 can only communicate with interface loopback 0 and 1 R3


    but cannot communicate with rest interface loopback on R3.

    - Ip interface loopback 1 R1 can only communicate with interface loopback 2 and 3 R3


    but cannot communicate with rest interface loopback on R3.

    - Ip interface loopback 2 R1 can communicate with all.

    Step 1 - In global configuration mode, create a named extended ACL block-extended and in
    extended ACL configuration mode add the necessary statements to block or permit
    traffic according to policy above with the following command :

    Router(config)#ip access-list extended [ACL-name]

    Router(config-std-nacl)#permit/deny ip [network-address/host/any]
    [wild-card mask] [network-address/host/any] [wild-card mask]

    or

    Router(config-std-nacl)#permit/deny [tcp/udp/icmp] [network-


    address/host/any] [wild-card mask] [eq/gt/lt/neq/range ] [port-number]
    [network-address/host/any] [wild-card mask] [eq/gt/lt/neq/range ] [port-
    number]

    Step 2 - Extended ACLs are typically placed close to the source. Place the extended ACL on the
    R2’s E0/1 interface, and will filter outbound traffic with following command :

    Router(config)#interface E0/1

    Router(config-if)#ip access-group [ACL-number/name] [in/out]

    Step 3 – Use some ping testing below to check about the policy :
    - Ping from interface loop back 0 R1 to interface loopback 0 and 1 R3
    - Ping from interface loop back 0 R1 to interface loopback 2 and 3 R3
    - Ping from interface loop back 1 R1 to interface loopback 0 and 1 R3
    - Ping from interface loop back 1 R1 to interface loopback 2 and 3 R3
    - Ping from interface loop back 2 R1 to interface loopback 0 and 2 R3

    Step 4 – Verify ACL configuration


    Use following command to verify acl configuration :
    Router#show access-lists

    Router#show running-config

    Here are the snapshots :

    These snapshots are just for example so the results in lab are not required to be
    exactly same

    R2
    Task 4 : Control Access to the vty Lines with a Standard ACL
    In this task, you are required to configure that only network 192.168.20.0/24 can telnet
    to R3.

    Step 1 - Configure a named standard ACL Telnet-policy on R3 that permit traffic from
    192.168.20.0 /24 and deny all other traffic with following command :

    Router(config)#ip access-list standard [ACL-name]

    Router(config-std-nacl)#permit/deny [network-address/host/any] [wild-


    card mask]

    Step 2 - Enter line configuration mode for vty access. Apply the ACL with following command :

    Router(config)#line vty 0 4

    Router(config-line)#access-class [Acl-number/name] [in/out]

    Step 3 – Test telnet to R3 from R1. Note that R1 has IP address in the address range listed in
    the ACL Telnet-policy deny statements. Connection attempts should fail.

    Step 4 – Verify ACL configuration


    Use following command to verify acl configuration :

    Router#show access-lists

    Router#show running-config

    Here are the snapshots :

    R3

    You might also like