26.2.3 Packet Tracer - Configure IP ACLs to Mitigate Attacks (Answers)

C:\> ssh -l SSHadmin 192.168.2.1

C:\> ssh -l SSHadmin 192.168.2.1

R1(config)# access-list 10 permit host 192.168.3.3
R2(config)# access-list 10 permit host 192.168.3.3
R3(config)# access-list 10 permit host 192.168.3.3

R1(config-line)# access-class 10 in
R2(config-line)# access-class 10 in
R3(config-line)# access-class 10 in

C:\> ssh -l SSHadmin 192.168.2.1

R1(config)# access-list 120 permit udp any host 192.168.1.3 eq domain
R1(config)# access-list 120 permit tcp any host 192.168.1.3 eq smtp
R1(config)# access-list 120 permit tcp any host 192.168.1.3 eq ftp
R1(config)# access-list 120 deny tcp any host 192.168.1.3 eq 443
R1(config)# access-list 120 permit tcp host 192.168.3.3 host 10.1.1.1 eq 22

R1(config)# interface s0/0/0
R1(config-if)# ip access-group 120 in

R1(config)# access-list 120 permit icmp any any echo-reply
R1(config)# access-list 120 permit icmp any any unreachable
R1(config)# access-list 120 deny icmp any any
R1(config)# access-list 120 permit ip any any

R3(config)# access-list 110 permit ip 192.168.3.0 0.0.0.255 any

R3(config)# interface g0/1
R3(config-if)# ip access-group 110 in

R3(config)# access-list 100 permit tcp 10.0.0.0 0.255.255.255 eq 22 host 192.168.3.3
R3(config)# access-list 100 deny ip 10.0.0.0 0.255.255.255 any
R3(config)# access-list 100 deny ip 172.16.0.0 0.15.255.255 any
R3(config)# access-list 100 deny ip 192.168.0.0 0.0.255.255 any
R3(config)# access-list 100 deny ip 127.0.0.0 0.255.255.255 any
R3(config)# access-list 100 deny ip 224.0.0.0 15.255.255.255 any
R3(config)# access-list 100 permit ip any any

R3(config)# interface s0/0/1
R3(config-if)# ip access-group 100 in

! ==============================================================
!--- 26.2.3 Packet Tracer - Configure IP ACLs to Mitigate Attacks
!--- ANSWER SCRIPT FOR ROUTER R1
!--- Usage: copy this whole file and paste it into the R1 terminal (start at the R1> prompt). Every line beginning with "!" is a comment; IOS ignores it, so pasting a comment by accident is harmless.
!--- Scope: enable/console passwords, SSH (SSHadmin/ciscosshpa55), IP
!--- addressing and static routing are already pre-configured per the
!--- activity's own Background note - this script only adds the ACLs.
! ==============================================================

enable
configure terminal

! --------------------------------------------------------------
!--- Part 2: Restrict VTY (remote) access to R1 so only the management
!--- station PC-C can reach it - by SSH or Telnet.
! --------------------------------------------------------------

!--- Only PC-C is allowed in; everything else hits the implicit deny.
access-list 10 permit host 192.168.3.3

line vty 0 4
 access-class 10 in
 exit

! --------------------------------------------------------------
!--- Part 3, Step 2: Numbered extended ACL 120 - control what outside
!--- hosts can reach on the PC-A server, and let PC-C manage R1 itself.
! --------------------------------------------------------------

!--- Outside hosts may reach PC-A's DNS, SMTP and FTP services...
access-list 120 permit udp any host 192.168.1.3 eq domain
access-list 120 permit tcp any host 192.168.1.3 eq smtp
access-list 120 permit tcp any host 192.168.1.3 eq ftp

!--- ...but HTTPS to PC-A is explicitly blocked from outside.
access-list 120 deny tcp any host 192.168.1.3 eq 443

!--- PC-C (the management station) may SSH directly into R1's WAN
!--- address (10.1.1.1) - this is traffic destined for the router
!--- itself, not transit traffic to PC-A.
access-list 120 permit tcp host 192.168.3.3 host 10.1.1.1 eq 22

! --------------------------------------------------------------
!--- Part 3, Step 3: Apply ACL 120 inbound on the WAN-facing interface -
!--- the traffic being filtered arrives here from R2/the outside.
! --------------------------------------------------------------

interface Serial0/0/0
 ip access-group 120 in
 exit

! --------------------------------------------------------------
!--- Part 4, Step 2: Append ICMP handling to ACL 120 - allow only the
!--- reply/error types a host needs for diagnostics (echo-reply,
!--- unreachable), block every other ICMP type, then re-permit
!--- everything else so normal transit traffic keeps flowing.
! --------------------------------------------------------------

access-list 120 permit icmp any any echo-reply
access-list 120 permit icmp any any unreachable

!--- Blocks echo (ping) requests and every other ICMP type/code not
!--- covered above - e.g. PC-A pinging out will get no reply back in.
access-list 120 deny icmp any any

!--- Required catch-all: without this, the ACL's own implicit deny
!--- would silently block every other protocol (not just ICMP) once
!--- the explicit "deny icmp any any" line is added.
access-list 120 permit ip any any

end

! --------------------------------------------------------------
!--- Save the configuration to NVRAM. (Press Enter when prompted for the destination filename.)
! --------------------------------------------------------------
copy running-config startup-config


! ==============================================================
!--- Verification:
!---   show access-lists 10           -> only "permit host 192.168.3.3"
!---   show access-lists 120          -> all 9 lines in order, with match counts once traffic flows
!---   show ip interface serial0/0/0  -> "Inbound access list is 120"
!---   ssh -l SSHadmin 192.168.2.1 (from PC-C)   -> succeeds (Part 2)
!---   ssh -l SSHadmin 192.168.2.1 (from PC-A)   -> fails (Part 2, not PC-C)
!---   https:// to 192.168.1.3 (from PC-C, simulating an outside host) -> fails (Part 3)
!---   ping 192.168.2.1 (from PC-A, after Part 4)  -> succeeds again (echo-reply now permitted back)
!--- Note: "Check Results" will not show ACL 120 as correct until Part 4's
!--- four extra lines are appended - this matches the lab's own Part 3
!--- note ("Check Results will not show a correct configuration for ACL
!--- 120 until you modify it in Part 4").
! ==============================================================

! ==============================================================
!--- 26.2.3 Packet Tracer - Configure IP ACLs to Mitigate Attacks
!--- ANSWER SCRIPT FOR ROUTER R2
!--- Usage: copy this whole file and paste it into the R2 terminal (start at the R2> prompt). Every line beginning with "!" is a comment; IOS ignores it, so pasting a comment by accident is harmless.
!--- Scope: enable/console passwords, SSH, IP addressing and static
!--- routing are already pre-configured per the activity's own
!--- Background note - R2 is transit-only in this lab, so it only
!--- needs the VTY-restriction ACL (no ACL 120/110/100 traffic touches R2).
! ==============================================================

enable
configure terminal

! --------------------------------------------------------------
!--- Part 2: Restrict VTY (remote) access to R2 so only the management
!--- station PC-C can reach it - by SSH or Telnet.
! --------------------------------------------------------------

!--- Only PC-C is allowed in; everything else hits the implicit deny.
access-list 10 permit host 192.168.3.3

line vty 0 4
 access-class 10 in
 exit

end

! --------------------------------------------------------------
!--- Save the configuration to NVRAM. (Press Enter when prompted for the destination filename.)
! --------------------------------------------------------------
copy running-config startup-config


! ==============================================================
!--- Verification:
!---   show access-lists 10   -> only "permit host 192.168.3.3"
!---   show line vty 0 4      -> "access class 10 in" listed
!---   ssh -l SSHadmin  (from PC-C)   -> succeeds
!---   ssh -l SSHadmin  (from PC-A)   -> fails (not PC-C)
!--- Note: R2 has no other ACL requirement in this lab - ACL 120 lives on
!--- R1 (WAN edge facing the outside), and ACL 110/100 live on R3 (LAN
!--- edge / anti-spoofing); R2 sits between them and only needs the VTY
!--- restriction that every device in this lab shares.
! ==============================================================

! ==============================================================
!--- 26.2.3 Packet Tracer - Configure IP ACLs to Mitigate Attacks
!--- ANSWER SCRIPT FOR ROUTER R3
!--- Usage: copy this whole file and paste it into the R3 terminal (start at the R3> prompt). Every line beginning with "!" is a comment; IOS ignores it, so pasting a comment by accident is harmless.
!--- Scope: enable/console passwords, SSH, IP addressing and static
!--- routing are already pre-configured per the activity's own
!--- Background note - this script adds the VTY ACL, the LAN-egress
!--- anti-spoofing ACL, and the WAN-ingress anti-spoofing ACL.
! ==============================================================

enable
configure terminal

! --------------------------------------------------------------
!--- Part 2: Restrict VTY (remote) access to R3 so only the management
!--- station PC-C can reach it - by SSH or Telnet.
! --------------------------------------------------------------

!--- Only PC-C is allowed in; everything else hits the implicit deny.
access-list 10 permit host 192.168.3.3

line vty 0 4
 access-class 10 in
 exit

! --------------------------------------------------------------
!--- Part 5: ACL 110 - anti-spoofing on the LAN-facing interface. Only
!--- traffic that legitimately originates from R3's own LAN
!--- (192.168.3.0/24, where PC-C lives) is allowed out toward the rest
!--- of the network; anything claiming a different source address on
!--- this interface is necessarily forged and is dropped.
! --------------------------------------------------------------

access-list 110 permit ip 192.168.3.0 0.0.0.255 any

interface gigabitethernet 0/1
 ip access-group 110 in
 exit

! --------------------------------------------------------------
!--- Part 6: ACL 100 - anti-spoofing on the WAN-facing interface, applied
!--- to traffic arriving FROM the outside (R2 direction). No outside
!--- source address should ever legitimately be a private (RFC 1918),
!--- loopback, or multicast address, nor R3's own internal network -
!--- all of those are classic spoofed-source attack signatures.
! --------------------------------------------------------------

!--- Required exception, and must come first: this permits the return
!--- leg of SSH sessions PC-C itself initiated toward the 10.0.0.0/8
!--- address space - "eq 22" here matches the SOURCE port (22, the
!--- remote SSH server replying), not the destination, since it appears
!--- before the destination "host 192.168.3.3". Without this line first,
!--- the broader "deny ip 10.0.0.0 ..." below would block those replies.
access-list 100 permit tcp 10.0.0.0 0.255.255.255 eq 22 host 192.168.3.3

!--- Block forged private-address (RFC 1918) sources arriving from outside.
access-list 100 deny ip 10.0.0.0 0.255.255.255 any
access-list 100 deny ip 172.16.0.0 0.15.255.255 any
access-list 100 deny ip 192.168.0.0 0.0.255.255 any

!--- Block forged loopback and multicast/class D sources.
access-list 100 deny ip 127.0.0.0 0.255.255.255 any
access-list 100 deny ip 224.0.0.0 15.255.255.255 any

!--- Required explicit permit - without this, the implicit deny at the
!--- end of the ACL would block all other legitimate inbound traffic too.
access-list 100 permit ip any any

interface serial 0/0/1
 ip access-group 100 in
 exit

end

! --------------------------------------------------------------
!--- Save the configuration to NVRAM. (Press Enter when prompted for the destination filename.)
! --------------------------------------------------------------
copy running-config startup-config


! ==============================================================
!--- Verification:
!---   show access-lists 10    -> only "permit host 192.168.3.3"
!---   show access-lists 110   -> "permit ip 192.168.3.0 0.0.0.255 any"
!---   show access-lists 100   -> 6 lines, SSH-return permit first, then
!---     the 4 spoofing denies, then the catch-all permit ip any any
!---   show ip interface gigabitethernet0/1  -> "Inbound access list is 110"
!---   show ip interface serial0/0/1        -> "Inbound access list is 100"
!---   ssh -l SSHadmin  (from PC-C)   -> succeeds (Part 2)
!---   ssh -l SSHadmin  (from PC-A)   -> fails (Part 2, not PC-C)
!--- Note: double-check ACL 110's applied interface against your own
!--- topology before pasting - if R3's LAN-facing interface in your build
!--- is not G0/1, adjust that one line to match; the ACL content itself
!--- is unaffected.
! ==============================================================