5.4.13 Packet Tracer - Configure Extended IPv4 ACLs - Scenario 2 Answers
Topology
5.4.13 Packet Tracer - Configure Extended IPv4 ACLs - Scenario 2
Addressing Table
| Device | Interface | IP Address | Subnet Mask | Default Gateway |
|---|---|---|---|---|
| RT1 | G0/0 | 172.31.1.126 | 255.255.255.224 | N/A |
| S0/0/0 | 209.165.1.2 | 255.255.255.252 | ||
| PC1 | NIC | 172.31.1.101 | 255.255.255.224 | 172.31.1.126 |
| PC2 | NIC | 172.31.1.102 | 255.255.255.224 | 172.31.1.126 |
| PC3 | NIC | 172.31.1.103 | 255.255.255.224 | 172.31.1.126 |
| Server1 | NIC | 64.101.255.254 | 255.254.0.0 | 64.100.1.1 |
| Server2 | NIC | 64.103.255.254 | 255.254.0.0 | 64.102.1.1 |
Objectives
- Part 1: Configure a Named Extended ACL
- Part 2: Apply and Verify the Extended ACL
Background / Scenario
In this scenario, specific devices on the LAN are allowed access to various services on servers located on the internet.
Instructions
Part 1: Configure a Named Extended ACL
Configure one named ACL to implement the following policy:
- Block HTTP and HTTPS access from PC1 to Server1 and Server2. The servers are inside the cloud and you only know their IP addresses.
- Block FTP access from PC2 to Server1 and Server2.
- Block ICMP access from PC3 to Server1 and Server2.
Note: For scoring purposes, you must configure the statements in the order specified in the following steps.
Step 1: Deny PC1 access to HTTP and HTTPS services on Server1 and Server2.
a. Create a named extended IP access list on router RT1 which will deny PC1 access to the HTTP and HTTPS services of Server1 and Server2. Four access control statements are required.
What is the command to begin the configuration of an extended access list with the name ACL?
ip access-list extended ACL
RT1(config)# ip access-list extended ACL
b. Begin the ACL configuration with a statement that denies access from PC1 to Server1, only for HTTP (port 80). Refer to the addressing table for the IP address of PC1 and Server1.
RT1(config-ext-nacl)# deny tcp host 172.31.1.101 host 64.101.255.254 eq 80
c. Next, enter the statement that denies access from PC1 to Server1, only for HTTPS (port 443).
RT1(config-ext-nacl)# deny tcp host 172.31.1.101 host 64.101.255.254 eq 443
d. Enter the statement that denies access from PC1 to Server2, only for HTTP. Refer to the addressing table for the IP address of Server2.
RT1(config-ext-nacl)# deny tcp host 172.31.1.101 host 64.103.255.254 eq 80
e. Enter the statement that denies access from PC1 to Server2, only for HTTPS.
RT1(config-ext-nacl)# deny tcp host 172.31.1.101 host 64.103.255.254 eq 443
Step 2: Deny PC2 access to FTP services on Server1 and Server2.
Refer to the addressing table for the IP address of PC2.
a. Enter the statement that denies access from PC2 to Server1, only for FTP (port 21 only).
RT1(config-ext-nacl)# deny tcp host 172.31.1.102 host 64.101.255.254 eq 21
b. Enter the statement that denies access from PC2 to Server2, only for FTP (port 21 only).
RT1(config-ext-nacl)# deny tcp host 172.31.1.102 host 64.103.255.254 eq 21
Step 3: Deny PC3 to ping Server1 and Server2.
Refer to the addressing table for the IP address of PC3.
a. Enter the statement that denies ICMP access from PC3 to Server1.
RT1(config-ext-nacl)# deny icmp host 172.31.1.103 host 64.101.255.254
b. Enter the statement that denies ICMP access from PC3 to Server2.
RT1(config-ext-nacl)# deny icmp host 172.31.1.103 host 64.103.255.254
Step 4: Permit all other IP traffic.
By default, an access list denies all traffic that does not match any rule in the list. Enter the command that permits all traffic that does not match any of the configured access list statements.
RT1(config-ext-nacl)# permit ip any any
Step 5: Verify the access list configuration before applying it to an interface.
Before any access list is applied, the configuration needs to be verified to make sure that there are no typographical errors and that the statements are in the correct order. To view the current configuration of the access list, use either the show access-lists or the show running-config command.
RT1# show access-lists
Extended IP access list ACL
10 deny tcp host 172.31.1.101 host 64.101.255.254 eq www
20 deny tcp host 172.31.1.101 host 64.101.255.254 eq 443
30 deny tcp host 172.31.1.101 host 64.103.255.254 eq www
40 deny tcp host 172.31.1.101 host 64.103.255.254 eq 443
50 deny tcp host 172.31.1.102 host 64.101.255.254 eq ftp
60 deny tcp host 172.31.1.102 host 64.103.255.254 eq ftp
70 deny icmp host 172.31.1.103 host 64.101.255.254
80 deny icmp host 172.31.1.103 host 64.103.255.254
90 permit ip any anyRT1# show running-config | begin access-list ip access-list extended ACL deny tcp host 172.31.1.101 host 64.101.255.254 eq www deny tcp host 172.31.1.101 host 64.101.255.254 eq 443 deny tcp host 172.31.1.101 host 64.103.255.254 eq www deny tcp host 172.31.1.101 host 64.103.255.254 eq 443 deny tcp host 172.31.1.102 host 64.101.255.254 eq ftp deny tcp host 172.31.1.102 host 64.103.255.254 eq ftp deny icmp host 172.31.1.103 host 64.101.255.254 deny icmp host 172.31.1.103 host 64.103.255.254 permit ip any any ! ! ! ! ! line con 0 ! line aux 0 ! line vty 0 4 login ! ! ! end
Note: The difference between the output of the show access-lists command and the output of the show running-config command is that the show access-lists command includes the sequence numbers assigned to the configuration statements. These sequence numbers enable the editing, deleting, and inserting of single lines within the access list configuration. Sequence numbers also define the processing order of individual access control statements, starting with the lowest sequence number.
Part 2: Apply and Verify the Extended ACL
The traffic to be filtered is coming from the 172.31.1.96/27 network and is destined for remote networks. Appropriate ACL placement depends on the relationship of the traffic with respect to RT1. In general, extended access lists should be placed on the interface closest to the source of the traffic.
Step 1: Apply the ACL to the correct interface and in the correct direction.
Note: In an actual operational network, an untested ACL should never be applied to an active interface. This is not a good practice and can disrupt network operation.
On which interface should the named ACL be applied, and in which direction?
Interface Gigabit Ethernet 0/0, in.
Enter the configuration commands to apply the ACL to the interface.
RT1(config)# interface gigabitethernet 0/0 RT1(config-if)# ip access-group ACL in
Step 2: Test access for each PC.
a. Access the websites of Server1 and Server2 using the web browser of PC1. Use both the HTTP and HTTPS protocols. Use the show access-lists command to view which access list statement permitted or denied the traffic. The output of the show access-lists command displays the number of packets that match each statement since the last time the counters were cleared, or the router rebooted.
Note: To clear the counters on an access list, use the clear access-list counters command.
RT1# show access-lists Extended IP access list ACL 10 deny tcp host 172.31.1.101 host 64.101.255.254 eq www (42 match(es)) 20 deny tcp host 172.31.1.101 host 64.101.255.254 eq 443 (109 match(es)) 30 deny tcp host 172.31.1.101 host 64.103.255.254 eq www (63 match(es)) 40 deny tcp host 172.31.1.101 host 64.103.255.254 eq 443 (167 match(es)) 50 deny tcp host 172.31.1.102 host 64.101.255.254 eq ftp 60 deny tcp host 172.31.1.102 host 64.103.255.254 eq ftp 70 deny icmp host 172.31.1.103 host 64.101.255.254 80 deny icmp host 172.31.1.103 host 64.103.255.254 90 permit ip any any (6 match(es))
b. Access FTP of Server1 and Server2 using PC1. The username and password are both cisco.
C:\> ftp 64.101.255.254
Trying to connect...64.101.255.254
Connected to 64.101.255.254
220- Welcome to PT Ftp server
Username:cisco
331- Username ok, need password
Password:*****
230- Logged in
(passive mode On)
ftp> quit
221- Service closing control connection.C:\> ftp 64.103.255.254
c. Ping Server1 and Server2 from PC1.
C:\> ping 64.101.255.254
Pinging 64.101.255.254 with 32 bytes of data:
Reply from 64.101.255.254: bytes=32 time=16ms TTL=126
Reply from 64.101.255.254: bytes=32 time=16ms TTL=126
Reply from 64.101.255.254: bytes=32 time=1ms TTL=126
Reply from 64.101.255.254: bytes=32 time=14ms TTL=126
Ping statistics for 64.101.255.254:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 1ms, Maximum = 16ms, Average = 11msC:\> ping 64.103.255.254
d. Repeat Step 2a to Step 2c with PC2 and PC3 to verify proper access list operation.
PC2:
C:\> ftp 64.101.255.254
Trying to connect...64.101.255.254
%Error opening ftp://64.101.255.254/ (Timed out)
.
(Disconnecting from ftp server)PC3:
C:\> ping 64.101.255.254
Pinging 64.101.255.254 with 32 bytes of data:
Reply from 172.31.1.126: Destination host unreachable.
Reply from 172.31.1.126: Destination host unreachable.
Reply from 172.31.1.126: Destination host unreachable.
Reply from 172.31.1.126: Destination host unreachable.
Ping statistics for 64.101.255.254:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),RT1:
RT1# show access-lists
Extended IP access list ACL
10 deny tcp host 172.31.1.101 host 64.101.255.254 eq www
20 deny tcp host 172.31.1.101 host 64.101.255.254 eq 443
30 deny tcp host 172.31.1.101 host 64.103.255.254 eq www
40 deny tcp host 172.31.1.101 host 64.103.255.254 eq 443
50 deny tcp host 172.31.1.102 host 64.101.255.254 eq ftp (12 match(es))
60 deny tcp host 172.31.1.102 host 64.103.255.254 eq ftp
70 deny icmp host 172.31.1.103 host 64.101.255.254 (4 match(es))
80 deny icmp host 172.31.1.103 host 64.103.255.254
90 permit ip any any (17 match(es))Device Configs - Final
ROUTER RT1
! ============================================================== !--- 5.4.13 Packet Tracer - Configure Extended IPv4 ACLs - Scenario 2 !--- ANSWER SCRIPT FOR ROUTER RT1 !--- Usage: open the RT1 CLI tab and paste this whole file at the RT1> prompt. Every line beginning with "!" is a comment; IOS ignores it, so pasting a comment by accident is harmless. ! ============================================================== enable configure terminal ! -------------------------------------------------------------- !--- Part 1: Configure a Named Extended ACL. ! -------------------------------------------------------------- !--- Step 1a. Named extended ACL "ACL" (statements must stay in this order for scoring). ip access-list extended ACL !--- Step 1b-e. Deny HTTP (80) and HTTPS (443) from PC1 to Server1 and Server2. deny tcp host 172.31.1.101 host 64.101.255.254 eq 80 deny tcp host 172.31.1.101 host 64.101.255.254 eq 443 deny tcp host 172.31.1.101 host 64.103.255.254 eq 80 deny tcp host 172.31.1.101 host 64.103.255.254 eq 443 !--- Step 2. Deny FTP (21) from PC2 to Server1 and Server2. deny tcp host 172.31.1.102 host 64.101.255.254 eq 21 deny tcp host 172.31.1.102 host 64.103.255.254 eq 21 !--- Step 3. Deny ICMP from PC3 to Server1 and Server2. deny icmp host 172.31.1.103 host 64.101.255.254 deny icmp host 172.31.1.103 host 64.103.255.254 !--- Step 4. Permit all other IP traffic. permit ip any any exit ! -------------------------------------------------------------- !--- Part 2: Apply and Verify the Extended ACL. ! -------------------------------------------------------------- !--- Step 1. Apply the ACL inbound on G0/0 (closest to the 172.31.1.96/27 source network). interface gigabitethernet 0/0 ip access-group ACL in exit end ! -------------------------------------------------------------- !--- Save the configuration to NVRAM. (Press Enter when prompted for the destination filename.) ! -------------------------------------------------------------- copy running-config startup-config ! ============================================================== !--- Verification: !--- show access-lists -> ACL lines 10-90 (IOS shows port 80 as www and 21 as ftp) !--- PC1: HTTP/HTTPS to both servers fails; FTP and ping succeed !--- PC2: FTP to both servers fails; web and ping succeed !--- PC3: ping to both servers fails; web and FTP succeed ! ==============================================================
Download Packet Tracer (.pka) file:
