5.5.2 Packet Tracer - Configure and Verify Extended IPv4 ACLs - Physical Mode Answers
Topology
Addressing Table
| Device | Interface | IP Address | Subnet Mask | Default Gateway |
|---|---|---|---|---|
| R1 | G0/0/1 | N/A | N/A | N/A |
| G0/0/1.20 | 10.20.0.1 | 255.255.255.0 | ||
| G0/0/1.30 | 10.30.0.1 | 255.255.255.0 | ||
| G0/0/1.40 | 10.40.0.1 | 255.255.255.0 | ||
| G0/0/1.1000 | N/A | N/A | ||
| G0/0/0 | 172.16.1.1 | 255.255.255.0 | ||
| R2 | G0/0/1 | 10.20.0.4 | 255.255.255.0 | N/A |
| S1 | VLAN 20 | 10.20.0.2 | 255.255.255.0 | 10.20.0.1 |
| S2 | VLAN 20 | 10.20.0.3 | 255.255.255.0 | 10.20.0.1 |
| PC-A | NIC | 10.30.0.10 | 255.255.255.0 | 10.30.0.1 |
| PC-B | NIC | 10.40.0.10 | 255.255.255.0 | 10.40.0.1 |
| Server-A | NIC | 172.16.1.2 | 255.255.255.0 | 172.16.1.1 |
VLAN Table
| VLAN | Name | Interface Assigned |
|---|---|---|
| 20 | Management | S2: F0/5 |
| 30 | Operations | S1: F0/6 |
| 40 | Sales | S2: F0/18 |
| 999 | ParkingLot | S1: F0/2-4, F0/7-24, G0/1-2 S2: F0/2-4, F0/6-17, F0/19-24, G0/1-2 |
| 1000 | Native | N/A |
Objectives
- Part 1: Build the Network and Configure Basic Device Settings
- Part 2: Configure VLANs on the Switches
- Part 3: Configure Trunking
- Part 4: Configure Routing
- Part 5: Configure Remote Access
- Part 6: Verify Connectivity
- Part 7: Configure and Verify Extended Access Control Lists
Background / Scenario
In this Packet Tracer Physical Mode (PTPM) activity, you have been tasked with configuring access control lists (ACLs) on a small company’s network. ACLs are one of the simplest and most direct means of controlling Layer 3 traffic. R1 will be hosting an internet connection and sharing the default route information to R2. After initial configuration is complete, the company has some specific traffic security requirements that you will be responsible for implementing.
Note: There are over 100 items scored in this activity. Therefore, Packet Tracer will display the number of items currently correct instead of the percentage score.
Instructions
Part 1: Build the Network and Configure Basic Device Settings
Step 1: Cable the network as shown in the topology.
a. Cable and power on the devices as shown in the topology diagram. Use a console cable to connect a PC to each switch or router as you configure them. To access a switch or router, you must connect a console cable between the PCs and the device you wish to configure. We recommend connecting PC-A to R1 and PC-B to R2.
b. Then, when configuring the switches, connect PC-A to S1 and PC-B to S2. After you have connected the console cable, click the PC > Desktop tab > Terminal, and then click OK, to access the command line.
When changing a console cable to a new device, such as between a router and a switch, it is easier to click the end of the console cable and drag it back to the Cable Pegboard than it is to try to connect the cable directly to another device. After attaching a console cable to a different device, you must close and reopen the Terminal window to establish a new connection.
Step 2: Configure basic settings for each router.
a. Assign a device name to the router.
Router(config)# hostname R1
b. Disable DNS lookup to prevent the router from attempting to translate incorrectly entered commands as though they were host names.
R1(config)# no ip domain lookup
c. Assign class as the privileged EXEC encrypted password.
R1(config)# enable secret class
d. Assign cisco as the console password and enable login.
R1(config)# line console 0 R1(config-line)# password cisco R1(config-line)# login
e. Assign cisco as the vty password. You will enable login later in this activity.
R1(config)# line vty 0 4 R1(config-line)# password cisco
f. Encrypt the plaintext passwords.
R1(config)# service password-encryption
g. Create a banner that warns anyone accessing the device that unauthorized access is prohibited.
R1(config)# banner motd $ Authorized Users Only! $
h. Save the running configuration to the startup configuration file.
R1# copy running-config startup-config
Step 3: Configure basic settings for each switch.
a. Assign a device name to the switch.
Switch(config)# hostname S1
b. Disable DNS lookup to prevent the router from attempting to translate incorrectly entered commands as though they were host names.
S1(config)# no ip domain-lookup
c. Assign class as the privileged EXEC encrypted password.
S1(config)# enable secret class
d. Assign cisco as the console password and enable login.
S1(config)# line console 0 S1(config-line)# password cisco S1(config-line)# login
e. Assign cisco as the vty password. You will enable login later in this activity.
S1(config)# line vty 0 15 S1(config-line)# password cisco
f. Encrypt the plaintext passwords.
S1(config)# service password-encryption
g. Create a banner that warns anyone accessing the device that unauthorized access is prohibited.
S1(config)# banner motd $ Authorized Users Only! $
h. Save the running configuration to the startup configuration file.
S1(config)# exit S1# copy running-config startup-config
Part 2: Configure VLANs on the Switches
Step 1: Create VLANs on both switches.
a. Create and name the required VLANs on each switch from the VLAN table.
S1(config)# vlan 20 S1(config-vlan)# name Management S1(config-vlan)# vlan 30 S1(config-vlan)# name Operations S1(config-vlan)# vlan 40 S1(config-vlan)# name Sales S1(config-vlan)# vlan 999 S1(config-vlan)# name ParkingLot S1(config-vlan)# vlan 1000 S1(config-vlan)# name Native S1(config-vlan)# exit S2(config)# vlan 20 S2(config-vlan)# name Management S2(config-vlan)# vlan 30 S2(config-vlan)# name Operations S2(config-vlan)# vlan 40 S2(config-vlan)# name Sales S2(config-vlan)# vlan 999 S2(config-vlan)# name ParkingLot S2(config-vlan)# vlan 1000 S2(config-vlan)# name Native S2(config-vlan)# exit
b. Configure the management interface and default gateway on each switch using the IP address information in the Addressing Table.
S1(config)# interface vlan 20 S1(config-if)# ip address 10.20.0.2 255.255.255.0 S1(config-if)# no shutdown S1(config-if)# exit S1(config)# ip default-gateway 10.20.0.1 S1(config)# end S2(config)# interface vlan 20 S2(config-if)# ip address 10.20.0.3 255.255.255.0 S2(config-if)# no shutdown S2(config-if)# exit S2(config)# ip default-gateway 10.20.0.1 S2(config)# end
c. Assign all unused ports on the switch to the Parking Lot VLAN. Configure them for static access mode, and administratively deactivate them.
Note: The interface range command helps to accomplish this task with as few commands as necessary.
S1(config)# interface range f0/2-4, f0/7-24, g0/1-2 S1(config-if-range)# switchport mode access S1(config-if-range)# switchport access vlan 999 S1(config-if-range)# shutdown S1(config-if-range)# end S2(config)# interface range f0/2-4, f0/6-17, f0/19-24, g0/1-2 S2(config-if-range)# switchport mode access S2(config-if-range)# switchport access vlan 999 S2(config-if-range)# shutdown S2(config-if-range)# end
Step 2: Assign VLANs to the correct switch interfaces.
a. Assign used ports to the appropriate VLAN (specified in the VLAN table) and configure them for static access mode.
S1(config)# interface f0/6 S1(config-if)# switchport mode access S1(config-if)# switchport access vlan 30 S2(config)# interface f0/5 S2(config-if)# switchport mode access S2(config-if)# switchport access vlan 20 S2(config-if)# interface f0/18 S2(config-if)# switchport mode access S2(config-if)# switchport access vlan 40
b. Issue the show vlan brief command and verify that the VLANs are assigned to the correct interfaces.
S1# show vlan brief VLAN NameStatusPorts —- ——————————– ——— ——————————- 1defaultactiveFa0/1, Fa0/5 20Managementactive 30OperationsactiveFa0/6 40Salesactive 999ParkingLotactiveFa0/2, Fa0/3, Fa0/4, Fa0/7 Fa0/8, Fa0/9, Fa0/10, Fa0/11 Fa0/12, Fa0/13, Fa0/14, Fa0/15 Fa0/16, Fa0/17, Fa0/18, Fa0/19 Fa0/20, Fa0/21, Fa0/22, Fa0/23 Fa0/24, Gig0/1, Gig0/2 1000 Nativeactive 1002 fddi-defaultactive 1003 token-ring-defaultactive 1004 fddinet-defaultactive 1005 trnet-defaultactive S2# show vlan brief VLAN NameStatusPorts —- ——————————– ——— ——————————- 1defaultactiveFa0/1 20Managementactive 30Operationsactive 40SalesactiveFa0/18 999ParkingLotactiveFa0/2, Fa0/3, Fa0/4, Fa0/5 Fa0/6, Fa0/7, Fa0/8, Fa0/9 Fa0/10, Fa0/11, Fa0/12, Fa0/13 Fa0/14, Fa0/15, Fa0/16, Fa0/17 Fa0/19, Fa0/20, Fa0/21, Fa0/22 Fa0/23, Fa0/24, Gig0/1, Gig0/2 1000 Nativeactive 1002 fddi-defaultactive 1003 token-ring-defaultactive 1004 fddinet-defaultactive 1005 trnet-defaultactive
Part 3: Configure Trunking
Step 1: Manually configure trunk interface F0/1.
a. Change the switchport mode on interface F0/1 to force trunking. Make sure to do this on both switches.
S1(config)# interface f0/1 S1(config-if)# switchport mode trunk S2(config)# interface f0/1 S2(config-if)# switchport mode trunk
b. As a part of the trunk configuration, set the native vlan to 1000 on both switches. You may see error messages temporarily while the two interfaces are configured for different Native VLANs.
S1(config-if)# switchport trunk native vlan 1000 S2(config-if)# switchport trunk native vlan 1000
c. As another part of trunk configuration, specify that VLANs 20, 30, and 1000 are allowed to cross the trunk.
S1(config-if)# switchport trunk allowed vlan 20,30,40,1000 S2(config-if)# switchport trunk allowed vlan 20,30,40,1000
d. Issue the show interfaces trunk command to verify trunking ports, the Native VLAN and allowed VLANs across the trunk.
S1# show interfaces trunk PortModeEncapsulationStatusNative vlan Fa0/1on802.1qtrunking1000 PortVlans allowed on trunk Fa0/120,30,40,1000 PortVlans allowed and active in management domain Fa0/120,30,40,1000 PortVlans in spanning tree forwarding state and not pruned Fa0/120,30,40,1000 S2# show interface trunk PortModeEncapsulationStatusNative vlan Fa0/1on802.1qtrunking1000 PortVlans allowed on trunk Fa0/120,30,40,1000 PortVlans allowed and active in management domain Fa0/130,40,1000 PortVlans in spanning tree forwarding state and not pruned Fa0/130,40
Step 2: Manually configure S1’s trunk interface F0/5.
a. Configure S1’s interface F0/5 with the same trunk parameters as F0/1. This is the trunk to R1.
S1(config)# interface f0/5 S1(config-if)# switchport mode trunk S1(config-if)# switchport trunk native vlan 1000 S1(config-if)# switchport trunk allowed vlan 20,30,40,1000
b. Save the running configuration to the startup configuration file.
S1# copy running-config startup-config
Part 4: Configure Routing
Step 1: Configure Inter-VLAN Routing on R1.
a. Activate interface G0/0/1 on the router.
R1(config)# interface g0/0/1 R1(config-if)# no shutdown
b. Configure sub-interfaces for each VLAN as specified in the Addressing Table. All sub-interfaces use 802.1Q encapsulation. Ensure the sub-interface for the Native VLAN does not have an IP address assigned. Include a description for each sub-interface.
R1(config)# interface g0/0/1.20 R1(config-subif)# description Management Network R1(config-subif)# encapsulation dot1q 20 R1(config-subif)# ip address 10.20.0.1 255.255.255.0 R1(config-subif)# interface g0/0/1.30 R1(config-subif)# encapsulation dot1q 30 R1(config-subif)# description Operations Network R1(config-subif)# ip address 10.30.0.1 255.255.255.0 R1(config-subif)# interface g0/0/1.40 R1(config-subif)# encapsulation dot1q 40 R1(config-subif)# description Sales Network R1(config-subif)# ip address 10.40.0.1 255.255.255.0 R1(config-subif)# interface g0/0/1.1000 R1(config-subif)# encapsulation dot1q 1000 native R1(config-subif)# description Native VLAN
c. Configure interface G0/0/0 on R1 with addressing from the Addressing Table.
R1(config)# interface g0/0/0 R1(config-if)# ip address 172.16.1.1 255.255.255.0 R1(config-if)# no shutdown
d. Use the show ip interface brief command to verify that the sub-interfaces are operational.
R1# show ip interface brief InterfaceIP-AddressOK? Method StatusProtocol GigabitEthernet0/0/0172.16.1.1YES manual upup GigabitEthernet0/0/1unassignedYES unsetupup GigabitEthernet0/0/1.2010.20.0.1YES manual upup GigabitEthernet0/0/1.3010.30.0.1YES manual upup GigabitEthernet0/0/1.4010.40.0.1YES manual upup GigabitEthernet0/0/1.1000unassignedYES unsetupup Vlan1unassignedYES unsetadministratively down down
Step 2: Configure the R2 interface g0/0/1 using the Addressing table and a default route with the next hop 10.20.0.1
R2(config)# interface g0/0/1 R2(config-if)# ip address 10.20.0.4 255.255.255.0 R2(config-if)# no shutdown R2(config-if)# exit R2(config)# ip route 0.0.0.0 0.0.0.0 10.20.0.1
Part 5: Configure Remote Access
Step 1: Configure all network devices for basic SSH support.
a. Create a local user with the username SSHadmin and $cisco123! as the encrypted password.
R1(config)# username SSHadmin secret $cisco123!
b. Use ccna-lab.com as the domain name.
R1(config)# ip domain name ccna-lab.com
c. Generate crypto keys using a 1024-bit modulus.
R1(config)# crypto key generate rsa general-keys modulus 1024
d. Configure the first five vty lines on each device to support SSH connections only and to authenticate to the local user database.
R1(config)# line vty 0 4 R1(config-line)# transport input ssh R1(config-line)# login local R1(config-line)# exit
Part 6: Verify Connectivity
Step 1: Configure PC hosts.
Refer to the Addressing Table for PC host address information.
Step 2: Complete the following tests. All should be successful.
Note: If you click Check Results, you will see that the five highlighted Connectivity Tests show as incorrect. This is because you have not implemented ACLs yet. After ACLs are implemented, these five highlighted Connectivity Tests should successfully fail.
| From | Protocol | Destination | Result |
|---|---|---|---|
| PC-A | Ping | 10.40.0.10 | Success |
| PC-A | Ping | 10.20.0.1 | Success |
| PC-B | Ping | 10.30.0.10 | Success |
| PC-B | Ping | 10.20.0.1 | Success |
| PC-B | Ping | 172.16.1.1 | Success |
| PC-B | HTTPS | 172.16.1.2 | Success |
| PC-A | HTTPS | 172.16.1.2 | Success |
| PC-B | SSH | 10.20.0.4 | Success |
| PC-B | SSH | 172.16.1.1 | Success |
Part 7: Configure and Verify Extended Access Control Lists
When basic connectivity is verified, the company requires the following security policies to be implemented:
Policy 1: The Sales Network is not allowed to SSH to the Management Network (but other SSH is allowed).
Policy 2: The Sales Network is not allowed to access server-A using any web protocol (HTTP/HTTPS). All other web traffic is allowed.
Policy 3: The Sales Network is not allowed to send ICMP echo requests to the Operations or Management Networks. ICMP echo requests to other destinations are allowed.
Policy 4: The Operations network is not allowed to send ICMP echo requests to the Sales Network. ICMP echo requests to other destinations are allowed.
Step 1: Develop and apply extended access lists that will meet the security policy statements.
R1(config)# access-list 101 remark ACL 101 fulfills policies 1, 2, and 3 R1(config)# access-list 101 deny tcp 10.40.0.0 0.0.0.255 10.20.0.0 0.0.0.255 eq 22 R1(config)# access-list 101 deny tcp 10.40.0.0 0.0.0.255 172.16.1.2 0.0.0.0 eq 80 R1(config)# access-list 101 deny tcp 10.40.0.0 0.0.0.255 172.16.1.2 0.0.0.0 eq 443 R1(config)# access-list 101 deny icmp 10.40.0.0 0.0.0.255 10.20.0.0 0.0.0.255 echo R1(config)# access-list 101 deny icmp 10.40.0.0 0.0.0.255 10.30.0.0 0.0.0.255 echo R1(config)# access-list 101 permit ip any any R1(config)# interface g0/0/1.40 R1(config-subif)# ip access-group 101 in R1(config)# access-list 102 remark ACL 102 fulfills policy 4 R1(config)# access-list 102 deny icmp 10.30.0.0 0.0.0.255 10.40.0.0 0.0.0.255 echo R1(config)# access-list 102 permit ip any any R1(config)# interface g0/0/1.30 R1(config-subif)# ip access-group 102 in
Step 2: Verify that security policies are being enforced by the deployed access lists.
Run the following tests. The expected results are shown in the table:
Note: Click Check Results to force Packet Tracer to run all the Connectivity Tests again.
| From | Protocol | Destination | Result |
|---|---|---|---|
| PC-A | Ping | 10.40.0.10 | Fail |
| PC-A | Ping | 10.20.0.1 | Success |
| PC-B | Ping | 10.30.0.10 | Fail |
| PC-B | Ping | 10.20.0.1 | Fail |
| PC-B | Ping | 172.16.1.1 | Success |
| PC-B | HTTPS | 172.16.1.2 | Fail |
| PC-A | HTTPS | 172.16.1.2 | Success |
| PC-B | SSH | 10.20.0.4 | Fail |
| PC-B | SSH | 172.16.1.1 | Success |
Device Configs - Final
ROUTER R1
! ============================================================== !--- 5.5.2 Packet Tracer - Configure and Verify Extended IPv4 ACLs - Physical Mode !--- ANSWER SCRIPT FOR ROUTER R1 !--- Usage: after cabling per the topology (G0/0/0 <-> Server-A, G0/0/1 trunk <-> S1 F0/5) !--- and powering on, console in, enter privileged EXEC mode with "enable", then paste this !--- whole file. Every line beginning with "!" is a comment; IOS ignores it. Physical !--- cabling itself is a drag-and-drop action on the Cable Pegboard, not an IOS command, so !--- it is not included here. ! ============================================================== enable configure terminal ! -------------------------------------------------------------- !--- Part 1, Step 2: Basic device settings ! -------------------------------------------------------------- hostname R1 no ip domain lookup enable secret class line console 0 password cisco login exit ! -------------------------------------------------------------- !--- vty password is set here, but login is intentionally NOT enabled yet - the lab does !--- this later in Part 5 via "login local" once SSH is configured, so vty access stays !--- effectively closed (no login method) until then. ! -------------------------------------------------------------- line vty 0 4 password cisco exit service password-encryption banner motd $ Authorized Users Only! $ copy running-config startup-config ! -------------------------------------------------------------- !--- Part 4, Step 1a-b: Trunk to S1, with a sub-interface per VLAN. The Native VLAN !--- sub-interface (.1000) deliberately gets NO ip address - a native VLAN sub-interface !--- carries untagged traffic and isn't meant to be a routed gateway here. ! -------------------------------------------------------------- interface GigabitEthernet0/0/1 no shutdown interface GigabitEthernet0/0/1.20 description Management Network encapsulation dot1Q 20 ip address 10.20.0.1 255.255.255.0 interface GigabitEthernet0/0/1.30 description Operations Network encapsulation dot1Q 30 ip address 10.30.0.1 255.255.255.0 interface GigabitEthernet0/0/1.40 description Sales Network encapsulation dot1Q 40 ip address 10.40.0.1 255.255.255.0 interface GigabitEthernet0/0/1.1000 description Native VLAN encapsulation dot1Q 1000 native ! -------------------------------------------------------------- !--- Part 4, Step 1c: R1's link to Server-A. !--- NOTE: the lab's own prose for this step says "Configure interface G0/0/1 on R1..." but !--- G0/0/1 was already fully configured with sub-interfaces just above - the actual command !--- shown right after that sentence is for G0/0/0 (172.16.1.1/24, matching Server-A's !--- gateway in the Addressing Table), which is what's used here. Simple prose typo, not a !--- functional error. ! -------------------------------------------------------------- interface GigabitEthernet0/0/0 ip address 172.16.1.1 255.255.255.0 no shutdown ! -------------------------------------------------------------- !--- Part 5, Step 1: Basic SSH support. !--- Password confirmed as literally "$cisco123!" (including the leading dollar sign) by !--- testing against the real Packet Tracer grading. ! -------------------------------------------------------------- username SSHadmin secret $cisco123! ip domain name ccna-lab.com crypto key generate rsa general-keys modulus 1024 line vty 0 4 transport input ssh login local exit ! -------------------------------------------------------------- !--- Part 7, Step 1: ACL 101 fulfills Policies 1-3 (all restrict the Sales network's !--- outbound access), applied inbound on the Sales sub-interface - closest to that traffic's !--- source. ACL 102 fulfills Policy 4 (restricts Operations -> Sales ICMP only), applied !--- inbound on the Operations sub-interface for the same reason. ! -------------------------------------------------------------- access-list 101 remark ACL 101 fulfills policies 1, 2, and 3 !--- Policy 1: Sales cannot SSH (TCP/22) to the Management network. access-list 101 deny tcp 10.40.0.0 0.0.0.255 10.20.0.0 0.0.0.255 eq 22 !--- Policy 2: Sales cannot reach Server-A over HTTP or HTTPS. access-list 101 deny tcp 10.40.0.0 0.0.0.255 172.16.1.2 0.0.0.0 eq 80 access-list 101 deny tcp 10.40.0.0 0.0.0.255 172.16.1.2 0.0.0.0 eq 443 !--- Policy 3: Sales cannot ping the Management or Operations networks. access-list 101 deny icmp 10.40.0.0 0.0.0.255 10.20.0.0 0.0.0.255 echo access-list 101 deny icmp 10.40.0.0 0.0.0.255 10.30.0.0 0.0.0.255 echo access-list 101 permit ip any any interface GigabitEthernet0/0/1.40 ip access-group 101 in exit access-list 102 remark ACL 102 fulfills policy 4 !--- Policy 4: Operations cannot ping the Sales network. access-list 102 deny icmp 10.30.0.0 0.0.0.255 10.40.0.0 0.0.0.255 echo access-list 102 permit ip any any interface GigabitEthernet0/0/1.30 ip access-group 102 in end copy running-config startup-config ! ============================================================== !--- Verification (from R1 and the PCs, after Part 7): !--- R1# show ip interface brief -> both G0/0/0 and every G0/0/1 sub-interface up/up !--- R1# show access-lists -> ACL 101 (5 lines + permit) and ACL 102 (1 line + permit), !--- each with its remark !--- PC-A (Operations) > ping 10.40.0.10 (PC-B) -> fails (ACL 102) !--- PC-A > ping 10.20.0.1, > https to 172.16.1.2 -> both succeed (untouched by either ACL) !--- PC-B (Sales) > ping 10.30.0.10, ping 10.20.0.1, https to 172.16.1.2, ssh to 10.20.0.4 !--- -> all four fail (ACL 101) !--- PC-B > ping 172.16.1.1, ssh to 172.16.1.1 -> both succeed (172.16.1.1 itself isn't !--- part of any network or host these rules target) ! ==============================================================
ROUTER R2
! ============================================================== !--- 5.5.2 Packet Tracer - Configure and Verify Extended IPv4 ACLs - Physical Mode !--- ANSWER SCRIPT FOR ROUTER R2 !--- Usage: after cabling per the topology (G0/0/1 <-> S2 F0/5) and powering on, console in, !--- enter privileged EXEC mode with "enable", then paste this whole file. Every line !--- beginning with "!" is a comment; IOS ignores it. !--- R2 needs no VLANs/trunking/ACLs of its own - it's a single-homed router on the !--- Management network (10.20.0.0/24) reaching everything else via a default route. ! ============================================================== enable configure terminal ! -------------------------------------------------------------- !--- Part 1, Step 2: Basic device settings (same pattern as R1). ! -------------------------------------------------------------- hostname R2 no ip domain lookup enable secret class line console 0 password cisco login exit line vty 0 4 password cisco exit service password-encryption banner motd $ Authorized Users Only! $ copy running-config startup-config ! -------------------------------------------------------------- !--- Part 4, Step 2: R2's own interface plus a default route back toward R1 (which owns the !--- internet-facing connection - not shown in this topology excerpt - and shares that route !--- via the network, per the lab's background statement). ! -------------------------------------------------------------- interface GigabitEthernet0/0/1 ip address 10.20.0.4 255.255.255.0 no shutdown exit ip route 0.0.0.0 0.0.0.0 10.20.0.1 ! -------------------------------------------------------------- !--- Part 5, Step 1: Basic SSH support - same commands as R1, applied here on R2. Password !--- confirmed as literally "$cisco123!" (including the leading dollar sign) by testing !--- against the real Packet Tracer grading. ! -------------------------------------------------------------- username SSHadmin secret $cisco123! ip domain name ccna-lab.com crypto key generate rsa general-keys modulus 1024 line vty 0 4 transport input ssh login local end copy running-config startup-config ! ============================================================== !--- Verification (from R2 and the PCs): !--- R2# show ip route -> S* 0.0.0.0/0 [1/0] via 10.20.0.1 !--- PC-B > ping 10.20.0.1 (R2's own gateway toward R1) -> succeeds !--- PC-B > ssh 10.20.0.4 -> fails once R1's ACL 101 is in place (Sales -> Management SSH !--- is blocked at R1, before it would even reach R2) ! ==============================================================
SWITCH S1
! ==============================================================
!--- 5.5.2 Packet Tracer - Configure and Verify Extended IPv4 ACLs - Physical Mode
!--- ANSWER SCRIPT FOR SWITCH S1
!--- Usage: after cabling per the topology (F0/1 <-> S2 F0/1, F0/5 <-> R1 G0/0/1, F0/6 <->
!--- PC-A) and powering on, console in, enter privileged EXEC mode with "enable", then paste
!--- this whole file. Every line beginning with "!" is a comment; IOS ignores it.
!--- NOTE ON DASH CHARACTERS: the lab document renders hyphens in interface ranges as an
!--- en-dash ("f0/2 – 4") - almost certainly a word-processor auto-correct artifact, not a
!--- real IOS token. Real IOS only accepts a plain hyphen ("f0/2-4"), which is what's used
!--- below.
! ==============================================================
enable
configure terminal
! --------------------------------------------------------------
!--- Part 1, Step 3: Basic device settings
! --------------------------------------------------------------
hostname S1
no ip domain-lookup
enable secret class
line console 0
password cisco
login
exit
line vty 0 15
password cisco
exit
service password-encryption
banner motd $ Authorized Users Only! $
exit
copy running-config startup-config
configure terminal
! --------------------------------------------------------------
!--- Part 2, Step 1a: Create all 5 VLANs from the VLAN table.
! --------------------------------------------------------------
vlan 20
name Management
vlan 30
name Operations
vlan 40
name Sales
vlan 999
name ParkingLot
vlan 1000
name Native
exit
! --------------------------------------------------------------
!--- Part 2, Step 1b: Management interface + default gateway (S1 itself lives on VLAN 20).
! --------------------------------------------------------------
interface vlan 20
ip address 10.20.0.2 255.255.255.0
no shutdown
exit
ip default-gateway 10.20.0.1
! --------------------------------------------------------------
!--- Part 2, Step 1c: Every unused port -> Parking Lot VLAN, access mode, shut down. Ports
!--- F0/1 (trunk to S2), F0/5 (trunk to R1), and F0/6 (PC-A) are excluded since they're used.
! --------------------------------------------------------------
interface range f0/2-4, f0/7-24, g0/1-2
switchport mode access
switchport access vlan 999
shutdown
exit
! --------------------------------------------------------------
!--- Part 2, Step 2a: Assign the one used access port (PC-A on the Operations/VLAN 30 LAN).
! --------------------------------------------------------------
interface FastEthernet0/6
switchport mode access
switchport access vlan 30
exit
! --------------------------------------------------------------
!--- Part 3, Step 1: Trunk to S2 (F0/1) - force trunking, set native VLAN to 1000, and
!--- restrict which VLANs may actually cross it.
!--- NOTE: the lab's prose here says "VLANs 10, 20, 30, and 1000 are allowed to cross the
!--- trunk" - but there is no VLAN 10 anywhere in this lab's VLAN table; the actual command
!--- immediately below it correctly lists 20, 30, 40, 1000 (Management/Operations/Sales/
!--- Native), which is what's used here. Simple prose typo, not a functional error.
! --------------------------------------------------------------
interface FastEthernet0/1
switchport mode trunk
switchport trunk native vlan 1000
switchport trunk allowed vlan 20,30,40,1000
exit
! --------------------------------------------------------------
!--- Part 3, Step 2: Trunk to R1 (F0/5) - identical trunk parameters as F0/1.
! --------------------------------------------------------------
interface FastEthernet0/5
switchport mode trunk
switchport trunk native vlan 1000
switchport trunk allowed vlan 20,30,40,1000
exit
! --------------------------------------------------------------
!--- Part 5, Step 1: Basic SSH support - "all network devices" includes the switches, not
!--- just the routers, even though the lab only prints these commands once under R1.
!--- Password confirmed as literally "$cisco123!" (including the leading dollar sign) by
!--- testing against the real Packet Tracer grading.
! --------------------------------------------------------------
username SSHadmin secret $cisco123!
ip domain name ccna-lab.com
crypto key generate rsa general-keys modulus 1024
line vty 0 15
transport input ssh
login local
end
copy running-config startup-config
! ==============================================================
!--- Verification:
!--- S1# show vlan brief -> VLAN 30 (Operations) shows Fa0/6; VLAN 999 shows every port in
!--- the shutdown range; VLANs 20 and 40 show no local ports (they only exist on S1 for
!--- trunking/routing purposes, not local access ports)
!--- S1# show interfaces trunk -> Fa0/1 and Fa0/5 both trunking, native VLAN 1000, allowed
!--- VLANs 20,30,40,1000
! ==============================================================
SWITCH S2
! ============================================================== !--- 5.5.2 Packet Tracer - Configure and Verify Extended IPv4 ACLs - Physical Mode !--- ANSWER SCRIPT FOR SWITCH S2 !--- Usage: after cabling per the topology (F0/1 <-> S1 F0/1, F0/5 <-> R2 G0/0/1, F0/18 <-> !--- PC-B) and powering on, console in, enter privileged EXEC mode with "enable", then paste !--- this whole file. Every line beginning with "!" is a comment; IOS ignores it. !--- Unlike S1's F0/5 (a trunk to R1), S2's F0/5 connects to R2 as a plain ACCESS port on !--- the Management VLAN (20) - R2 has no sub-interfaces/trunk of its own in this topology, !--- it's just a regular host on that VLAN's subnet. ! ============================================================== enable configure terminal ! -------------------------------------------------------------- !--- Part 1, Step 3: Basic device settings ! -------------------------------------------------------------- hostname S2 no ip domain-lookup enable secret class line console 0 password cisco login exit line vty 0 15 password cisco exit service password-encryption banner motd $ Authorized Users Only! $ exit copy running-config startup-config configure terminal ! -------------------------------------------------------------- !--- Part 2, Step 1a: Create all 5 VLANs from the VLAN table. ! -------------------------------------------------------------- vlan 20 name Management vlan 30 name Operations vlan 40 name Sales vlan 999 name ParkingLot vlan 1000 name Native exit ! -------------------------------------------------------------- !--- Part 2, Step 1b: Management interface + default gateway. ! -------------------------------------------------------------- interface vlan 20 ip address 10.20.0.3 255.255.255.0 no shutdown exit ip default-gateway 10.20.0.1 ! -------------------------------------------------------------- !--- Part 2, Step 1c: Every unused port -> Parking Lot VLAN, access mode, shut down. Ports !--- F0/1 (trunk to S1), F0/5 (R2), and F0/18 (PC-B) are excluded since they're used. ! -------------------------------------------------------------- interface range f0/2-4, f0/6-17, f0/19-24, g0/1-2 switchport mode access switchport access vlan 999 shutdown exit ! -------------------------------------------------------------- !--- Part 2, Step 2a: Assign the two used access ports - R2 on Management (VLAN 20), and !--- PC-B on Sales (VLAN 40). ! -------------------------------------------------------------- interface FastEthernet0/5 switchport mode access switchport access vlan 20 exit interface FastEthernet0/18 switchport mode access switchport access vlan 40 exit ! -------------------------------------------------------------- !--- Part 3, Step 1: Trunk to S1 (F0/1) - force trunking, set native VLAN to 1000, and !--- restrict which VLANs may cross it. Same VLAN-10-vs-40 prose-typo note as on S1's !--- script applies here too - the actual command (20,30,40,1000) is correct. ! -------------------------------------------------------------- interface FastEthernet0/1 switchport mode trunk switchport trunk native vlan 1000 switchport trunk allowed vlan 20,30,40,1000 ! -------------------------------------------------------------- !--- Part 5, Step 1: Basic SSH support - same as S1/R1/R2. ! -------------------------------------------------------------- exit username SSHadmin secret $cisco123! ip domain name ccna-lab.com crypto key generate rsa general-keys modulus 1024 line vty 0 15 transport input ssh login local end copy running-config startup-config ! ============================================================== !--- Verification: !--- S2# show vlan brief -> VLAN 40 (Sales) shows Fa0/18; VLAN 999 shows every port in the !--- shutdown range; VLAN 20 shows no local access port listed (F0/5 is a VLAN 20 access !--- port carrying R2's traffic, but "show vlan brief" only lists ports on VLANs that !--- aren't also involved in trunking/routing elsewhere the same way S1 behaves for VLANs !--- 20/40) !--- S2# show interfaces trunk -> Fa0/1 trunking, native VLAN 1000, allowed VLANs !--- 20,30,40,1000 ! ==============================================================
