8.5.6 Packet Tracer - Configure Numbered Standard IPv4 ACLs Answers

R2(config)# access-list 1 deny 192.168.11.0 0.0.0.255

R2(config)# access-list 1 permit any

R2# show access-lists
Standard IP access list 1
       10 deny 192.168.11.0 0.0.0.255
       20 permit any

R2(config)# interface GigabitEthernet0/0
R2(config-if)# ip access-group 1 out

R3(config)# access-list 1 deny 192.168.10.0 0.0.0.255

R3(config)# access-list 1 permit any

R3# show access-lists
Standard IP access list 1
       10 deny 192.168.10.0 0.0.0.255
       20 permit any

R3(config)# interface GigabitEthernet0/0
R3(config-if)# ip access-group 1 out

R2# show access-lists
Standard IP access list 1
       10 deny 192.168.11.0 0.0.0.255 (4 match(es))
       20 permit any (8 match(es))

R3# show access-lists
Standard IP access list 1
       10 deny 192.168.10.0 0.0.0.255 (4 match(es))
       20 permit any (8 match(es))

! ==============================================================
!--- 8.5.6 Packet Tracer - Configure Numbered Standard IPv4 ACLs
!--- ANSWER SCRIPT FOR ROUTER R2
!--- Usage: from the console (or CLI tab) on R2, enter privileged EXEC mode with "enable",
!--- then paste this whole file. Every line beginning with "!" is a comment; IOS ignores it.
!--- R2 is already fully addressed with EIGRP routing configured - the only task here is
!--- adding standard ACL 1, which blocks the 192.168.11.0/24 network (PC2, on R1's second
!--- LAN) from reaching the Web Server (192.168.20.0/24) attached to R2's own G0/0, while
!--- permitting everyone else.
! ==============================================================

enable
configure terminal

! --------------------------------------------------------------
!--- Part 2, Step 1a-b: Build the ACL BEFORE applying it (best practice per the lab's
!--- own note: "it is not good practice to apply an untested access list to an active
!--- interface"). Standard ACLs only match on source address, so no destination/mask needed.
! --------------------------------------------------------------
access-list 1 deny 192.168.11.0 0.0.0.255
!--- Standard ACLs implicitly deny everything not matched - this line is required so
!--- every other network (PC1, PC3, and R2's own traffic) still gets through.
access-list 1 permit any

! --------------------------------------------------------------
!--- Part 2, Step 1d: Apply the ACL outbound on G0/0 - traffic is filtered as it leaves
!--- toward the Web Server, not as it arrives from the WAN side.
! --------------------------------------------------------------
interface GigabitEthernet0/0
 ip access-group 1 out

end

! --------------------------------------------------------------
!--- Operational habit (not explicitly required by this lab): save to NVRAM.
! --------------------------------------------------------------
copy running-config startup-config

! ==============================================================
!--- Verification (from R2 and the PCs):
!---   R2# show access-lists -> Standard IP access list 1: 10 deny 192.168.11.0 0.0.0.255,
!---   20 permit any (match counts will accumulate as the test pings below are run)
!---   R2# show run | include interface|access -> confirms "ip access-group 1 out" under G0/0
!---   PC1 (192.168.10.10) > ping 192.168.20.254 (Web Server) -> succeeds
!---   PC2 (192.168.11.10) > ping 192.168.20.254 (Web Server) -> fails (blocked by ACL 1)
!---   PC3 (192.168.30.10) > ping 192.168.20.254 (Web Server) -> succeeds
! ==============================================================

! ==============================================================
!--- 8.5.6 Packet Tracer - Configure Numbered Standard IPv4 ACLs
!--- ANSWER SCRIPT FOR ROUTER R3
!--- Usage: from the console (or CLI tab) on R3, enter privileged EXEC mode with "enable",
!--- then paste this whole file. Every line beginning with "!" is a comment; IOS ignores it.
!--- R3 is already fully addressed with EIGRP routing configured - the only task here is
!--- adding standard ACL 1, which blocks the 192.168.10.0/24 network (PC1, on R1's first
!--- LAN) from reaching PC3 (192.168.30.0/24) attached to R3's own G0/0, while permitting
!--- everyone else.
! ==============================================================

enable
configure terminal

! --------------------------------------------------------------
!--- Part 2, Step 2a-b: Build the ACL BEFORE applying it (same best-practice order as
!--- R2 - review/verify the list with "show access-lists" before wiring it to an interface).
! --------------------------------------------------------------
access-list 1 deny 192.168.10.0 0.0.0.255
!--- Standard ACLs implicitly deny everything not matched - this line is required so every
!--- other network (PC2 and the Web Server's network) still gets through to PC3.
access-list 1 permit any

! --------------------------------------------------------------
!--- Part 2, Step 2d: Apply the ACL outbound on G0/0 - traffic is filtered as it leaves
!--- toward PC3, not as it arrives from the WAN side.
! --------------------------------------------------------------
interface GigabitEthernet0/0
 ip access-group 1 out

end

! --------------------------------------------------------------
!--- Operational habit (not explicitly required by this lab): save to NVRAM.
! --------------------------------------------------------------
copy running-config startup-config

! ==============================================================
!--- Verification (from R3 and the PCs):
!---   R3# show access-lists -> Standard IP access list 1: 10 deny 192.168.10.0 0.0.0.255,
!---   20 permit any (match counts will accumulate as the test pings below are run)
!---   R3# show run | include interface|access -> confirms "ip access-group 1 out" under G0/0
!---   PC1 (192.168.10.10) > ping 192.168.30.10 (PC3) -> fails (blocked by ACL 1)
!---   PC2 (192.168.11.10) > ping 192.168.30.10 (PC3) -> succeeds
!---
!--- NOTE on the lab's own printed match counts: after running the 6 verification pings,
!--- the lab document shows R3's ACL as "10 deny ... (4 matches) / 20 permit any (8
!--- matches)" - identical to R2's counts. But only two of the six test pings actually
!--- cross R3's G0/0 outbound (PC1->PC3 and PC2->PC3; the PC3->Web Server ping crosses
!--- R2's G0/0, not R3's, and the other three pings never reach R3 at all), which would
!--- give 4 deny / 4 permit here, not 4/8. This looks like R2's numbers were reused by
!--- mistake rather than reflecting R3's actual traffic - though the lab explicitly notes
!--- match counts "may be different" depending on how many pings were sent, so treat the
!--- exact numbers as illustrative rather than a hard target to match.
! ==============================================================