8.6.5 Packet Tracer - Configure IP ACLs to Mitigate Attacks Answers

SERVER> ssh -l SSHadmin 192.168.2.1

PC> ssh -l SSHadmin 192.168.2.1

R1(config)# access-list 10 permit host 192.168.3.3

R2(config)# access-list 10 permit host 192.168.3.3

R3(config)# access-list 10 permit host 192.168.3.3

R1(config-line)# access-class 10 in

R2(config-line)# access-class 10 in

R3(config-line)# access-class 10 in

PC> ssh –l SSHadmin 192.168.2.1

R1(config)# access-list 120 permit udp any host 192.168.1.3 eq domain

R1(config)# access-list 120 permit tcp any host 192.168.1.3 eq smtp

R1(config)# access-list 120 permit tcp any host 192.168.1.3 eq ftp

R1(config)# access-list 120 deny tcp any host 192.168.1.3 eq 443

R1(config)# access-list 120 permit tcp host 192.168.3.3 host 10.1.1.1 eq 22

R1(config)# interface s0/0/0

R1(config-if)# ip access-group 120 in

R1(config)# access-list 120 permit icmp any any echo-reply

R1(config)# access-list 120 permit icmp any any unreachable

R1(config)# access-list 120 deny icmp any any

R1(config)# access-list 120 permit ip any any

R3(config)# access-list 110 permit ip 192.168.3.0 0.0.0.255 any

R3(config)# interface g0/1

R3(config-if)# ip access-group 110 in

R3(config)# access-list 100 permit tcp 10.0.0.0 0.255.255.255 eq 22 host 192.168.3.3

R3(config)# access-list 100 deny ip 10.0.0.0 0.255.255.255 any

R3(config)# access-list 100 deny ip 172.16.0.0 0.15.255.255 any

R3(config)# access-list 100 deny ip 192.168.0.0 0.0.255.255 any

R3(config)# access-list 100 deny ip 127.0.0.0 0.255.255.255 any

R3(config)# access-list 100 deny ip 224.0.0.0 15.255.255.255 any

R3(config)# access-list 100 permit ip any any

R3(config)# interface s0/0/1

R3(config-if)# ip access-group 100 in

! ==============================================================
!--- 8.6.5 Packet Tracer - Configure IP ACLs to Mitigate Attacks
!--- ANSWER SCRIPT FOR ROUTER R1
!--- Usage: from the console (or CLI tab) on R1, enter privileged EXEC mode with "enable",
!--- then paste this whole file. Every line beginning with "!" is a comment; IOS ignores it.
!--- R1 is already pre-configured (enable secret ciscoenpa55, console ciscoconpa55, SSH
!--- SSHadmin/ciscosshpa55, addressing, static routing) - this lab only adds ACLs on top.
!--- Confirmed against this lab's own "Device Configs - Final" section.
! ==============================================================

enable
configure terminal

! --------------------------------------------------------------
!--- Part 2, Step 1-2: ACL 10 restricts VTY (Telnet/SSH) access to R1 down to the
!--- management station PC-C only.
! --------------------------------------------------------------
access-list 10 permit host 192.168.3.3

line vty 0 4
 access-class 10 in
exit

! --------------------------------------------------------------
!--- Part 3, Step 2: ACL 120 - edge filtering for PC-A's exposed services. Permit DNS/SMTP/
!--- FTP inbound to PC-A, explicitly deny HTTPS to PC-A, and let PC-C specifically SSH to
!--- R1's own S0/0/0 address (10.1.1.1 - the near side of the R1<->R2 link, which is what
!--- PC-C's SSH traffic actually arrives at once it enters R1 from the WAN side).
! --------------------------------------------------------------
access-list 120 permit udp any host 192.168.1.3 eq domain
access-list 120 permit tcp any host 192.168.1.3 eq smtp
access-list 120 permit tcp any host 192.168.1.3 eq ftp
access-list 120 deny tcp any host 192.168.1.3 eq 443
access-list 120 permit tcp host 192.168.3.3 host 10.1.1.1 eq 22

! --------------------------------------------------------------
!--- Part 3, Step 3: apply inbound on S0/0/0 - this is the WAN-facing link (to R2), so
!--- "inbound" here means traffic arriving FROM the rest of the network toward PC-A/R1.
! --------------------------------------------------------------
interface Serial0/0/0
 ip access-group 120 in
exit

! --------------------------------------------------------------
!--- Part 4, Step 2: extend ACL 120 (appended via auto-numbering, landing after the 5 lines
!--- above) - allow diagnostic ICMP replies back in, block everything else ICMP-related
!--- (e.g. inbound ping floods), then explicitly re-permit all other IP traffic so the ACL's
!--- earlier lines remain the only real restrictions (without this line, the implicit deny
!--- at the very end of the ACL would silently block everything not already matched above).
! --------------------------------------------------------------
access-list 120 permit icmp any any echo-reply
access-list 120 permit icmp any any unreachable
access-list 120 deny icmp any any
access-list 120 permit ip any any

end

! --------------------------------------------------------------
!--- Operational habit (not explicitly required by this lab): save to NVRAM.
! --------------------------------------------------------------
copy running-config startup-config

! ==============================================================
!--- Verification (from R1, PC-A, and PC-C):
!---   PC-C > ssh -l SSHadmin 192.168.2.1 (R2's Lo0) -> succeeds
!---   PC-A > ssh -l SSHadmin 192.168.2.1             -> fails (blocked by ACL 10 on R2's VTY)
!---   PC-C > browse https://192.168.1.3 (PC-A)       -> fails (blocked by ACL 120's deny 443)
!---   PC-A > ping 192.168.2.1 (R2's Lo0)              -> succeeds (echo-reply permitted back)
!---   R1# show access-lists -> ACL 10 (1 line) and ACL 120 (9 lines total, in the exact
!---   order both parts added them)
! ==============================================================

! ==============================================================
!--- 8.6.5 Packet Tracer - Configure IP ACLs to Mitigate Attacks
!--- ANSWER SCRIPT FOR ROUTER R2
!--- Usage: from the console (or CLI tab) on R2, enter privileged EXEC mode with "enable",
!--- then paste this whole file. Every line beginning with "!" is a comment; IOS ignores it.
!--- R2 is the middle router (between R1 and R3) and hosts the Cluster Cloud link plus its
!--- own Loopback0 - it only needs the same VTY-restriction ACL as the other two routers,
!--- no traffic-filtering ACLs of its own in this lab.
! ==============================================================

enable
configure terminal

! --------------------------------------------------------------
!--- Part 2, Step 1-2: ACL 10 restricts VTY (Telnet/SSH) access to R2 down to the
!--- management station PC-C only.
! --------------------------------------------------------------
access-list 10 permit host 192.168.3.3

line vty 0 4
 access-class 10 in

end

! --------------------------------------------------------------
!--- Operational habit (not explicitly required by this lab): save to NVRAM.
! --------------------------------------------------------------
copy running-config startup-config

! ==============================================================
!--- Verification:
!---   PC-C > ssh -l SSHadmin 192.168.2.1 (Lo0) and 209.165.200.225 (G0/0) -> both succeed
!---   PC-A > ssh -l SSHadmin 192.168.2.1 -> fails
! ==============================================================

! ==============================================================
!--- 8.6.5 Packet Tracer - Configure IP ACLs to Mitigate Attacks
!--- ANSWER SCRIPT FOR ROUTER R3
!--- Usage: from the console (or CLI tab) on R3, enter privileged EXEC mode with "enable",
!--- then paste this whole file. Every line beginning with "!" is a comment; IOS ignores it.
!--- R3 is the edge router closest to PC-C (the management station) - it gets both an
!--- egress anti-spoofing filter (only PC-C's own LAN may leave via R3) and an ingress
!--- anti-spoofing filter (block obviously-fake source addresses arriving from the WAN).
!--- Confirmed against this lab's own "Device Configs - Final" section.
! ==============================================================

enable
configure terminal

! --------------------------------------------------------------
!--- Part 2, Step 1-2: ACL 10 restricts VTY (Telnet/SSH) access to R3 down to PC-C itself.
! --------------------------------------------------------------
access-list 10 permit host 192.168.3.3

line vty 0 4
 access-class 10 in
exit

! --------------------------------------------------------------
!--- Part 6, Step 1: ACL 100 - ingress anti-spoofing on the WAN-facing link. Explicitly
!--- permit SSH RETURN traffic first (source port 22, i.e. replies from an SSH server R2 or
!--- R1 out on the 10.0.0.0/8 WAN addressing) back to PC-C - this ACL has no "established"
!--- keyword, so without this line the deny lines right after would also catch legitimate
!--- SSH session replies. Then deny any inbound traffic falsely claiming to originate from
!--- RFC 1918 private space, the loopback block, or multicast - addresses that should never
!--- legitimately arrive FROM the outside network.
! --------------------------------------------------------------
access-list 100 permit tcp 10.0.0.0 0.255.255.255 eq 22 host 192.168.3.3
access-list 100 deny ip 10.0.0.0 0.255.255.255 any
access-list 100 deny ip 172.16.0.0 0.15.255.255 any
access-list 100 deny ip 192.168.0.0 0.0.255.255 any
access-list 100 deny ip 127.0.0.0 0.255.255.255 any
access-list 100 deny ip 224.0.0.0 15.255.255.255 any
access-list 100 permit ip any any

interface Serial0/0/1
 ip access-group 100 in
exit

! --------------------------------------------------------------
!--- Part 5, Step 1: ACL 110 - egress anti-spoofing on the LAN-facing link. Only traffic
!--- genuinely sourced from R3's own internal network (192.168.3.0/24) may leave toward the
!--- WAN - blocks any spoofed-source traffic originating from inside this network.
! --------------------------------------------------------------
access-list 110 permit ip 192.168.3.0 0.0.0.255 any

interface GigabitEthernet0/1
 ip access-group 110 in

end

! --------------------------------------------------------------
!--- Operational habit (not explicitly required by this lab): save to NVRAM.
! --------------------------------------------------------------
copy running-config startup-config

! ==============================================================
!--- Verification (from PC-C):
!---   PC-C > ping 192.168.1.3 (PC-A)     -> echo replies are blocked by ACL 100 (they'd be
!---   sourced from the 192.168.0.0/16 space, which the deny-192.168.0.0/16 line catches)
!---   PC-C > ssh -l SSHadmin 192.168.2.1 (R2's Lo0, 192.168.2.x)  -> fails (same reasoning -
!---   the reply would come from 192.168.2.1, not the explicitly-permitted 10.0.0.0/8 range)
!---   PC-C > ssh -l SSHadmin 209.165.200.225 (R2's G0/0)          -> succeeds (this reply
!---   path uses R2's WAN-side 10.x addressing, matching the explicit permit line)
!---   R3# show access-lists -> ACL 10 (1 line), ACL 100 (7 lines), ACL 110 (1 line)
! ==============================================================