Lab 5.5.3 – Troubleshooting Access Control Lists (Answers)

Lab 5.5.3 – Troubleshooting Access Control Lists (Answers)

Topology Diagram

Addressing Table

Learning Objectives

To complete this lab:

• Cable a network according to the topology diagram
• Erase the startup configuration and reload a router to the default state
• Load routers with scripts
• Find and correct network errors
• Document the corrected network

Scenario

You work for a regional service provider that has customers who have recently experienced several security breaches. Some security policies have been implemented that haven’t addressed the specific needs of the customers. Your department has been asked to examine the configuration, conduct tests and change the configuration as necessary to secure the customer routers.

Ensure that your final configurations implement the following security policies:

• R1 and R3 customers request that only local PCs are able to access VTY lines. Log any attempts by other devices to access the VTY lines.
• R1 and R3 directly connected networks should not be allowed to send or receive traffic to each other. All other traffic should be allowed to and from R1 and R3.

A minimum of ACL statements should be used and applied inbound on the R2 serial interfaces. OSPF is used to distribute routing information. All passwords, except the enable secret password, are set to cisco. The enable secret password is set to class.

Task 1: Load Routers with the Supplied Scripts

[Instructor note: These commands can be loaded into the router by the instructor or by the students. They are not included in the student version of the lab.]

R1

hostname R1
enable secret class
no ip domain lookup
!
interface FastEthernet0/1
ip address 10.1.1.254 255.255.255.0
no shutdown
!
interface Serial0/0/0
ip address 10.1.0.1 255.255.255.0
clock rate 125000
no shutdown
ip access-group VTY-Local out
!
router ospf 1
network 10.1.0.0 0.0.0.255 area 0
network 10.1.1.0 0.0.0.255 area 0
!
ip access-list standard VTY-Local
deny any log
permit 10.1.1.0 0.0.0.255
!
banner motd ^Unauthorized access strictly prohibited, violators will be
prosecuted to the full extent of the law.^
!
line con 0
password cisco
logging synchronous
login
line aux 0
line vty 0 4
password cisco
login

R2

hostname R2
enable secret class
!
interface Loopback0
ip address 10.13.205.1 255.255.0.0
!
interface Serial0/0/0
ip address 10.1.0.2 255.255.255.0
no shutdown
ip access-group block-R3 in
!
interface Serial0/0/1
ip address 10.3.0.5 255.255.255.0
clock rate 125000
no shutdown
ip access-group block-R1 out
!
router ospf 1
network 10.1.0.0 0.0.0.255 area 0
network 10.3.0.0 0.0.0.255 area 0
network 10.13.0.0 0.0.255.255 area 0
!
ip access-list extended block-R1
deny ip 10.1.1.0 0.0.0.255 10.3.0.0 0.0.0.255
permit ip any any
!
ip access-list extended block-R3
deny ip 10.3.0.0 0.0.1.255 10.1.0.0 0.0.1.255
!
banner motd ^Unauthorized access strictly prohibited, violators will be
prosecuted to the full extent of the law.^
!
line con 0
password cisco
logging synchronous
login
!
line vty 0 4
password cisco
login

R3

hostname R3
enable secret class
no ip domain lookup
!
interface FastEthernet0/1
ip address 10.3.1.254 255.255.255.0
no shutdown
!
interface Serial0/0/1
ip address 10.3.0.6 255.255.255.0
no shutdown
!
router ospf 1
network 10.3.0.0 0.0.0.255 area 0
network 10.3.1.0 0.0.0.255 area 0
!
ip access-list standard VTY-Local
permit 10.3.11.0 0.0.0.255
deny any log
!
banner motd ^Unauthorized access strictly prohibited, violators will be
prosecuted to the full extent of the law.^
!
line con 0
password cisco
logging synchronous
login
!
line vty 0 4
access-class VTY-Local in
password cisco
login

Task 2: Find and Correct Network Errors

Find and correct all errors in the configuration. Document the steps you used to troubleshoot the network and note each error found.

Task 3: Document the Corrected Network

Now that you have corrected all errors and tested connectivity throughout the network, document the final configuration for each device.

R1

hostname R1
enable secret class
no ip domain lookup
!
interface FastEthernet0/1
ip address 10.1.1.254 255.255.255.0
!
interface Serial0/0/0
ip address 10.1.0.1 255.255.255.0
clockrate 125000
!
router ospf 1
log-adjacency-changes
network 10.1.0.0 0.0.0.255 area 0
network 10.1.1.0 0.0.0.255 area 0
!
ip access-list standard VTY-Local
permit 10.1.1.0 0.0.0.255
deny any log
!
banner motd ^Unauthorized access strictly prohibited, violators will be
prosecuted to the full extent of the law.^
!
line con 0
password cisco
logging synchronous
login
!
line vty 0 4
access-class VTY-Local in
password cisco
login
!

R2

hostname R2
enable secret class
!
interface Loopback0
ip address 10.13.205.1 255.255.0.0
!
interface Serial0/0/0
ip address 10.1.0.2 255.255.255.0
ip access-group block-R1 in
!
interface Serial0/0/1
ip address 10.3.0.6 255.255.255.0
clockrate 125000
ip access-group block-R3 in
!
router ospf 1
log-adjacency-changes
network 10.1.0.0 0.0.0.255 area 0
 network 10.3.0.0 0.0.0.255 area 0
network 10.13.0.0 0.0.255.255 area 0
!
ip access-list extended block-R1
deny ip 10.1.0.0 0.0.1.255 10.3.0.0 0.0.1.255
permit ip any any
!
ip access-list extended block-R3
deny ip 10.3.0.0 0.0.1.255 10.1.0.0 0.0.1.255
permit ip any any
!
banner motd ^Unauthorized access strictly prohibited, violators will be
prosecuted to the full extent of the law.^
!
line con 0
password cisco
logging synchronous
login
!
line vty 0 4
password cisco
login
!

R3

hostname R3
enable secret class
no ip domain lookup
!
interface FastEthernet0/1
ip address 10.3.1.254 255.255.255.0
!
interface Serial0/0/1
ip address 10.3.0.5 255.255.255.0
!
router ospf 1
network 10.3.0.0 0.0.0.255 area 0
network 10.3.1.0 0.0.0.255 area 0
!
ip access-list standard VTY-Local
permit 10.3.1.0 0.0.0.255
deny any log
!
banner motd ^Unauthorized access strictly prohibited, violators will be
prosecuted to the full extent of the law.^
!
line con 0
password cisco
logging synchronous
login
!
line vty 0 4
access-class VTY-Local in
password cisco
login

Task 4: Clean Up

Erase the configurations and reload the routers. Disconnect and store the cabling. For PC hosts that are normally connected to other networks, such as the school LAN or the Internet, reconnect the appropriate cabling and restore the TCP/IP settings.