[CCNAv6 S4] 4.2.2.11 Packet Tracer - Configuring Extended ACLs Scenario 2



Packet Tracer - Configuring Extended ACLs - Scenario 2
Addressing Table


Objectives

Part 1: Configure, Apply and Verify an Extended Numbered ACL

Part 2: Reflection Questions

Background / Scenario

In this scenario, devices on one LAN are allowed to remotely access devices in another LAN using the Telnet protocol. Besides ICMP, all traffic from other networks is denied.

Part 1:    Configure, Apply and Verify an Extended Numbered ACL
Configure, apply and verify an ACL to satisfy the following policy:

·         Telnet traffic from devices on the 10.101.117.32/28 network is allowed to devices on the 10.101.117.0/27 networks.
·         ICMP traffic is allowed from any source to any destination
·         All other traffic to 10.101.117.0/27 is blocked.
Step 1:     Configure the extended ACL.

a.     From the appropriate configuration mode on RTA, use the last valid extended access list number to configure the ACL. Use the following steps to construct the first ACL statement:

1)     The last extended list number is 199.

2)     The protocol is TCP.

3)     The source network is 10.101.117.32.

4)     The wildcard can be determined by subtracting 255.255.255.240 from 255.255.255.255.

5)     The destination network is 10.101.117.0.

6)     The wildcard can be determined by subtracting 255.255.255.224 from 255.255.255.255.

7)     The protocol is Telnet.

What is the first ACL statement?
b.     ICMP is allowed, and a second ACL statement is needed. Use the same access list number to permit all ICMP traffic, regardless of the source or destination address.  What is the second ACL statement? (Hint: Use the any keywords)

c.     All other IP traffic is denied, by default.

Step 2:     Apply the extended ACL.

The general rule is to place extended ACLs close to the source. However, since access list 199 affects traffic originating from both networks 10.101.117.48/29 and 10.101.117.32/28, the best placement for this ACL might be on interface Gigabit Ethernet 0/2 in the outbound direction. What is the command to apply ACL 199 to the Gigabit Ethernet 0/2 interface?

Step 3:     Verify the extended ACL implementation.

a.     Ping from PCB to all of the other IP addresses in the network. If the pings are unsuccessful, verify the IP addresses before continuing.

b.     Telnet from PCB to SWC. The password is cisco.

c.     Exit the Telnet service of the SWC.

d.     Ping from PCA to all of the other IP addresses in the network. If the pings are unsuccessful, verify the IP addresses before continuing.

e.     Telnet from PCA to SWC. The access list causes the router to reject the connection.

f.      Telnet from PCA to SWB. The access list is placed on G0/2 and does not affect this connection.

g.     After logging into SWB, do not log out. Telnet to SWC.

Part 2:    Reflection Questions
1.     How was PCA able to bypass access list 199 and Telnet to SWC?

2.     What could have been done to prevent PCA from accessing SWC indirectly, while allowing PCB Telnet access to SWC?




Configuration RTA:

enable
configure terminal
access-list 199 permit tcp 10.101.117.32 0.0.0.15 10.101.117.0 0.0.0.31 eq telnet
access-list 199 permit icmp any any
interface g0/2
 ip access-group 199 out
 end
write memory
!

END !~!



Nhận xét

Đăng nhận xét

Bài đăng phổ biến từ blog này

[CCNAv6 S4] 8.2.4.14 Packet Tracer - Troubleshooting Enterprise Networks 3

Hình ảnh
Packet Tracer – Troubleshooting Enterprise Networks 3 Addressing Table Background This activity uses a variety of technologies you have encountered during your CCNA studies, including routing, port security, EtherChannel, DHCP, NAT, PPP, and Frame Relay. Your task is to review the requirements, isolate and resolve any issues, and then document the steps you took to verify the requirements. Note: This activity begins with a partial score. Requirements DHCP ·         R1 is the DHCP server for the R1 LAN. Switching Technologies ·         Port security is configured to only allow PC1 to access S1's F0/3 interface. All violations should disable the interface. ·         Link aggregation using EtherChannel is configured on S2, S3, and S4. Routing ·         All routers are configured with OSPF process ID 1 and no routing updates should be sent across interfaces that do n...
Đọc thêm

[CCNAv6 S2] 2.2.2.4 Packet Tracer - Configuring IPv4 Static and Default Routes

Hình ảnh
Packet Tracer - Configuring IPv4 Static and Default Routes Addressing Table Objectives Part 1: Examine the Network and Evaluate the Need for Static Routing Part 2: Configure Static and Default Routes Part 3: Verify Connectivity Background In this activity, you will configure static and default routes. A static route is a route that is entered manually by the network administrator to create a reliable and safe route. There are four different static routes that are used in this activity: a recursive static route, a directly attached static route, a fully specified static route, and a default route. Part 1:     Examine the Network and Evaluate the Need for Static Routing a.     Looking at the topology diagram, how many networks are there in total? b.    How many networks are directly connected to R1, R2, and R3? c.     How many static routes are required by each router to reach networks that are not directly ...
Đọc thêm

[CCNAv6 S2] 7.3.2.4 Packet Tracer - Troubleshooting Standard IPv4 ACLs

Hình ảnh
Packet Tracer – Troubleshooting Standard IPv4 ACLs Addressing Table Objectives Part 1: Troubleshoot ACL Issue 1 Part 2: Troubleshoot ACL Issue 2 Part 3: Troubleshoot ACL Issue 3 Scenario This network is meant to have the following three policies implemented: ·         Hosts from the 192.168.0.0/24 network are unable to access network 10.0.0.0/8. ·         L3 can’t access any devices in network 192.168.0.0/24. ·         L3 can’t access Server1 or Server2. L3 should only access Server3. ·         Hosts from the 172.16.0.0/16 network have full access to Server1, Server2 and Server3. Note: All FTP usernames and passwords are “cisco”. No other restrictions should be in place. Unfortunately, the rules that have been implemented are not working correctly. Your task is to find and fix the errors related to the access lists on R1. Part 1:     Troublesh...
Đọc thêm