Arista EOS lab 6 of 20
ACLs and management-plane hardening with IPv6 basics
Protect Northwind's infrastructure from the user VLAN with an extended ACL and per-entry counters, restrict SSH to the admin workstation with a standard ACL on the management plane, inspect the control-plane ACL, and add dual-stack IPv6 with static routes.
Run this lab
It needs Lite: its 4 nodes are set to 4 vCPU and 5,120 MB in total. That fits the free demo too.
In your workspace: Shared, then Arista EOS guided labs, then 06 - ACLs and management-plane hardening with IPv6 basics
- Level
- Intermediate
- Time
- About 65 minutes
- Nodes need
- 4 vCPU, 5,120 MB
- Smallest plan
- Lite
The scenario
An audit found that anyone on Northwind's user VLAN can reach the switches' infrastructure loopbacks and try SSH logins on them. Your brief: users may reach the application server srv1 only with ping, SSH and web; nobody on the user VLAN may touch the infrastructure range 10.255.0.0/24; and only the admin workstation h1 (10.10.10.11) may open SSH to spine1. While you're there, bring the segment up dual-stack for the IPv6 pilot.
| Device | Interface | IPv4 | IPv6 |
|---|---|---|---|
| leaf1 | Ethernet1 | 10.1.1.1/31 | 2001:db8:0:1::2/64 |
| leaf1 | Ethernet3 (USERS, routed port) | 10.10.10.1/24 | 2001:db8:10::1/64 |
| leaf1 | Loopback0 | 10.255.0.11/32 | – |
| spine1 | Ethernet1 | 10.1.1.0/31 | 2001:db8:0:1::1/64 |
| spine1 | Vlan30 (SERVERS) | 10.30.30.1/24 | 2001:db8:30::1/64 |
| spine1 | Loopback0 (management) | 10.255.0.1/32 | – |
| h1 | eth0 (admin workstation) | 10.10.10.11/24 via .1 | 2001:db8:10::11/64 via ::1 |
| srv1 | eth0 (application server) | 10.30.30.100/24 via .1 | 2001:db8:30::100/64 via ::1 |
IPv4 routing and the netops user (secret Arista-Lab1) are already configured on both switches.
What you’ll practise
- Write an extended IPv4 ACL with ordered entries, port lists and per-entry counters, and know where deny logging fits
- Apply an ACL inbound on the users' routed port and prove both its permits and its denies
- Restrict SSH access with a standard ACL under management ssh and set an idle timeout
- Read the default control-plane ACL and explain what it protects
- Enable IPv6 routing, address interfaces and hosts, add IPv6 static routes and test with ping6
The tasks
- Address the hosts and record the baseline
- Write and apply the user ACL
- Lock SSH to the admin workstation
- Read the control-plane ACL
- Bring up IPv6
The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.
Topology and devices
The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.
Every link, as text
- leaf1
Ethernet1to spine1Ethernet1 - leaf1
Ethernet3to h1eth0 - spine1
Ethernet3to srv1eth0
| Node | Device | Image in Add Node | Set to |
|---|---|---|---|
| leaf1 | Arista vEOS | veos-4.33.1.1F | 1 vCPU, 2,048 MB |
| spine1 | Arista vEOS | veos-4.33.1.1F | 1 vCPU, 2,048 MB |
| h1 | Alpine Linux | clbalpinebase-alpine-base-3-20-3 | 1 vCPU, 512 MB |
| srv1 | Alpine Linux | clbalpinebase-alpine-base-3-20-3 | 1 vCPU, 512 MB |
How to open this lab
Sign in to your workspace at
lab.cloudlabbox.com.In File Manager, open Shared, then the folder
Arista EOS guided labs.Open
06 - ACLs and management-plane hardening with IPv6 basicsand start its nodes, then open Lab Tasks for the scenario and the steps.
The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.
More Arista EOS labs
Related labs in other courses
CloudLabBox is independent of Arista Networks. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.