CloudLabBox
Try the free demo

CCNA lab 34 of 46

Extended ACLs: filtering by protocol and port

Turn a written security policy into an extended ACL at a branch: allow web and DNS to the head-office servers, ping everywhere, SSH for the admin only, block Telnet and everything else to the servers, and prove each rule from a Linux host.

Run this lab

It needs Lite: its 5 nodes are set to 5 vCPU and 4,608 MB in total. That fits the free demo too.

In your workspace: Shared, then CCNA 200-301 guided labs, then 34 - Extended ACLs - filtering by protocol and port

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 55 minutes
Nodes need
5 vCPU, 4,608 MB
Smallest plan
Lite

The scenario

Larchmont Pharmacy's branch (R1) connects to head office (R2), where the web server (10.34.10.80) and DNS server (10.34.10.53) live. Security has issued this policy for traffic from the branch LAN (10.34.1.0/24):

  1. Web (HTTP, TCP 80) to the web server: allowed.
  2. DNS (UDP 53) to the DNS server: allowed.
  3. SSH to R2 (10.0.12.2) only from the admin laptop H1 (10.34.1.20).
  4. Ping (ICMP) to anywhere: allowed.
  5. Telnet to anywhere: denied and logged.
  6. Anything else to the HQ server network 10.34.10.0/24: denied and logged.
  7. Everything else: allowed.
DeviceAddress
R1Gi0/1 10.34.1.1/24 (branch LAN), Gi0/0 10.0.12.1/30
R2Gi0/0 10.0.12.2/30; Loopback10 10.34.10.80 (web) and 10.34.10.53 (DNS)
PC110.34.1.10/24
H110.34.1.20/24 (you set it)

What you’ll practise

  • Write extended ACL entries with protocols, source, destination and port operators
  • Place extended ACLs close to the source
  • Convert a numbered ACL into a named ACL with remarks and sequence numbers
  • Test permitted and denied flows with real TCP and UDP clients
  • Read hit counters and logged denies

The tasks

  1. Prepare the test client and test before filtering
  2. Learn the extended syntax
  3. Build it as numbered ACL 110
  4. Rebuild it as a named ACL
  5. Prove every rule
  6. Read the counters and the log

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Extended ACLs - filtering by protocol and port5 nodes, 4 links. Every link is listed as text below the diagram.R1R2S1PC1H1Gi0/1Gi0/0Gi0/1eth0Gi0/2eth0Gi0/0Gi0/0
5 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • R1 Gi0/0 to R2 Gi0/0
  • R1 Gi0/1 to S1 Gi0/0
  • S1 Gi0/1 to PC1 eth0
  • S1 Gi0/2 to H1 eth0
Nodes in Extended ACLs: filtering by protocol and port, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
R1Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 1,024 MB
R2Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 1,024 MB
S1Cisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 1,024 MB
PC1VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB
H1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CCNA 200-301 guided labs.

  3. Open 34 - Extended ACLs - filtering by protocol and port and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More CCNA labs

All CCNA labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.