CloudLabBox
Try the free demo

CCNA lab 33 of 46

Standard ACLs: wildcard masks and where to place them

Protect an HR server so that only the sales office can reach it: write a numbered standard ACL, rebuild it as a named ACL with remarks and sequence numbers, restrict who may manage the core router, and learn why standard ACLs belong close to the destination.

Run this lab

It needs Lite: its 6 nodes are set to 6 vCPU and 6,144 MB in total. That fits the free demo too.

In your workspace: Shared, then CCNA 200-301 guided labs, then 33 - Standard ACLs - wildcard masks and where to place them

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 50 minutes
Nodes need
6 vCPU, 6,144 MB
Smallest plan
Lite

The scenario

Elmstead Builders keeps payroll on an HR server (PC3, 10.33.30.100) behind R3. Today every network can reach it, including the guest Wi-Fi. The policy is simple: only the sales office (10.33.10.0/24) may reach the HR LAN, plus one named contractor laptop on the guest network; and only the sales office may manage the core router R2.

NetworkWhereNotes
10.33.10.0/24 SalesR1 Gi0/1, PC1 .10allowed to HR
10.33.20.0/24 GuestR1 Gi0/2, PC2 .10denied, except the contractor at 10.33.20.50
10.33.30.0/24 HRR3 Gi0/1, server PC3 .100to protect
10.0.12.0/30, 10.0.23.0/30R1–R2, R2–R3OSPF area 0

What you’ll practise

  • Explain ACL processing: top-down, first match, implicit deny
  • Calculate wildcard masks for hosts, subnets and ranges
  • Configure and apply a numbered standard ACL in the right place and direction
  • Edit a named standard ACL with sequence numbers and remarks
  • Restrict VTY access with access-class and read ACL hit counters

The tasks

  1. Learn how an ACL is read
  2. Master wildcard masks
  3. Protect the HR LAN with a numbered ACL
  4. Rebuild it as a named ACL and edit it
  5. Restrict management of R2
  6. Read the counters and the interface
  7. See why placement matters

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Standard ACLs - wildcard masks and where to place them6 nodes, 5 links. Every link is listed as text below the diagram.R1R2R3PC1PC2PC3Gi0/1eth0Gi0/2eth0Gi0/1eth0Gi0/0Gi0/0Gi0/1Gi0/0
6 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • R1 Gi0/0 to R2 Gi0/0
  • R2 Gi0/1 to R3 Gi0/0
  • R1 Gi0/1 to PC1 eth0
  • R1 Gi0/2 to PC2 eth0
  • R3 Gi0/1 to PC3 eth0
Nodes in Standard ACLs: wildcard masks and where to place them, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
R1Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 1,024 MB
R2Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 1,024 MB
R3Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 1,024 MB
PC1VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB
PC2VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB
PC3VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CCNA 200-301 guided labs.

  3. Open 33 - Standard ACLs - wildcard masks and where to place them and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More CCNA labs

All CCNA labs

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.