CloudLabBox
Try the free demo

CCNP ENARSI lab 26 of 35

IPv4 and IPv6 ACLs, time-based ACLs and uRPF

Protect an Internet edge router: restrict management with a standard ACL, filter inbound IPv4 traffic with an extended named ACL and a time-based entry, filter IPv6 without breaking neighbour discovery, and drop spoofed sources with uRPF.

Run this lab

It needs Lite: its 4 nodes are set to 4 vCPU and 2,560 MB in total. That fits the free demo too.

In your workspace: Shared, then CCNP ENARSI 300-410 guided labs, then 26 - IPv4 and IPv6 ACLs time-based ACLs and uRPF

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 75 minutes
Nodes need
4 vCPU, 2,560 MB
Smallest plan
Lite

The scenario

Wagtail Design's edge router R1 connects its staff LAN and a small web service (10.26.20.1, served by R1's own HTTP server for this lab) to the Internet. Today nothing is filtered. The security policy says:

  1. Only the staff LAN may manage R1 over VTY.
  2. From the Internet, allow web traffic to the web service, pings to the web service (for the monitoring company), and replies to traffic the staff started. The web agency's vendor (203.0.113.10) may reach HTTPS on the web service during the contracted support period (1 January 2026 to 31 December 2030). Log everything else that is dropped.
  3. For IPv6, allow only web traffic to the web service from the Internet, without breaking IPv6 itself.
  4. Drop any packet arriving from the Internet with a source address that belongs inside Wagtail.
DeviceInterfaceIPv4IPv6Notes
R1Gi0/0198.51.100.1/302001:db8:a::1/64Internet
R1Gi0/110.26.10.1/242001:db8:26:10::1/64staff LAN, PC1 10.26.10.10
R1Lo2010.26.20.1/242001:db8:26:20::1/64web service
ISPGi0/0 / Gi0/1198.51.100.2/30 / 203.0.113.1/242001:db8:a::2 / 2001:db8:b::1provider
NETGi0/0203.0.113.10/242001:db8:b::10/64Internet host; Lo66 10.26.20.66 is a spoofed source

What you’ll practise

  • Apply a standard ACL to VTY lines with access-class
  • Build an extended named ACL for an Internet edge, with sequence numbers, logging and established
  • Add a time-based ACL entry and verify its state
  • Write an IPv6 traffic filter that keeps neighbour discovery working
  • Configure strict uRPF with allow-default and prove it drops spoofed packets

The tasks

  1. Restrict management access
  2. Filter the Internet edge with an extended named ACL
  3. Add a time-based entry
  4. Filter IPv6 without breaking it
  5. Drop spoofed sources with uRPF

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of IPv4 and IPv6 ACLs time-based ACLs and uRPF4 nodes, 3 links. Every link is listed as text below the diagram.R1ISPNETPC1Gi0/1eth0Gi0/0Gi0/0Gi0/1Gi0/0
4 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • R1 Gi0/0 to ISP Gi0/0
  • ISP Gi0/1 to NET Gi0/0
  • R1 Gi0/1 to PC1 eth0
Nodes in IPv4 and IPv6 ACLs, time-based ACLs and uRPF, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
R1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
ISPCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
NETCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
PC1VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CCNP ENARSI 300-410 guided labs.

  3. Open 26 - IPv4 and IPv6 ACLs time-based ACLs and uRPF and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More CCNP ENARSI labs

All CCNP ENARSI labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.