CloudLabBox
Try the free demo

CCNP ENCOR lab 29 of 36

ACLs and control plane policing

Lock down Fernhill's Bristol router: restrict management access with a standard ACL, fence the guest network with an extended named ACL, protect a server with an outbound ACL, and keep the router's CPU safe with control plane policing.

Run this lab

It needs Lite: its 5 nodes are set to 5 vCPU and 3,584 MB in total. That fits the free demo too.

In your workspace: Shared, then CCNP ENCOR 350-401 guided labs, then 29 - ACLs and control plane policing

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 70 minutes
Nodes need
5 vCPU, 3,584 MB
Smallest plan
Lite

The scenario

An external penetration test of Fernhill Freight's Bristol branch found three problems: anyone on any subnet can open a Telnet or SSH session to the routers; guests on the Wi-Fi can reach internal servers; and a simple ping flood pushes the router's CPU to 100%. Your job is to close all three findings on R1 (and protect the HR server at HQ on R2).

DeviceInterfaceAddressNotes
R1Gi0/0 / Lo010.0.12.1/30 / 10.255.0.1/32WAN to R2
R1Gi0/110.20.10.1/24staff LAN, PC1 10.20.10.10
R1Gi0/210.20.50.1/24guest Wi-Fi, PC2 10.20.50.10
R2Gi0/0 / Gi0/110.0.12.2/30 / 10.10.30.1/24HQ; server LAN
R2Lo99 / Lo010.10.99.1/24 / 198.51.100.1/24IT admin subnet / "the internet"
SRVGi0/010.10.30.10/24HR web application (HTTP)

OSPF runs between R1 and R2, and R2 sends a default route. Both routers have the local user admin / Fh-Adm1n! for remote logins.

The security policy:

  1. Only the IT admin subnet 10.10.99.0/24 may open management sessions to R1 and R2.
  2. Guests may use DNS, HTTP, HTTPS and ping towards the internet and may ping their own gateway, but may not reach any 10.0.0.0/8 address. Everything else is dropped and logged.
  3. The HR server accepts only web traffic from anyone, pings from anyone, and Telnet from the admin subnet.
  4. R1's control plane: routing protocol traffic always gets through; management is limited to 256 kbit/s; ICMP to the router is limited to 8 kbit/s; everything else to 64 kbit/s.

Topology: PC1 and PC2 connect to R1; R1 — R2 — SRV.

What you’ll practise

  • Choose between standard, extended, numbered and named ACLs, and place them correctly
  • Restrict VTY access with access-class
  • Write an extended named ACL with an explicit deny and logging, and read its hit counters
  • Explain what CoPP protects and build a policy with class maps and policers
  • Prove CoPP drops excess ICMP without hurting routing or management

The tasks

  1. Plan the ACLs
  2. Restrict management access
  3. Fence the guest network
  4. Protect the HR server
  5. Police the control plane
  6. Prove CoPP works

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of ACLs and control plane policing5 nodes, 4 links. Every link is listed as text below the diagram.R1R2SRVPC1PC2Gi0/1eth0Gi0/2eth0Gi0/1Gi0/0Gi0/0Gi0/0
5 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • R1 Gi0/0 to R2 Gi0/0
  • R2 Gi0/1 to SRV Gi0/0
  • R1 Gi0/1 to PC1 eth0
  • R1 Gi0/2 to PC2 eth0
Nodes in ACLs and control plane policing, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
R1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
R2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
SRVCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
PC1VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB
PC2VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CCNP ENCOR 350-401 guided labs.

  3. Open 29 - ACLs and control plane policing and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More CCNP ENCOR labs

All CCNP ENCOR labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.