CloudLabBox
Try the free demo

Cisco ASA lab 3 of 15

Access control lists, objects and object groups

Publish the DMZ web server to the internet, restrict what inside users may do, and lock down the DMZ with a global ACL, using network and service objects, object groups, remarks, logging and hit counts.

Run this lab

It needs Lite: its 5 nodes are set to 5 vCPU and 4,096 MB in total. That fits the free demo too.

In your workspace: Shared, then Cisco ASA Firewall SCOR 350-701 guided labs, then 03 - Access control lists objects and object groups

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 60 minutes
Nodes need
5 vCPU, 4,096 MB
Smallest plan
Lite

The scenario

HQ-FW is running with the default policy from lab 1, and the security team has signed off a written rule set for Kestrel HQ:

  1. Internet to DMZ: anyone may reach the web server WEB (172.16.10.10) on HTTP and HTTPS. Only the ISP's monitoring host 198.51.100.10 may ping it. Everything else from the internet is denied and logged.
  2. Inside: IT admins (today only PC1, 10.10.10.10) may manage DMZ servers with SSH and Telnet. All staff, IT included, may use web (HTTP, HTTPS), DNS and ping to anywhere. Everything else is denied and logged.
  3. DMZ: servers may only send DNS and NTP queries towards the internet. Write this as a global ACL.
  4. Incident: during the change window the SOC reports that 203.0.113.1 is scanning Kestrel. Block it completely.

What you’ll practise

  • Write extended ACLs with network objects, service objects and object groups
  • Apply ACLs inbound on an interface and as a global ACL, and explain the processing order
  • Explain how an inside ACL removes the default higher-to-lower permit
  • Insert, remark and log ACL entries, and read hit counts
  • Use packet-tracer to see which ACL line decides a flow

The tasks

  1. Build the objects
  2. Internet to DMZ
  3. Inside users
  4. Global ACL for the DMZ
  5. The scanner
  6. Read the counters

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Access control lists objects and object groups5 nodes and 1 network, 5 links. Every link is listed as text below the diagram.HQ-FWPC1PC2WEBISPInside-LANGi0/0Gi0/0Gi0/1Gi0/0Gi0/0Gi0/2Gi0/0
5 nodes and 1 network, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • HQ-FW Gi0/0 to Inside-LAN (network)
  • PC1 Gi0/0 to Inside-LAN (network)
  • PC2 Gi0/0 to Inside-LAN (network)
  • HQ-FW Gi0/1 to ISP Gi0/0
  • HQ-FW Gi0/2 to WEB Gi0/0
Nodes in Access control lists, objects and object groups, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
HQ-FWCisco ASAvasav-9.22.1.1-PLR-Licensed1 vCPU, 2,048 MB
PC1Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
PC2Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
WEBCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
ISPCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Cisco ASA Firewall SCOR 350-701 guided labs.

  3. Open 03 - Access control lists objects and object groups and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Cisco ASA labs

All Cisco ASA labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.