CloudLabBox
Try the free demo

HCIA-Datacom lab 13 of 22

Basic and advanced ACLs

Turn three security requirements into ACLs. You use a basic ACL near the destination to keep guests out of the server farm, an advanced ACL near the source to wall off Finance from Sales, and a VTY ACL to lock down remote logins, while learning how VRP matches rules and what happens to unmatched traffic.

Run this lab

It needs Lite: its 4 nodes are set to 4 vCPU and 7,168 MB in total. That fits the free demo too.

In your workspace: Shared, then HCIA-Datacom H12-811 guided labs, then 13 - Basic and advanced ACLs

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 60 minutes
Nodes need
4 vCPU, 7,168 MB
Smallest plan
Lite

The scenario

Northwind's network runs OSPF, and everything can reach everything. That's exactly what the security team doesn't want. You get three requirements:

  1. Guests (192.168.2.0/24, simulated by R1's LoopBack1) must not reach anything behind R2: no server, no Finance.
  2. Sales (192.168.1.0/24, where PC1 sits) may use the server 3.3.3.3 but must not reach the Finance servers (172.16.1.0/24) at all.
  3. Only the core router R2 (10.0.23.2) may open a remote login (Telnet) to R3.

What you’ll practise

  • Explain basic (2000–2999) and advanced (3000–3999) ACLs, rule numbering, wildcards and first-match order
  • Apply ACLs with traffic-filter inbound and outbound, and choose where to place them
  • Know that traffic-filter permits packets no rule matches, and that router-generated traffic skips inbound filters
  • Restrict Telnet and SSH logins with an ACL on the VTY lines

The tasks

  1. Load the starting configuration
  2. Keep guests out of the server farm
  3. Wall off Finance from Sales
  4. Read the ACLs
  5. Lock down remote logins on R3
  6. Optional, a TCP test from a PC

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Basic and advanced ACLs4 nodes, 3 links. Every link is listed as text below the diagram.R1R2R3PC1GE0/0/1eth0GE0/0/0GE0/0/0GE0/0/1GE0/0/1
4 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • R1 GE0/0/0 to R2 GE0/0/0
  • R2 GE0/0/1 to R3 GE0/0/1
  • R1 GE0/0/1 to PC1 eth0
Nodes in Basic and advanced ACLs, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
R1Huawei AR1000V routerhuaweiar1k-5.170-V300R022C00SPC100-Auto-update-esn1 vCPU, 2,048 MB
R2Huawei AR1000V routerhuaweiar1k-5.170-V300R022C00SPC100-Auto-update-esn1 vCPU, 2,048 MB
R3Huawei AR1000V routerhuaweiar1k-5.170-V300R022C00SPC100-Auto-update-esn1 vCPU, 2,048 MB
PC1VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder HCIA-Datacom H12-811 guided labs.

  3. Open 13 - Basic and advanced ACLs and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More HCIA-Datacom labs

All HCIA-Datacom labs

Related labs in other courses

CloudLabBox is independent of Huawei. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.