CloudLabBox
Try the free demo

Network+ lab 20 of 27

ACLs and security rules between zones

Turn a written security policy into router ACLs. Guests get the internet but nothing internal, servers accept only web and SSH from staff, and the internet gets nothing but replies. You read hit counters and logs, and see where stateless filtering stops.

Run this lab

It needs Lite: its 5 nodes are set to 5 vCPU and 2,560 MB in total. That fits the free demo too.

In your workspace: Shared, then CompTIA Network Plus N10-009 guided labs, then 20 - ACLs and security rules between zones

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 65 minutes
Nodes need
5 vCPU, 2,560 MB
Smallest plan
Lite

The scenario

Harbour Logistics' depot router R1 joins four zones: staff, guest Wi-Fi, servers, and the internet. Today any device can reach any other. The security team has written a policy, and your job is to enforce it on R1 with access control lists.

ZoneR1 interfaceSubnetHosts
Staff (trusted)Gi0/010.10.10.0/24H1, DHCP
Guest (untrusted)Gi0/110.10.30.0/24H2, DHCP
ServersGi0/210.10.50.0/24SRV1 10.10.50.10: web 80, SSH 22, SQL 1433
Internet (untrusted)Gi0/3192.0.2.0/30R2, web on 203.0.113.1

The policy

  1. Guests may use the internet, but nothing inside 10.0.0.0/8. They must still get DHCP.
  2. Staff may reach SRV1 on web (80) and SSH (22), and ping it. Nothing else reaches SRV1, except replies to connections SRV1 started itself.
  3. From the internet, only replies to inside connections may come in (TCP replies and ping replies, plus ICMP errors for troubleshooting).

For this lab, R2 routes 10.10.0.0/16 back to R1 so that you can test inbound filtering without NAT.

What you’ll practise

  • Translate a security policy into ordered permit and deny rules
  • Write named extended ACLs with protocols, ports and wildcard masks
  • Choose the interface and direction for each ACL
  • Allow the traffic an ACL quietly breaks, such as DHCP
  • Verify with hit counters, logs and real connection tests
  • Explain the implicit deny and the limits of stateless filtering

The tasks

  1. Start the server
  2. Measure the starting point
  3. Isolate the guests
  4. Protect the server with least privilege
  5. Accept only replies from the internet
  6. Spot the classic ACL mistakes

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of ACLs and security rules between zones5 nodes, 4 links. Every link is listed as text below the diagram.R1R2H1H2SRV1Gi0/2eth0Gi0/3Gi0/0Gi0/0eth0Gi0/1eth0
5 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • R1 Gi0/0 to H1 eth0
  • R1 Gi0/1 to H2 eth0
  • R1 Gi0/2 to SRV1 eth0
  • R1 Gi0/3 to R2 Gi0/0
Nodes in ACLs and security rules between zones, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
R1Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
R2Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
H1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
H2Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
SRV1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CompTIA Network Plus N10-009 guided labs.

  3. Open 20 - ACLs and security rules between zones and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Network+ labs

All Network+ labs

Related labs in other courses

CloudLabBox is independent of CompTIA, Cisco and Netgate. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.