Lab Objective:
Learn how to configure an extended access list.
Lab Purpose:
Extended lists offer far more granularity than standard lists. Standard ACLs can block only source hosts or networks, whereas extended ACLs can block sources/destinations as well as many ports and protocols.
The basic configuration is the same as in the standard ACL lab, so if you want a quick fix, remove the existing ACL and configure the new one.
R0(config)#no access-list 1
R0(config)#int g0/0
R0(config-if)#no ip access-group 1 in
By now, I’m sure you know how to use the end and exit commands to get back to the correct router prompt, so I’ll leave that part to you.
Lab Tool:
Packet Tracer
Lab Topology:
Please use the following topology to complete this lab exercise:
Lab Walkthrough:
Task 1:
Connect two routers with a crossover cable. We will use loopback interfaces to simulate networks/hosts. You already know how to change the router hostnames.
R0(config)#int g0/0
R0(config-if)#ip add 192.168.1.1 255.255.255.252
R0(config-if)#no shut
R0(config-if)#int lo0
R0(config-if)#ip add 172.16.1.1 255.255.0.0
R0(config-if)#int lo1
R0(config-if)#ip add 172.20.1.1 255.255.0.0
R1(config)#int g0/0
R1(config-if)#ip add 192.168.1.2 255.255.255.252
R1(config-if)#no shut
R1(config-if)#int lo0
R1(config-if)#ip add 10.1.1.1 255.0.0.0
R1(config-if)#exi
Task 2:
Ping across the link.
R0#ping 192.168.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.2, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 0/0/0 ms
Task 3:
Configure a static route on R0 and R1 so each can reach the network on the other side, and then test with the ‘ping’ command.
R0(config)#ip route 0.0.0.0 0.0.0.0 192.168.1.2
R1(config)#ip route 0.0.0.0 0.0.0.0 192.168.1.1
R0#ping 10.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 0/0/1 ms
R1#ping 172.16.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 0/0/1 ms
R1#ping 172.20.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.20.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 0/0/1 ms
Task 4:
Configure an access list on R0. Traffic from 10.1.1.1 should be blocked if it’s trying to access the 172.16.0.0 network. Any other traffic from this or other hosts should be permitted.
R0(config)#access-list 100 deny ip host 10.1.1.1 172.16.0.0 0.0.255.255
R0(config)#access-list 100 permit ip any any
R0(config)#int g0/0
R0(config-if)#ip access-group 100 in
Task 5:
Test the access list by pinging 172.16.1.1 from 192.168.1.2 (which it will automatically do because it’s the closest interface) and then from 172.16.1.1 (loopback 0). The U response means the traffic has been blocked.
R1#ping 172.16.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 0/0/1 ms
R1#ping
Protocol [ip]:
Target IP address: 172.16.1.1
Repeat count [5]:
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface: loopback0
Type of service [0]:
Set DF bit in IP header? [no]:
Validate reply data? [no]:
Data pattern [0xABCD]:
Loose, Strict, Record, Timestamp, Verbose[none]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
Packet sent with a source address of 10.1.1.1
UUUUU
Success rate is 0 percent (0/5)
Task 6:
You can check the ACL for hits on the router if you wish.
R0#show ip access-lists
Extended IP access list 100
10 deny ip host 10.1.1.1 172.16.0.0 0.0.255.255 (5 match(es))
20 permit ip any any (5 match(es))
Notes:
ACLs are pretty tricky, and each vendor has its own way of configuring them, so don’t sweat the commands too much. Just bear in mind that they are processed from top to bottom, and if there is a match, the traffic stops. At the end of each ACL is an implicit ‘deny all’ command.
