This is an ACL or access control list or lab.
In this lab, you've been asked to configure router 1 to restrict traffic based on these instructions,
we need to use access list 100.
In other words, an extended IP version 4 access list. Inside PC 1, which is this PC here, should
be restricted so that it can only access HTTP server 1 using HTTP on subnet 10.1.1.0/24.
In other words, this PC should only be able to access the server using HTTP.
These two servers are in subnet 10.1.1.0/24, the inside PCs are in subnet 10.1.2.0
/24, inside PC 2 this PC here should only be able to access HTTP server to this server using HTTPS
on that subnet.
So in other words, the only device that PC 1 should be able to access on subnet 10.1.1.0
is this server using HTTP, the only device that PC 2 should be able to access on subnet 10.1.1
0 is this server using HTTPS.
No other PCs or servers on the subnet 10.1.2.0 should be able to access any other devices on
network 10.1.1.0/24.
At the moment we only have these two PCs.
But if you had another device connected to this switch in this subnet, 10.1.2.0/24.
That device should not be able to access any other devices in subnet 10.1.1.0/24. Now by default
there is an implicit deny any in Cisco IP access lists.
Normally you would add an explicit line to log traffic so you would use the word log at the end of your
access list
entry to log traffic to a syslog server for example.
Now packet tracer doesn't support that logging option.
So we're going to add the line explicitly.
But in the real world, we would add a log keyword to log that traffic.
It will allow us, however, to see matches on an access list.
So we're going to explicitly specify that line host on subnet 10.1.2.1 should be able to access
any other network.
So in other words, these two PCs should be able to access Cisco.com and Facebook.com.
Now you need to bind the access list in the most efficient place on router 1.
So where are you going to place the access list on router 1?
You need to decide where that access list will be placed, will it be placed here, here or here?
Now, don't forget, just because you've configured something doesn't mean that it's working the
way you think it's working.
Routers do what you tell them, not what you think they should do.
So make sure that you verify that things are working properly.
So verify that inside PC 1 can access internal HTTP server 1 using HTTP, but it's not able to ping
HTTP server 2 for example, verify that inside PC 2 can access the internal HTTP server 2 using HTTPS
but can't ping HTTP server 1.
You could also do some additional tests like PC 2 shouldn't be able to browse using HTTP to server
1,PC 1 shouldn't be able to browse, using it to server 2 and so forth and so on.
You should also verify that both inside PC 1 and PC 2 can browse to Cisco.com and Facebook.
com.
Now, we'll do a more complex lab in a separate video, but this is an example to get you started.
Are you able to complete the lab? Download the attached packet tracer a file and see if you can complete
the lab yourself.
In the next video, I'll give you some tips and tricks, as well as show you how to complete the lab.