This is an ACL or access control list lab.
We've been told that we need to restrict traffic internally using router 1 as follows, one of the big
decisions to make is where are you going to bind the access list?
We've been told to bind it in the most efficient place on router 1, In these examples
we are restricting traffic from the user PCs the most efficient place to bind the access list
would be here gigabit 000.
That's because we don't want the border to have to process the traffic and then simply drop it on the
outbound interface.
Extended access lists allow us to be very granular and we are able to specify individual traffic types
and port numbers when permitting or denying traffic.
So this is where we're going to bind the access list.
We generally want to bind extended access lists as close to the source as possible to stop devices having
to process the traffic and then simply drop it.
Now, firstly, we need to permit traffic from PC 1 to HTTP server one using HTTP.
So here's our router.
Show IP interface brief, we can see the IP addresses on the router, the router has been configured with
IP addresses already.
This PC has an IP address
of 10.1.2.101, for the real world and for the exam
don't forget about the command IP config that also shows you the IP address of the PC.
So it has an IP address of 10.
1.2.101.
This server
has an IP address of 10.1.100.
So we want to permit traffic from this IP address
to this IP address
but only permit HTTP.
We've been told which access list number to use, so that makes it simple.
Remember extended access lists
have this range, standard IP access lists have this range.
Now, if you check this on a real device, you'll notice that there are actually additional numbers.
So in this example, I'll telnet to a real physical router that I have
and if I access list question mark.
Notice standard access list in the range 1 to 99, but there's also this range, which is called the
expanded range. IP
extended access lists are in this range, but there's also this expanded range of extended IP access
lists. For the exam
those are the two most important ranges to know.
And that's what we have in packet tracer. So on the router access list 100 and we are going to
permit specific traffic. First
we're using TCP here because HTTP resides on top of TCP.
Now the source address is going to be host
10.1.2.101, so 10.1.2.101 now we could use greater than
but we're not going to do that here.
The destination
is our server 10.1.1.100.
So 10.1.1.100
we need to specify the port number, which in our example is going to be 80 HTTP.
So now do show run pipe include access.
Notice this line access list 100 permit TCP host 10 .1.2.101 host 10.1.1.100 equal WWW.
So the router has automatically converted the port number to a word which is fine.
So that's the first access list entry.