This is an ACL or access control list lab.
The second access list entry will be to permit PC 2 and only allow it to access server 2 using HTTPS.
So this PC has an IP address of 10.1.2.102
and the server has an IP address of 10.1.1.101.
So both of those devices simply have the next IP address in the list.
So Access List 100 permit TCP host, host is going to be 10.1.2.102, so 10.1.2.10
2 destination host is going to be 10.1.1.101.
Now, notice the mistake I've made, I'm going to ignore it for the moment and later on I'll correct
it when I show you how to edit access lists.
Be very careful when you edit your access lists.
You could, by mistake, delete your entire access list.
And in this example, we need to permit HTTPS, which is Port 443.
It's important that you learn your port numbers.
So do show run pipe include access?
We've now got those two entries in our access list.
Now, we're told that no other PCs or servers on subnet 10.1.2.0 should be able to access devices
on subnet 10.1.1.0.
So Access List 100 denied in this case, IP 10.1.2.0 with our mask.
Going to a destination of 10.1.1.0 with our mask, now in the real world, you'd use a word
such as log here, but I'm simply going to press enter here because packet tracer doesn't support logging.
Notice the difference on a real router access-list 100, deny, IP 10.1.2.0 going to 10.1
1.0
and notice we have the option to log traffic so there are more options than available in packet tracer.
But packet trace is great for learning.
Now we're told that hosts on the subnet can access any other network.
So we need to add a line here permitting IP from 10.1.2.0 going anywhere.
So show access lists, that's the access list that we've configured, notice access list number entries are
added automatically
and that allows you to do this, so IP access list extended 100 notice instead of using access list
100, I used the command IP access list that would allow me, for example, to delete an entry in the
access list, so if I said no study and then type do show access list.
Notice that individual line has been removed.
If I typed no access list 100, that would remove the entire access list.
So be careful doing that.
Notice the whole access list has disappeared.
So you want to go into the access list and then edit the access list manually.
So that was the first line access list 100.
And here's the problem when you remove entries.
So let me try that again, access list 100.
Access List 100.
So be careful deleting access lists.
You'll regret it in the real world if you do it by mistake.
And our last entry
is that so, again, do show access list, let's confirm that.
That's correct.
We are permitting the first host to access the first server using HTTP.
We're permitting the second host and notice there is a typo there, so let's correct that.
So IP access list extended 100 no
20, and then I can add it back by saying permit TCP host 10.1.2.102 host 10.1.1.1
01
equal 443, so do show access list, that looks better.
It's important to verify things, so I've checked that line, that line looks good.
That line has also got a mistake, so no 30, 30 deny, 30 needs to be
255, so let's verify again, that looks good, that looks good, that looks better, that looks good.
So once I verified my access list, I need to bind it.
So interface gigabit 000 command to use is IP Access Group 100 because that's the access list
number that we using.
And then we specified either inbound or outbound in this example, it's going to be inbound.
If you're working remotely, you're going to want to use a command like that.
If you working remotely, you're going to want to use a commander like that.
So before you apply your access list, and only if you are able to do a reload of the device, you would
say reload in 10 or something like that.
That means that the device will reload in 10 minutes.
So the idea is if you by mistake, lock yourself out of your router, you can get it back by forcing
it to go back to an older configuration if something goes wrong.
So for the real world, that's a good thing to do, especially if you're working remotely via telnet
or SSH, here we're connected to the console, so it doesn't matter.
We're working directly on the console.
So an access list won't block us out of a telnet session, which it may do if we working remotely.
So we've bound the access list to this port.
There's our access list, so let's test it. Can PC 1 open up a Web browser
to the first server? Yes, it can. Can it open up a Web browser to the second server?
Looks like it can't.
And as you can see there, the request timed out.
We could also test it this way.
Can it ping
the servers? Notice it can't ping the servers even though
that server 10.1.1.100 is available via the Web browser, so the access list is working as expected.
What about PC 2?
Can it ping either of the servers?
No, it can't.
Can it connect to the second server using HTTPS?
Need to specify the right IP address.
Yes, it can.
So notice, first PC can access the first server using HTTP, second PC can access the second server
using HTTPS, but not using HTTP.
If we look at our access list show access list, we see matches on the various lines..
So at the moment, 65 matches on the first line.
Let's generate some traffic.
Notice that's increased, so that's working well.
Look at the image page using a HTTPS.
It was 66 matches.
Now it's 88 matches.
So that's working.
Well, this is 52 matches.
Ping the servers notice that's increasing, we should be able to access devices on the Internet.
So if I go to Cisco.com that should hopefully work.
It took it a while, but there you go.
There's Cisco.com show access lists.
We see the matches.
What about Facebook.com?
That also works, we see the matches, so as an example, on this PC, can we ping Cisco.com?
Yes, we can.
And we see the matches.
So at this point, we've completed the lab.
We configured the router with an access list.
We found the access list.
On gigabit 0/0/0 inbound and we verified that things work as expected.
I also fix some mistakes that were made in the access list configuration.
Don't just configure, always verify.
How did you do?
Were you able to complete the lab, did you get it working?
The last step before I forget is to save the router configuration, so WR, for the exam, you may have
to use copy running config startup config.
Don't forget to save your configuration when finished.