Answers

Figure 1: Topology Used in Extended ACL Lab

interface GigabitEthernet0/2.3
 ip access-group ThisACL in
!
ip access-list extended ThisACL
 permit tcp host 10.0.3.100 eq telnet 20.0.2.0 0.0.0.255
 permit tcp host 10.0.3.100 eq 22 20.0.2.0 0.0.0.255
 permit udp host 10.0.3.100 eq snmp 20.0.2.0 0.0.0.255
 deny   tcp 10.0.3.0 0.0.0.255 eq telnet 20.0.2.0 0.0.0.255
 deny   tcp 10.0.3.0 0.0.0.255 eq 22 20.0.2.0 0.0.0.255
 deny   udp 10.0.3.0 0.0.0.255 eq snmp 20.0.2.0 0.0.0.255
 permit ip any any

Example 1: R1 Config

Commentary

The primary use of access-lists is to control which traffic is allowed to come in and go out of the interfaces of a device. On Cisco devices, you can use either standard or extended ACLs. Standard ACLs use simple matching logic based solely on the source IP address of the packet. Extended ACLs use more complex matching based on multiple header fields, including the source and destination host or network, and matching based on the protocol in use. However, it is important to note that ACLs are not limited to the blocking or permitting of specific traffic. They are also used in several features, from Network Address Translation (NAT) to route maps.

With this lab, you were tasked with configuring an extended named ACL that would be used to block specific traffic. In particular, the two requirements ask that you match packets coming from servers, which means that the source TCP or UDP port in those packets will be used to match the well-known ports used by those servers. The first requirement asked you to match packets from a specific server, while the second requirement asked that you match packets coming from an entire subnet.

For that first requirement, you needed to match the specific server address (10.0.3.100) with the host 10.0.3.100 parameters and the destination subnet with the 20.0.2.0 0.0.0.255 parameters. Beyond that, for three consecutive commands, the ACL needed a separate statement to match each service noted in the requirements, for the well-known port used by Telnet (23), SSH (22), and SNMP (161), and for the correct transport protocols (see example 1).

The logic works the same for the second requirement, except that the source field in each case matches the source subnet with the 10.0.3.0 0.0.0.255 parameters.

The last step is to apply the ACL to the appropriate interface. Generally, Cisco suggests applying standard ACLs to the interface closest to the destination and applying extended ACLs to the interface closest to the source. In this case, you are configuring an extended ACL, so you are looking for the closest interface to the source. Because R1 is configured with a Router-on-a-Stick (ROAS) configuration, the closest interface would be a sub-interface, not a physical interface. The source network is 10.0.3.0/24, which is located off R1’s G0/2.3 sub-interface, so the answer applies the ACL inbound on this interface using the ip access-group ThisACL in command.

Finally, note that this lab glossed over one SNMP issue. As worded, the lab exercise requirements mentioned Telnet, SSH, and SNMP server. As it turns out, SNMP does not often use client and server terms. However, the device using well-known UDP port 161, which is matched by an IOS ACL with the snmp keyword, is the SNMP agent running on the networking device. So, in the literal sense, the ACL listed here is correct. However, many people incorrectly think of the Network Management Station as the server; if that was your intent, note that the NMS would not send packets with source UDP port 161, but rather with destination UDP port 161 when communicating to SNMP agents throughout the network.

Known Issues in this Lab

This section of each Config Lab Answers post hopes to help with those issues by listing any known issues with Packet Tracer related to this lab. In this case, the issues are:

Why Would Cisco Packet Tracer Have Issues?

(Note: The below text is the same in every Config Lab.)

Cisco Packet Tracer (CPT) simulates Cisco routers and switches. However, CPT does not run the same software that runs in real Cisco routers and switches. Instead, developers wrote CPT to predict the output a real router or switch would display given the same topology and configuration – but without performing all the same tasks, an actual device has to do. On a positive note, CPT requires far less CPU and RAM than a lab full of devices so that you can run CPT on your computer as an app. In addition, simulators like CPT help you learn about the Cisco router/switch user interface – the Command Line Interface (CLI) – without owning real devices.

CPT can have issues compared to real devices because CPT does not run the same software as Cisco devices. CPT does not support all commands or parameters of a command. CPT may supply output from a command that differs in some ways from what an actual device would give. Those differences can be a problem for anyone learning networking technology because you may not have experience with that technology on real gear – so you may not notice the differences. So this section lists differences and issues that we have seen when using CPT to do this lab.

Beyond comparing your answers to this lab’s Answers post, you can test in Cisco Packet Tracer (CPT) or Cisco Modeling Labs (CML). In fact, you can and should explore the lab once configured. For this lab, once you have completed the configuration, try these verification steps:

1. Issue the show ip access-lists and show access-lists commands to display the access-lists.
2. Issue the show ip interfaces commands and look for the lines on each interface that identify if any ACLs are enabled, and if so, which ACLs and in what direction.
3. Add some hosts to the topology and use some ping and traceroute commands to generate traffic and test the ACLs. Because all the requirements mention IP packets only and not specific applications, you can use any command to drive traffic to test the ACL.