Reference no: EM133212701

Access Control Lists (ACL) in Packet Tracer

Objectives of this Lab:

The goal of this lab is to become familiar with the configuration of Access Control Lists (ACLs) in Packet Tracer.

Access Control Lists (ACLs):

In order to filter network traffic, ACLs control whether routed packets are forwarded or blocked at the router interface. Your router examines each packet in order to determine whether to forward or drop the packet based on the criteria that you specify within the ACL.

ACL criteria include:
• Source address of the traffic
• Destination address of the traffic
• Upper-layer protocol

Complete these steps in order to construct an ACL as the examples in this document show:
1. Create an ACL.
2. Apply the ACL to an interface.

The IP ACL is a sequential collection of permit and deny conditions that apply to an IP packet. The router tests packets against the conditions in the ACL one at a time.
The first match determines whether the Cisco IOS Software accepts or rejects the packet.

Types of ACL:
There are two main different types of Access-list namely:

1. Standard Access-list - These are the Access-list which are made using the source IP address only. These ACLs permit or deny the entire protocol suite. They don't distinguish between the IP traffic such as TCP, UDP, HTTPs etc. By using numbers 1-99 or 1300- 1999, router will understand it as a standard ACL and the specified address as source IP address.

2. Extended Access-list - These are the ACL which uses both source and destination IP address. In this type of ACL, we can also mention which IP traffic (for example TCP/UDP etc) should be allowed or denied. These use range 100-199 and 2000-2699.

Advantages of ACL:

• Improve network performance.

• Provides security as administrator can configure the access list according to the needs and deny the unwanted packets from entering the network.

• Provides control over the traffic as it can permit or deny according to the need of network.

Important ACL configuration commands:

1. access-list command

A standard ACL provides the ability to match traffic based on the source address of the traffic only. This is, of course, rather limiting, but in many situations is all that is required. The command syntax of a standard ACL is as follows:

router(config)#access-list access-list-number {permit | deny} {source[source-wildcard]
| host hostname | any}

2. ip access-group command

To apply an IPv4 access control list (ACL) to a Layer 3 interface as a router ACL, we use the ip access-group command. To remove an IPv4 ACL from an interface, we use the no form of this command.
ip access-group access-list-number {in | out}
no ip access-group access-list-number {in | out}

Create the network topology below in Packet Tracer and follow the steps below to configure the static routes for the remote networks.

1. Assign the IP addresses (provided in the topology diagram) to all the end hosts with the subnet mask of 255.255.255.0. Also configure the default gateways accordingly.

2. Configure the IP addresses on router interfaces Following are the commands to configure the Student_Router1

Student_Router1(config)#int Gig0/0

Student_Router1(config-if)#ip address 192.168.1.1 255.255.255.0 Student_Router1(config-if)#no shutdown
Student_Router1(config-if)#exit Student_Router1(config)#int Gig0/1
Student_Router1(config-if)#ip address 192.168.10.1 255.255.255.0
Student_Router1(config-if)#no shutdown

Student_Router1(config-if)#exit

Following are the commands to configure the Student_Router2

Student_Router2(config)#int Gig0/0

Student_Router2(config-if)#ip address 192.168.10.2 255.255.255.0 Student_Router2(config-if)#no shutdown
Student_Router2(config-if)#exit Student_Router2(config)#int Gig0/1
Student_Router2(config-if)#ip address 192.168.20.1 255.255.255.0 Student_Router2(config-if)#no shutdown
Student_Router2(config-if)#exit

Now, we will configure the routers with the static routing command

3. Configure a Static Route Using a Next-Hop Address.

Following are the commands to configure the static routes on Student_Router1.

Student_Router1>enable Student_Router1#config terminal
Student_Router1(config)#ip route 192.168.20.0 255.255.255.0 192.168.10.2

Following are the commands to configure the static routes on Student_Router2.
Student_Router2>enable Student_Router2#config terminal
Student_Router2(config)#ip route 192.168.1.0 255.255.255.0 192.168.10.1

4. Configure the standard access list
Student_Router1(config)#access-list 1 deny 192.168.20.4 0.0.0.0

Student_Router1(config)#access-list 1 permit any

In the wildcard entry, we use the "0.0.0.0" address because we only wanted to block that particular host. This will deny any communication from the source IP address of "192.168.20.4". In the next command, parameter "any" permits the communication for all the other hosts.

5. Apply the standard access list to the interface.
Student_Router1(config)#int gig0/0
Student_Router1(config-if)#ip access-group 1 out Student_Router1(config-if)#exit

In the command, we specify "out" which corresponds to the outbound traffic (any traffic going out of the interface).

This will apply the access list to the interface giga ethernet 0/0. Now, "192.168.20.4" will not be able to send traffic to the "Student_Router1" interface gig 0/0 (to the corresponding network "192.168.1.0" i.e neither to 192.168.1.2 nor to 192.168.1.3).

6. See the configured access list of the router.

"show access-lists" is the command to see the configured access list of the router.

7. To add a new host to deny communication in existing ACL.

If we want to add a new host AdminPC2 with IP address "192.168.20.3", we have to do the following configuration. First, we have to delete the command permit any with the following command.

Answer the following Questions.

Question 1: Write the exact commands to configure access-list to deny communication from host 192.168.20.3 on Student_Router1. Set the enable password as your first name and show the running configuration of the router. (Snapshot/s Required)

Question 2: (Change the Student_Router1 hostname as your first name_Router1). With "show access-lists", show the output of the given command on Student_Router1. What is the use of this command? (Snapshot/s Required)

Question 3: How will you ensure that AttackerPC1 is unable to access StudentPC1? (Snapshot/s Required)

Question 4: How will you ensure that StudentPC2 is still able to access StudentPC1? (Snapshot/s Required)

Attachment:- Packet Tracer.rar