Courseiva
CCNA lab 13

Extended ACL: allow only web and DNS to a server

Write a named extended ACL that lets the LAN reach a server only on HTTP and DNS, keeps the rest of the network open, and is placed close to the source.

About 30 minutes 6 devices 4 tasksAdvanced

Scenario

SRV (10.0.2.10) runs web, DNS, FTP and SSH. Policy: hosts on the 192.168.1.0/24 LAN may use only HTTP (TCP 80) and DNS (UDP 53) on SRV. Every other kind of traffic to SRV from the LAN is dropped, but the LAN must still reach everything else, such as the internet host 8.8.8.8. Write the ACL on R1 and apply it close to the source. Test with `telnet 10.0.2.10 80`, `nslookup www.courseiva.lab` and `ping` from the PCs.

eth0Fa0/1eth0Fa0/2Gi0/1Gi0/0Gi0/1Gi0/0Gi0/1eth0PC1PC1 — PCPC2PC2 — PCSW1SW1 — Switch (Catalyst 2960-24)R1R1 — Router (2911)R2R2 — Router (2911)SRVSRV — Server

Your tasks

  1. From the LAN, HTTP and DNS to SRV still work but FTP (TCP 21) is blocked.
  2. HTTPS (TCP 443) from PC2 to SRV is blocked too, while PC2's web traffic (TCP 80) still works.
  3. Pings to SRV are dropped, but the LAN can still ping 8.8.8.8.
  4. The ACL is applied inbound on R1 Gi0/0, close to the source.

The lab checks the result, not the exact commands. For example, a ping task passes only when the ping really succeeds through the network you built.

Start the lab