Courseiva
CCNA lab 12

Standard ACLs: filter a host and secure VTY access

Block one host from a server LAN with a standard ACL placed near the destination, and allow only the HR subnet to telnet to the router.

About 25 minutes 7 devices 3 tasksIntermediate

Scenario

PC2 (192.168.10.11) in Sales must no longer reach the server LAN 10.0.2.0/24 behind R2. Every other host keeps full access, and PC2 must still reach the HR LAN. A standard ACL only matches the source address, so where you apply it matters. Then lock down R2's VTY lines (password cisco is already set) so only HR (192.168.20.0/24) can telnet to R2.

eth0Fa0/1eth0Fa0/2Gi0/1Gi0/0Gi0/1eth0Gi0/2Gi0/0Gi0/1eth0PC1PC1 — PCPC2PC2 — PCSW1SW1 — Switch (Catalyst 2960-24)R1R1 — Router (2911)PC3PC3 — PCR2R2 — Router (2911)SRVSRV — Server

Your tasks

  1. PC2 can no longer reach SRV, while PC1 and PC3 still can.
  2. PC2 can still reach the HR LAN (PC3): the standard ACL sits close to the destination.
  3. Only the HR subnet can telnet to R2: PC3 connects, PC1 is refused.

The lab checks the result, not the exact commands. For example, a ping task passes only when the ping really succeeds through the network you built.

Start the lab