Write it, then apply it
Two steps. First the list, in global configuration:
access-list 10 deny 192.168.20.0 0.0.0.255access-list 10 permit any
Then apply it to an interface, in one direction: ip access-group 10 out.
Where to put it
A standard ACL only looks at the source. Put it near the destination: if you put it near the source, it would block that source from everything, not just from the one network you wanted to protect.
Here guests must not reach the server LAN, but they can still use everything else. So the ACL goes out of Gi0/2, the server LAN's interface:
In NetLab
▶ R1 R1>enable R1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. R1(config)#access-list 10 remark no guests on the server LAN R1(config)#access-list 10 deny 192.168.20.0 0.0.0.255 R1(config)#access-list 10 permit any R1(config)#interface g0/2 R1(config-if)#ip access-group 10 out R1(config-if)#end *Mar 1 00:00:08.000: %SYS-5-CONFIG_I: Configured from console by console ▶ GUEST student@GUEST:~$ ping -c 2 10.1.1.10 PING 10.1.1.10 (10.1.1.10) 56(84) bytes of data. From 192.168.20.1 icmp_seq=1 Packet filtered --- 10.1.1.10 ping statistics --- 2 packets transmitted, 0 received, 100% packet loss, time 1001ms student@GUEST:~$ ping -c 2 192.168.10.10 PING 192.168.10.10 (192.168.10.10) 56(84) bytes of data. 64 bytes from 192.168.10.10: icmp_seq=2 ttl=127 time=0.640 ms --- 192.168.10.10 ping statistics --- 2 packets transmitted, 1 received, 50% packet loss, time 1001ms rtt min/avg/max/mdev = 0.640/0.640/0.640/0.000 ms ▶ PC1 NetLab Windows-style command prompt. Type help to see the commands. C:\Users\student>ping 10.1.1.10 Pinging 10.1.1.10 with 32 bytes of data: Request timed out. Reply from 10.1.1.10: bytes=32 time<1ms TTL=63 Reply from 10.1.1.10: bytes=32 time<1ms TTL=63 Reply from 10.1.1.10: bytes=32 time<1ms TTL=63 Ping statistics for 10.1.1.10: Packets: Sent = 4, Received = 3, Lost = 1 (25% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms ▶ R1 R1#show access-lists 10 Standard IP access list 10 10 deny 192.168.20.0, wildcard bits 0.0.0.255 (2 matches) 20 permit any (4 matches) R1#show ip interface g0/2 | include access list Outgoing access list is 10 Inbound access list is not set
Common mistake: Forgetting
permit anyat the end. Without it the implicit deny blocks everybody, not only the guests.
Tip: An outbound ACL never filters packets the router sends itself (such as its own pings), only packets it routes from one interface to another.