Capstone: connect and secure the edge
R1 is the branch's edge router. Beyond R2, the 203.0.113.0/24 side is the "internet" and WEB is a public server; R2 has no route back to the private branch LAN (192.168.1.0/24), just like the real internet. R1 already has a default route to R2. Connect and secure the branch:
- PAT on R1: the whole branch (192.168.1.0/24) shares R1's Gi0/1 address with ACL
1. Gi0/0 inside, Gi0/1 outside. - Port security on SW1's fa0/1 - fa0/3: access mode, sticky, max 1.
- An extended ACL
GUARDinbound on R1's Gi0/1 (from the internet) that denies ICMP from the internet into the branch LAN but still allows the branch's own return traffic (permit ip any anyat the end for this lab).
How it works: this is VulnTech NetLab, a network simulator running in your browser. Click a device in the diagram to open its console and type commands, just like on real equipment (? shows help, Tab finishes a word). Click a cable to inspect it. Tasks tick themselves off as you complete them; questions are answered in the box under each task. Your work is kept if you reload; Reset starts the network over.
Solution explanation
PAT on the branch edge lets the whole LAN share R1's one public outside address; R2 (the internet) never needs a route to the private 192.168.1.0/24. The extended ACL on R1's outside interface blocks the internet from pinging into the branch, while permit ip any any keeps the branch's own NAT return traffic flowing. Port security caps each access port at one learned MAC.
Show solution
[R1]
enable
configure terminal
access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface g0/1 overload
interface g0/0
ip nat inside
exit
interface g0/1
ip nat outside
exit
ip access-list extended GUARD
deny icmp any 192.168.1.0 0.0.0.255
permit ip any any
exit
interface g0/1
ip access-group GUARD in
end
[SW1]
enable
configure terminal
interface range fa0/1 - 3
switchport mode access
switchport port-security
switchport port-security mac-address sticky
end
[PC1]
curl http://203.0.113.10