Edit a named ACL
R1 already has the GUEST_IN ACL on Gi0/1 (guests may only browse the web server). Two change requests came in:
- Guests may now ping the web server 10.1.1.10. Insert the line so that it comes before the final deny, without retyping the ACL.
- HTTPS (TCP 443) for guests is no longer needed: remove just that line.
How it works: this is VulnTech NetLab, a network simulator running in your browser. Click a device in the diagram to open its console and type commands, just like on real equipment (? shows help, Tab finishes a word). Click a cable to inspect it. Tasks tick themselves off as you complete them; questions are answered in the box under each task. Your work is kept if you reload; Reset starts the network over.
Solution explanation
The lines were 10 (HTTP), 20 (HTTPS) and 30 (deny). Sequence number 25 slots the new line in before the deny, and no 20 removes the HTTPS line alone. Had you added the ping line without a number, it would have become line 40, after the deny, and never matched.
Show solution
[R1]
enable
show access-lists GUEST_IN
configure terminal
ip access-list extended GUEST_IN
25 permit icmp 192.168.20.0 0.0.0.255 host 10.1.1.10 echo
no 20
end
show access-lists GUEST_IN
[GUEST]
ping -c 2 10.1.1.10
curl http://10.1.1.10