An extended ACL for the server LAN
Write a named extended ACL STAFF_IN and apply it in on the staff interface (Gi0/0). It must allow exactly this from the staff LAN:
- web (TCP 80 and 443) to the WEB server 10.1.1.10;
- SSH (TCP 22) to both servers, but only from ADMIN (192.168.10.50);
- ping (ICMP echo) to anywhere.
Everything else from the staff LAN is blocked.
How it works: this is VulnTech NetLab, a network simulator running in your browser. Click a device in the diagram to open its console and type commands, just like on real equipment (? shows help, Tab finishes a word). Click a cable to inspect it. Tasks tick themselves off as you complete them; questions are answered in the box under each task. Your work is kept if you reload; Reset starts the network over.
Solution explanation
The implicit deny does the blocking, so the ACL only needs the permits. One line covers SSH to both servers with the wildcard 0.0.0.255. Ping replies coming back from the servers aren't affected: the ACL is inbound on the staff interface, so it only sees packets from the staff LAN. An extended ACL belongs close to the source, which here is the staff interface.
Show solution
[R1]
enable
configure terminal
ip access-list extended STAFF_IN
permit tcp 192.168.10.0 0.0.0.255 host 10.1.1.10 eq www
permit tcp 192.168.10.0 0.0.0.255 host 10.1.1.10 eq 443
permit tcp host 192.168.10.50 10.1.1.0 0.0.0.255 eq 22
permit icmp 192.168.10.0 0.0.0.255 any echo
exit
interface g0/0
ip access-group STAFF_IN in
end
[ADMIN]
nc -zv 10.1.1.20 22
nc -zv 10.1.1.20 21
[PC1]
curl http://10.1.1.10
ping 10.1.1.20
[R1]
show access-lists STAFF_IN