Fix the ACLs
The design: guests (Gi0/1) may only browse the web server 10.1.1.10 (HTTP); staff (Gi0/0) may use everything, except that only ADMIN may SSH to the servers. Two ACLs were written for it, but users complain:
- "Guests can't browse the web server."
- "PC1 can SSH to the servers."
- "Staff can't reach anything at all."
Find and fix every fault, keeping the two ACLs (GUEST_IN and STAFF_IN).
How it works: this is VulnTech NetLab, a network simulator running in your browser. Click a device in the diagram to open its console and type commands, just like on real equipment (? shows help, Tab finishes a word). Click a cable to inspect it. Tasks tick themselves off as you complete them; questions are answered in the box under each task. Your work is kept if you reload; Reset starts the network over.
Solution explanation
Three faults. GUEST_IN permitted port 443 instead of 80 (www). STAFF_IN's first line permitted SSH from the whole staff LAN, and since the first match wins, the ADMIN-only line and the deny after it never mattered. And STAFF_IN had no permit for anything else, so the implicit deny blocked all other staff traffic: a final permit ip any any fixes that.
Notice that staff still can't ping a guest PC: the echo request gets there, but the reply enters Gi0/1, where GUEST_IN denies it. ACLs filter every packet, replies included.
Show solution
[GUEST]
curl http://10.1.1.10
[R1]
enable
show access-lists
configure terminal
ip access-list extended GUEST_IN
5 permit tcp 192.168.20.0 0.0.0.255 host 10.1.1.10 eq www
no 10
exit
ip access-list extended STAFF_IN
no 10
permit ip any any
end
show access-lists
[GUEST]
curl http://10.1.1.10
[ADMIN]
nc -zv 10.1.1.20 22
[PC1]
curl http://10.1.1.10