Keep the guests away from the servers
Guests (192.168.20.0/24) must not reach the server LAN (10.1.1.0/24), but they must still reach everything else, and the staff LAN must keep working. Use a standard numbered ACL, number 20, placed where a standard ACL belongs.
How it works: this is VulnTech NetLab, a network simulator running in your browser. Click a device in the diagram to open its console and type commands, just like on real equipment (? shows help, Tab finishes a word). Click a cable to inspect it. Tasks tick themselves off as you complete them; questions are answered in the box under each task. Your work is kept if you reload; Reset starts the network over.
Solution explanation
A standard ACL only checks the source, so it goes near the destination: out of Gi0/2, towards the servers. On Gi0/1 in, it would have cut the guests off from the staff LAN too. The permit any line matters: without it, the implicit deny would block the staff as well.
Show solution
[R1]
enable
configure terminal
access-list 20 deny 192.168.20.0 0.0.0.255
access-list 20 permit any
interface g0/2
ip access-group 20 out
end
show access-lists 20
[GUEST]
ping -c 2 10.1.1.10
ping -c 2 192.168.10.10
[PC1]
curl http://10.1.1.10