34. Configure Extended ACL
Configuring Extended ACL
Syntax:
conf t
access-list (acl#) permit/deny (source protocol tcp/udp) (source ip/net address) (source wildcard mask) (destination ip/net address) (destination wildcard mask) eq (dest port/application)
Scenario: Do this on R1:L
1. Allow the network 192.168.10.0/24 to telnet R1's IP Address 192.168.10.1/24
answer: access-list 150 permit tcp 192.168.10.0 0.0.0.255 host 192.168.10.1 eq 23
2. Allow the entire network 172.126.16.0/24 to telnet R1's IP address 192.168.10.1/24 except this IP Addresses 172.16.16.16/24 - 172.16.16.31/24.
two ACL rule will be made from this problem. The first one is we are going t5o get the summary of the IP address range 172.16.16.16/24 - 172.16.16.31/24 and create an ACL rule.
answer: access-list 150 deny tcp 172.16.16.16 0.0.0.15 host 192.168.10.1 eq 23
= answer: access-list 150 allow tcp 172.126.16.0 0.0.0.255 host 192.168.10.1 eq 23
3. Allow all networks to acess R1's Mail Server (Use port 25) on IP Adress 192.168.12.1/24.
-answer: access-list 150 permit tcp any host 192.168.12.1 eq 25
4. Allow all networks to access R1's Web Server (use port 80) on IP Address 192.168.13.1/24
-answer: access-list 150 permit tcp any host 192.168.13.1 eq 80
5. Allow these IP Addresses 172.16.17.192/24 - 172.16.17.223/24 to access R1's FTP Server (use port 21)
on IP Address 192.168.14.1/24.
-we need to get first the supernet of the IP range: 172.16.17.192/24 - 172.16.17.223/24 and create the ACL afterwards.
-answer: access-list 150 permit tcp 172.16.17.192 0.0.0.31 host 192.168.14.1 eq 21
6. Do everything while making sure to maintain EIGRP neighbor relationship on all routers...
-answer: access-list 150 permit eigrp any any
7. All all pings from any networks into any of R1's IP Addresses
-answer: access-list 150 permit icmp any any
8. Block telnet from all sources but allow all other protocols
-answer: access-list 150 deny tcp any any eq 23
-answer: access-list 150 permit ip any any
Step 1: Creating the ACL base on the scenario above:
R1:
conf t
access-list 150 permit tcp 192.168.10.0 0.0.0.255 host 192.168.10.1 eq 23
access-list 150 deny tcp 172.16.16.16 0.0.0.15 host 192.168.10.1 eq 23
access-list 150 permit tcp 172.16.16.0 0.0.0.255 host 192.168.10.1 eq 23
access-list 150 permit tcp any host 192.168.12.1 eq 25
access-list 150 permit tcp any host 192.168.13.1 eq 80
access-list 150 permit tcp 172.16.17.192 0.0.0.31 host 192.168.14.1 eq 21
access-list 150 permit eigrp any any
exit
Step 2: We need to apply the ACL inside an interface, for the ACL to take effect.
R1:
conf t
int se 0/1/0
ip access-group 150 in
exit
Step 3: Testing
1. Go to R3
*ping R1: R3#:ping 192.168.10.1
expected result for this is "uuuuuuu"
we got a "......" reply and we have a problem their because a working ACL should have "UUUU" response.
*telnet R1: R3#: telnet 192.168.10.1
expected result for this is "destination unreachable"
we got a conne3ction timeout result bu that should be destination unreachable hence 201.50.60.0/24 network is denied access by R1's ACL in traffic.
The reason of this issue is that EIGRP has been block by ACL. As we have setup this lab before with routing via EIGRP to enable routing on all networks on the 3 routers. To allow EIGRP, create an ACL.So we are going to check now with R3 if the ACL works..
2. Go to R2
*telnet R1
should work since telnet is allowed by R1's ACL on from thois source 192.168.10.0
*PING r1
this should yield "UUUU" result since only telnet allowed on R1's ACL, the rest not declared ports are automatically denied
to allow ping, we can create additional ACL rule on R1 allowing ICMP.
Last task, create an ACL on R1 that will deny telnet from all sources but allow all other protocols....
access-list 150 deny tcp any any eq telnet
access-list 150 permit tcp 192.168.10.0 0.0.0.255 host 192.168.10.1 eq telnet
access-list 150 deny tcp 172.16.16.16 0.0.0.15 host 192.168.10.1 eq telnet
access-list 150 permit tcp any host 192.168.12.1 eq smtp
access-list 150 permit tcp any host 192.168.13.1 eq www
access-list 150 permit tcp 172.16.17.192 0.0.0.31 host 192.168.14.1 eq ftp
access-list 150 permit tcp 172.16.16.0 0.0.0.255 host 192.168.10.1 eq telnet
access-list 150 permit eigrp any any
access-list 150 permit icmp any any
access-list 150 permit ip any any
my telnet from R2 to R1 is now droped due to the first ACL line.
alright... all good with this lab. on to the next video.... :D