ACL Help please

Oh man! Ad-blocking software has been detected! :'(

This website is run by the community, for the community... and it needs advertisements in order to keep running. Blocking our ads means your killing our stats!
Please disable your ad-block, or become a premium member to hide all advertisements and this notice.

Right im working on an assignment that involves working with ACLs and im struggling a little. Im using packet tracer and have the following topology:




Now the conditions of the ACL are as follows:

Admin can send data to students
Students must not have access to Admin
Students can send packets
Students can send data to PC3 and PC2 (you will see the IP's in the ACL)

Now my show access-list gives me:

Code:

Router#show access-lists 
Standard IP access list 1
    permit 192.160.2.0 0.0.0.255
Extended IP access list 102
    permit ip any host 192.168.2.3
    permit ip any host 192.168.2.4
Standard IP access list 2
    deny 192.168.1.0 0.0.0.255

Students : 192.168.1.0 255.255.255.0
Admin: 192.168.2.0 255.255.255.0

Now i know the order is important but thats not the problem - i can still ping from the student pc to the admin ones! What am i doing wrong?

 

Oh man! Ad-blocking software has been detected! :'(

This website is run by the community, for the community... and it needs advertisements in order to keep running. Blocking our ads means your killing our stats!
Please disable your ad-block, or become a premium member to hide all advertisements and this notice.

Hello mate.
I am also a bit new to this ACL thing as I am still currently doing my CCNA course but I believe that if you want to allow packets to go to admin and yet block access to data to admin from students you would have to creat a extended ACL. Remeber that packets use UDP so allow udp access to admin and block all other trafic.
Hope it helps and surelly you'll have better answers as this forum is one of the best out there if not the best.
Good luck
Albert, C

 

Extended IP access list 102
permit ip any host 192.168.2.3
permit ip any host 192.168.2.4

there is the extended list.. is that what you meant? Also why use UDP? I thought IP covers all the below protocols that's why i specified it.

 

there is the extended list.. is that what you meant? Also why use UDP? I thought IP covers all the below protocols that's why i specified it.
******************************************************************************
Sorry mate didn't see it there.

Yes that would be what I meant.

Why use UDP? You want to block students from accessing the admin and yet you want them to be able to send packets right? By this what do you really mean? Do you want them to be able to ping/telnet or send reall data? What kind of packets? IP, UDP, TCP?

Yes IP does cover the whole range when applyd in a standard ACL.

Also remember that standard access control list do not specify destination addresses, so they should be placed as close to the destination as possible and extended access control list are placed near the trafic you want to block if memory serves me right so be aware of inbound and outbond trafic and which interface in the router to apply the ACL.
ACLs must be defined on a per-protocol basis, so you must provide an ACL for every protocol enabled on an interface.

Hope it helps.
Albert, C

 

No traffic from students must cross to admin only requests to the servers on those IP addresses. So which parts are wrong? can u highlight them please?

 

:hhhmmm ACL was covered in my N+ study book!

don't you have to setup the permissions?

not sure if it's a good idea to type out what the book says.. so I have found a link instead..hope this helps..

ACL

 

Thats for software based permissions - im talking about ACL on Cisco routers mate!

 

Great, you've got access lists...

...but have you applied one of those access lists to an interface? You can apply one outgoing and one incoming to each interface.

 

hmm i thought something didnt quite make sense! Err how do i apply it to an interface? i really hope packet tracer allows me to do this!

 

Dunno, mate... I just use the old trusty IOS.

 

well thats what im using lets say i wanted to apply the first ACL to fa0/0?

 

Sorry - never used Packet Tracer before... didn't know if it worked like the IOS.

config t
int fa0/0
access-group 1 out (if you want to apply it to outbound traffic on that interface - if you want to apply it to inbound traffic, do access-group 1 in)

 

access-list 101 permit ip 192.168.1.0 0.0.0.255 host 192.168.2.3 (server1 IP?)
access-list 101 permit ip 192.168.1.0 0.0.0.255 host 192.168.2.4 (server2 IP?)
access-list 101 deny ip any any (to deny any other traffic)

The 192.168.1.0 0.0.0.255 is a wilcard that tells the ACLs to block all valid IPs in the
192.168.1.0 network which are 254.

After this you just go to the interface you want to apply it and apply it

int f0/0 (example)
ip access-group 101 in (or) out

I would apply this extended ACL to the interface where the students network connect to the router so therefore blocking incoming trafic hence (IN) on the ip access-group 101 IN

Hope it helps,
Albert, C

 

ZIMBO

Here it is a packet tracer file with what you where trying to do.
Now I only ask of you to do yourself a favor mate, do not copy the runconfig file for your benefit or just oiut of laysiness (I am not saying you are laisy) but insted try to understand how it all works as it will be better for you in the long run.
This was my best subject at college but still can be a bit challanging.
It is a matter of logic I'd say.
Hope it helps you rather then do you harm, so please try to understand how it all works.
Take care,
Albert, C

 

Thanks for the help everyone! Albert no need to worry cause i think the final topology will different as its also a design question - and i still need to allow Admin to have full access to the student side so i still got work to do!! Would i need another router to achieve that?

 

No you would not need another router mate.
It can all be done using just the one you have in your pic and with the use of a simple standard ACL.
Glad to be able to help just like others have helped me as well.

Best of luck and please feel free to lay down any questions or doubts you may have.

Albert
C

 

Yes but i would need to use the other interface right? you cant apply more than one access list group to an interface correct?

Another question if fa0/0 blocks all other traffic and fa0/1 will allow the traffic - im guessing there needs to be a change to:

Code:

access-list 101 deny ip any any 

to become

Code:

access-list 101 deny 192.168.1.0 0.0.0.255

 

Just a quick note, at the end of every access list the is an inplicit deny all, so you dont really need the last line

 

It can all be done in the same access list by adding more lines to it.
Remember to place them in order.

 

such as the one above? or and extended ACL?