Exercise Access Control List

Exercise

Following network is given

• Each device from the network 192.168.1.0/24 should have access to the two computer in the network 192.168.3.0/24
• Each device from the network 192.168.2.0/24 should have access to every computer in the network 192.168.3.0/24

Jedes Gerät aus dem Netzwerk 192.168.2.0/24 soll auf die beiden Computer in Netzwerk 192.168.3.0/24 zugreifen können except device 192.168.2.2.

• From the network 192.168.5.0/24 have only the device 192.168.5.1/24 access to the two PCs in the network 192.168.3.0/24.

Aus Netzwerk 192.168.5.0/24 soll nur Gerät 192.168.5.1 auf die beiden PCs in Netzwerk 192.168.3.0/24 zugreifen können.

• Convert the standard access list in an extended access list.
• Adding the expanded access list so that all the above access rights but access to PC1 generally prohibited.

---

Solution:

• Each device from the network 192.168.1.0/24 should have access to the two computer in the network 192.168.3.0/24

access-list 1 permit 192.168.1.0 0.0.0.255

• Each device from the network 192.168.2.0/24 should have access to every computer in the network 192.168.3.0/24

access-list 1 deny 192.168.2.2 access-list 1 permit 192.168.2.0 0.0.0.255

• From the network 192.168.5.0/24 have only the device 192.168.5.1/24 access to the two PCs in the network 192.168.3.0/24.

access-list 1 permit 192.168.5.1 access-list 1 deny 192.168.5.0 0.0.0.255 -> By default, when ACL always all IP addresses blocked, about this line is superfluous (default: access-list 1 deny 0.0.0.0 255.255.255.255)

Router(config)#int fa1/0

Router(config-if)#ip access-group 1 OUT

• Convert the standard access list in an extended access list.

access-list 101 permit ip 192.168.1.0 0.0.0.255 0.0.0.0 255.255.255.255

access-list 101 permit ip host 192.168.5.1 0.0.0.0 255.255.255.255

access-list 101 deny ip 192.168.5.0 0.0.0.255 0.0.0.0 255.255.255.255

access-list 101 deny ip host 192.168.2.2 0.0.0.0 255.255.255.255

access-list 101 permit ip 192.168.2.0 0.0.0.255 0.0.0.0 255.255.255.255

Instead of the syntax '0 .0.0.0 255,255,255,255 "can also be used any To no distinction between the protocols to make " 'IP'". IP stands for "any Protocolls"

• Adding the expanded access list so that all the above access rights but access to PC1 generally prohibited.

access-list 101 deny any hosts 192.168.3.102

access-list 101 permit ip 192.168.1.0 0.0.0.255 any

access-list 101 permit ip host 192.168.5.1 any

access-list 101 deny ip 192.168.5.0 0.0.0.255 any

access-list 101 deny ip host 192.168.2.2 any

access-list 101 permit ip 192.168.2.2 0.0.0.255 any

Router(config)# int fa 1/0

Router(config-if)#ip access-group 101 out