CSN205 Lab 5

Lab 5 – Configuring and Verifying Standard IPv4 ACLs (5%) Student Name: Adnan Iqbal ID: 147294201 10 Marks Topology Addressing Table Device Interface IP Address Subnet Mask Default Gateway R1 G0/1 192.168.10.1 255.255.255.0 N/A Lo0 192.168.20.1 255.255.255.0 N/A S0/0/0 (DCE) 10.1.1.1 255.255.255.252 N/A ISP S0/0/0 10.1.1.2 255.255.255.252 N/A S0/0/1 (DCE) 10.2.2.2 255.255.255.252 N/A Lo0 209.165.200.225 255.255.255.224 N/A R3 G0/1 192.168.30.1 255.255.255.0 N/A Lo0 192.168.40.1 255.255.255.0 N/A S0/0/1 10.2.2.1 255.255.255.252 N/A S1 VLAN 1 192.168.10.11 255.255.255.0 192.168.10.1 S3 VLAN 1 192.168.30.11 255.255.255.0 192.168.30.1 PC-A NIC 192.168.10.3 255.255.255.0 192.168.10.1 PC-C NIC 192.168.30.3 255.255.255.0 192.168.30.1 Objectives Part 1: Set Up the Topology and Initialize Devices  Set up equipment to match the network topology.  Initialize and reload the routers and switches. Part 2: Configure Devices and Verify Connectivity  Assign a static IP address to PCs.  Configure basic settings on routers.  Configure basic settings on switches. © 2024 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 1 of 21

Lab – Configuring and Verifying Standard IPv4 ACLs  Configure RIP routing on R1, ISP, and R3.  Verify connectivity between devices. Part 3: Configure and Verify Standard Numbered and Named ACLs  Configure, apply, and verify a numbered standard ACL.  Configure, apply, and verify a named ACL. Part 4: Modify a Standard ACL  Modify and verify a named standard ACL.  Test the ACL. Background / Scenario Network security is an important issue when designing and managing IP networks. The ability to configure proper rules to filter packets, based on established security policies, is a valuable skill. In this lab, you will set up filtering rules for two offices represented by R1 and R3. Management has established some access policies between the LANs located at R1 and R3, which you must implement. The ISP router sitting between R1 and R3 will not have any ACLs placed on it. You would not be allowed any administrative access to an ISP router because you can only control and manage your own equipment. Note : The routers used with CCNA hands-on labs are Cisco 1941 Integrated Services Routers (ISRs) with Cisco IOS Release 15.2(4)M3 (universalk9 image). The switches used are Cisco Catalyst 2960s with Cisco IOS Release 15.0(2) (lanbasek9 image). Other routers, switches, and Cisco IOS versions can be used. Depending on the model and Cisco IOS version, the commands available and output produced might vary from what is shown in the labs. Refer to the Router Interface Summary Table at the end of the lab for the correct interface identifiers. Note : Make sure that the routers and switches have been erased and have no startup configurations. If you are unsure, contact your instructor. Part 1: Set Up the Topology and Initialize Devices In Part 1, you set up the network topology and clear any configurations, if necessary. Part 2: Configure Devices and Verify Connectivity In Part 2, you configure basic settings on the routers, switches, and PCs. Refer to the Topology and Addressing Table for device names and address information. Step 1: Configure IP addresses on PC-A and PC-C. Step 2: Configure basic settings for the routers. a. Console into the router and enter global configuration mode. b. Copy the following basic configuration and paste it to the running-configuration on the router. no ip domain-lookup hostname R1 service password-encryption enable secret class banner motd # Unauthorized access is strictly prohibited. # Line con 0 © 2024 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 2 of 21

Lab – Configuring and Verifying Standard IPv4 ACLs Insert here screen shots of Router 1 and Switch 1 configuration [1 mark] © 2024 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 4 of 21

Lab – Configuring and Verifying Standard IPv4 ACLs © 2024 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 5 of 21

Lab – Configuring and Verifying Standard IPv4 ACLs R1(config-router)# network 192.168.20.0 R1(config-router)# network 10.1.1.0 ISP(config)# router rip ISP(config-router)# version 2 ISP(config-router)# network 209.165.200.224 ISP(config-router)# network 10.1.1.0 ISP(config-router)# network 10.2.2.0 b. After configuring Rip on R1, ISP, and R3, verify that all routers have complete routing tables, listing all networks. Troubleshoot if this is not the case. Show the routing tables here. [1 mark] © 2024 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 7 of 21

Lab – Configuring and Verifying Standard IPv4 ACLs Step 5: Verify connectivity between devices. Note : It is very important to test whether connectivity is working before you configure and apply access lists! You want to ensure that your network is properly functioning before you start to filter traffic. a. From PC-A, ping PC-C and the loopback interface on R3. Were your pings successful? _______ b. From R1, ping PC-C and the loopback interface on R3. Were your pings successful? _______ c. From PC-C, ping PC-A and the loopback interface on R1. Were your pings successful? _______ d. From R3, ping PC-A and the loopback interface on R1. Were your pings successful? _______ © 2024 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 8 of 21

Lab – Configuring and Verifying Standard IPv4 ACLs © 2024 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 10 of 21

Lab – Configuring and Verifying Standard IPv4 ACLs © 2024 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 11 of 21

Lab – Configuring and Verifying Standard IPv4 ACLs What wildcard mask would you use to allow all hosts on the 192.168.10.0/24 network to access the 192.168.30.0/24 network? 0.0.0.255 Following Cisco’s recommended best practices, on which router would you place this ACL? ___R3________ On which interface would you place this ACL? In what direction would you apply it? _______________________G0/1,Outgoing____________________________________________________ ___ a. Configure the ACL on R3. Use 1 for the access list number. R3(config)# access-list 1 remark Allow R1 LANs Access R3(config)# access-list 1 permit 192.168.10.0 0.0.0.255 R3(config)# access-list 1 permit 192.168.20.0 0.0.0.255 R3(config)# access-list 1 deny any b. Apply the ACL to the appropriate interface in the proper direction. R3(config)# interface g0/1 R3(config-if)# ip access-group 1 out c. Verify a numbered ACL. The use of various show commands can aid you in verifying both the syntax and placement of your ACLs in your router. To see access list 1 in its entirety with all ACEs, which command would you use? __Show access-list 1_____________________________________________________________________ What command would you use to see where the access list was applied and in what direction? Show running config_______________________________________________________________________________ _____ 1) On R3, issue the show access-lists 1 command. R3# show access-list 1 Standard IP access list 1 10 permit 192.168.10.0, wildcard bits 0.0.0.255 20 permit 192.168.20.0, wildcard bits 0.0.0.255 30 deny any 2) On R3, issue the show ip interface g0/1 command. Verify that the access list 1 is included Insert here screen shots of the command [1 mark] © 2024 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 13 of 21

Lab – Configuring and Verifying Standard IPv4 ACLs 3) Test the ACL to see if it allows traffic from the 192.168.10.0/24 network access to the 192.168.30.0/24 network. From the PC-A command prompt, ping the PC-C IP address. Were the pings successful? _____Yes__ 4) Test the ACL to see if it allows traffic from the 192.168.20.0/24 network access to the 192.168.30.0/24 network. You must do an extended ping and use the loopback 0 address on R1 as your source. Ping PC-C’s IP address. Were the pings successful? ____Yes___ © 2024 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 14 of 21

Lab – Configuring and Verifying Standard IPv4 ACLs d. From the R1 prompt, ping PC-C’s IP address again. R1# ping 192.168.30.3 Insert here screen shots of successful or unsuccessful ping commands [1 mark] © 2024 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 16 of 21

Lab – Configuring and Verifying Standard IPv4 ACLs Was the ping successful? Why or why not? No, the ping wasn’t successful because only 192.168.10.0/24 and 192.168.20.0/24 networks have access on R3, and we try to ping 10.1.1.1 ip address which does not have any access. Step 2: Configure a named standard ACL. Create a named standard ACL that conforms to the following policy: allow traffic from all hosts on the 192.168.40.0/24 network access to all hosts on the 192.168.10.0/24 network. Also, only allow host PC-C access to the 192.168.10.0/24 network. The name of this access list should be called BRANCH-OFFICE- POLICY. Following Cisco’s recommended best practices, on which router would you place this ACL? _____R1______ On which interface would you place this ACL? In what direction would you apply it? G0/1, outgoing a. Create the standard named ACL BRANCH-OFFICE-POLICY on R1. R1(config)# ip access-list standard BRANCH-OFFICE-POLICY R1(config-std-nacl)# permit host 192.168.30.3 R1(config-std-nacl)# permit 192.168.40.0 0.0.0.255 © 2024 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 17 of 21

Lab – Configuring and Verifying Standard IPv4 ACLs Insert here screen shots of successful or unsuccessful ping commands [1 mark] 4) Test the ACL to ensure that only the PC-C host is allowed access to the 192.168.10.0/24 network. You must do an extended ping and use the G0/1 address on R3 as your source. Ping PC-A’s IP address. Were the pings successful? _____No__ 5) Test the ACL to see if it allows traffic from the 192.168.40.0/24 network access to the 192.168.10.0/24 network. You must perform an extended ping and use the loopback 0 address on R3 as your source. Ping PC-A’s IP address. Were the pings successful? __Yes_____ Part 4: Modify a Standard ACL It is common in business for security policies to change. For this reason, ACLs may need to be modified. In Part 4, you will change one of the previous ACLs you configured to match a new management policy being put in place. Management has decided that users from the 209.165.200.224/27 network should be allowed full access to the 192.168.10.0/24 network. Management also wants ACLs on all of their routers to follow consistent rules. A deny any ACE should be placed at the end of all ACLs. You must modify the BRANCH-OFFICE-POLICY ACL. You will add two additional lines to this ACL. There are two ways you could do this: OPTION 1: Issue a no ip access-list standard BRANCH-OFFICE-POLICY command in global configuration mode. This would effectively take the whole ACL out of the router. Depending upon the router IOS, one of the following scenarios would occur: all filtering of packets would be cancelled and all packets would be allowed through the router; or, because you did not take off the ip access-group command on the G0/1 interface, filtering is still in place. Regardless, when the ACL is gone, you could retype the whole ACL, or cut and paste it in from a text editor. © 2024 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 19 of 21

Lab – Configuring and Verifying Standard IPv4 ACLs OPTION 2: You can modify ACLs in place by adding or deleting specific lines within the ACL itself. This can come in handy, especially with ACLs that have many lines of code. The retyping of the whole ACL or cutting and pasting can easily lead to errors. Modifying specific lines within the ACL is easily accomplished. Note : For this lab, use Option 2. Step 1: Modify a named standard ACL. a. From R1 privileged EXEC mode, issue a show access-lists command. R1# show access-lists Standard IP access list BRANCH-OFFICE-POLICY 10 permit 192.168.30.3 (8 matches) 20 permit 192.168.40.0, wildcard bits 0.0.0.255 (5 matches) b. Add two additional lines at the end of the ACL. From global config mode, modify the ACL, BRANCH- OFFICE-POLICY. R1#(config)# ip access-list standard BRANCH-OFFICE-POLICY R1(config-std-nacl)# 30 permit 209.165.200.224 0.0.0.31 R1(config-std-nacl)# 40 deny any R1(config-std-nacl)# end c. Verify the ACL. 1) On R1, issue the show access-lists command. R1# show access-lists Insert here screen shots of this command [1 mark] © 2024 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 20 of 21