CCNA Access List Sim 2
Question
A network associate is adding security to the configuration of the Corp1 router. The user on host C should be able to use a web browser to access financial information from the Finance Web Server. No other hosts from the LAN nor the Core should be able to use a web browser to access this server. Since there are multiple resources for the corporation at this location including other resources on the Finance Web Server, all other traffic should be allowed.
The task is to create and apply a numbered access-list with no more than three statements that will allow ONLY host C web access to the Finance Web Server. No other hosts will have web access to the Finance Web Server. All other traffic is permitted.
Access to the router CLI can be gained by clicking on the appropriate host.
All passwords have been temporarily set to “cisco”.
The Core connection uses an IP address of 198.18.196.65
The computers in the Hosts LAN have been assigned addresses of 192.168.33.1 – 192.168.33.254
Host A 192.168.33.1
Host B 192.168.33.2
Host C 192.168.33.3
Host D 192.168.33.4
The servers in the Server LAN have been assigned addresses of 172.22.242.17 – 172.22.242.30
The Finance Web Server is assigned an IP address of 172.22.242.23.
The Public Web Server is assigned an IP address of 172.22.242.17
Answer and Explanation
(Note: If you are not sure how to use access-list, please check out my access-list tutorial at: http://www.9tut.com/access-list-tutorial, also some modifications about the access-list have been reported so you should read the “Some modifications” section at the end of this question to understand more. You can also download this sim to practice (open with Packet Tracer) here: http://www.9tut.com/download/9tut.com_Access-list_sim2.pkt
Corp1>enable (you may enter “cisco” as it passwords here)
We should create an access-list and apply it to the interface which is connected to the Server LAN because it can filter out traffic from both Sw-2 and Core networks. The Server LAN network has been assigned addresses of 172.22.242.17 – 172.22.242.30 so we can guess the interface connected to them has an IP address of 172.22.242.30 (.30 is the number shown in the figure). Use the “show running-config” command to check which interface has the IP address of 172.22.242.30.
Corp1#show running-config
We learn that interface FastEthernet0/1 is the interface connected to Server LAN network. It is the interface we will apply our access-list (for outbound direction).
Corp1#configure terminal
Our access-list needs to allow host C – 192.168.33.3 to the Finance Web Server 172.22.242.23 via web (port 80)
Corp1(config)#access-list 100 permit tcp host 192.168.33.3 host 172.22.242.23 eq 80
Deny other hosts access to the Finance Web Server via web
Corp1(config)#access-list 100 deny tcp any host 172.22.242.23 eq 80
All other traffic is permitted
Corp1(config)#access-list 100 permit ip any any
Apply this access-list to Fa0/1 interface (outbound direction)
Corp1(config)#interface fa0/1
Corp1(config-if)#ip access-group 100 out
Notice: We have to apply the access-list to Fa0/1 interface (not Fa0/0 interface) so that the access-list can filter traffic coming from both the LAN and the Core networks. If we apply access list to the inbound interface we can only filter traffic from the LAN network.
In the real exam, just click on host C and open its web browser. In the address box type http://172.22.242.23 to check if you are allowed to access Finance Web Server or not. If your configuration is correct then you can access it.
Click on other hosts (A, B and D) and check to make sure you can’t access Finance Web Server from these hosts.
Finally, save the configuration
Corp1(config-if)#end
Corp1#copy running-config startup-config
(This configuration only prevents hosts from accessing Finance Web Server via web but if this server supports other traffic – like FTP, SMTP… then other hosts can access it, too.)
Notice: In the real exam, you might be asked to allow other host (A, B or D) to access the Finance Web Server so please read the requirement carefully.
Some modifications:
Modification 1:
| permit host B from accessing finance server | access-list 100 permit ip host 192.168.33.2 host 172.22.242.23 |
| deny host B from accessing other servers (not the whole network) | access-list 100 deny ip host 192.168.33.2 172.22.242.16 0.0.0.15 |
| permit everything else | access-list 100 permit ip any any |
Modification 2:
| Only allow Host C to to access the financial server | access-list 100 permit ip host 192.168.33.3 host 172.22.242.23 |
| Not allow anyone else in any way communicate with the financial server | access-list 100 deny ip any host 172.22.242.23 |
| Allow all other traffic | access-list 100 permit ip any any |
Modification 3:
| - Host C should be able to use a web browser(HTTP)to access the Finance Web Server | access-list 100 permit tcp host 192.168.33.3 host 172.22.242.23 eq 80 |
| - Other types of access from host C to the Finance Web Server should be blocked - All access from hosts in the Core or local LAN to the Finance Web Server should be blocked |
access-list 100 deny ip any host 172.22.242.23 (because the requirement says we can not use more than 3 statements so we have to use “any” here for the hosts in the Core and hosts in local LAN) |
| - All hosts in the Core and local LAN should be able to access the Public Web Server * | access-list 100 permit ip any host (If the question asks this, surely it has to give you the IP of Public Web Server) but in the exam you should use “access-list 100 permit ip any any” |
Modification 4:
| Host C should be able to use a web browser to access the financial web server | access-list 100 permit tcp host 192.168.33.3 host 172.22.242.23 eq 80 |
| Other types of access from host C to the finance web server should be blocked | access-list 100 deny ip host 192.168.33.3 host 172.22.242.23 |
| All hosts in the core and on the local LAN should be able to access the Public web server * | access-list 100 permit ip any host (The IP of Public Web Server will surely be given in this question) but in the exam you should use “access-list 100 permit ip any any” |
* There are some reports about the command of “All hosts in the core and on the local LAN should be able to access the Public web server” saying that the correct command should be “access-list 100 permit ip any any”, not “access-list 100 permit ip any host (IP of Public Web Server)”. Although I believe the second command is better but maybe you should use the first command “access-list 100 permit ip any any” instead as some reports said they got 100% when using this command (even if the question gives you the IP address of Public Web Server). It is a bug in this sim.
(Note: Don’t forget to apply this access list to the suitable interface or you will lose points
interface fa0/1
ip access-group 100 out
And in the exam, they may slightly change the requirements, for example host A, host B instead of host C… so make sure you read the requirement carefully and use the access-list correctly)
I created this sim in Packet Tracer v5.2.1 so you can practice with it. You will need new version of Packet Tracer to open it (v5.1+).
Download this sim here
Notice: After typing the commands above, if you make a “ping” from other hosts (PC0, PC1, PC3) then PC4 (Finance Web Server) can still reply because we just filter HTTP traffic, not ICMP traffic. To generate HTTP traffic, select “Web Browser” in the “Desktop” tab of these PCs. When a web browser opens, type the IP address of Finance Web Server and you can see how traffic flows in Simulation Mode.
And notice that in the initial configuration of this sim the Core network can ping Finance Web Server. We have to create an access-list that can filter this traffic too.
Other lab-sims on this site:
At the end of the SIM when I type copy running-config startup-config I am asked where do I want to copy the configuration to. What to I type?
please can somebody help me with the latest access-list sim
Finally I passed the CCNA exam with 947/1000.
The Lab was VTP, EIGRP and ACL2. Same like 9tut.
Acl2 Host C 192.168.178.3
Finance Web Server 201.22.0.17
Public Web Server 201.22.0.20
***Reasons of lose my points, Because of skipped two or three questions by Mouse clicking.
Many many thanks 9tut.
I failed my CCNA exam , 788/1000 messed up with the ACL2 Lab sim..most painful thing ever, discount voucher gone..
Thanks you ! Anonymous give for me suggest of you. I hope I can have exam same you .
i am not understand this question please help me
hi can somebody email (kndou@sataxi.co.za) me the correct Lap sims pls. thanks in advance
Passed CCNA today with 973/1000. Thank you 9tut very much! Labs are EIGRP, ACL 2, VTP with little differences.
ACL2
1.
2.
3. Allow all hosts to the Public Web Server (access-list 100 permit ip any host 172.22.162.18)
I also lose points with “access-list 100 permit ip any host 172.22.162.18″ Probably “access-list 100 permit ip any any” should be used, as you noted.
How can we test the result of our config in real exam?
Does this command works there from PC3 for example?
ping 172..22.242.23:80 ==> ok
and also from PC4 ===>
to check if we have configured correctly or not?
I passed my ccna exam with 841/1000. Acl, vtp and eigrp simulations on 9tut website are still valid. I didnt do well in the vtp section but I still scaled thru, anyway. Thanks 9tut, you are simply the best.
Why my ACL lab was wrong… please explain to me??????I did as 9tut ……help me it drive mw e mad!!!!!!!!!!!
to all ccna candidates and people who had passed:
How can we test our ACL in real test center?
I mean to see if we have configured , correctly?
Does “ping 172.22.242.23:80″ works On every PCs or not?
regarding modifications
access-list 100 permit ip host 192.168.33.2 host 172.22.242.23
access-list 100 deny ip host 192.168.33.2 172.22.242.16 0.0.0.15
permit ip any any
this access-list should be applied to fa0/0 (the .254 interface) inside.
although applying to fa1/0 will work in this case since all the servers are on the fa1/0 (the .30 interface).. especially when you mention …deny host B from accessing other servers (not the whole network) .. if possible the extended access-list should be closer to the source .. and in this case since we are only concerned with host B. the list should be on interface fa1/0
I pass CCNA 7/3/2013 , Question is random , no arrge. Lab is
- Host C should be able to use a web browser(HTTP)to access the Finance Web Server access-list 100 permit tcp host 192.168.33.3 host 172.22.242.23 eq 80
- Other types of access from host C to the Finance Web Server should be blocked
– All access from hosts in the Core or local LAN to the Finance Web Server should be blocked access-list 100 deny ip any host 172.22.242.23
(because the requirement says we can not use more than 3 statements so we have to use “any” here for the hosts in the Core and hosts in local LAN)
- All hosts in the Core and local LAN should be able to access the Public Web Server *
Thanks 9tut.com
ALHUMDOLILLAH
Thanks GOD I pass today. I recommend spike dump, 9tut, and for Urdu students urduitacademy.com. All questions came from spike dump and labs from 9tut. Thanks spike, 9tut and Mr. Kashif from urduitacademy…any query —> ks_jafry@yahoo.com
has anyone actually had to apply the access group inside instead of outside on the interface during the exam or has it always been inside?
I passed my exam with a 945/1000. I got acl 1&2 on the labs. questions and answers were all from Prakash dumps!! lab was exact on 9tut. Just study dumps and labs and you will pass. 30mins to finish. pretty easy exam.. many thanks to 9tut, prakash..
good luck to all!!!
# gotz88
please what is acl 1 you get in exam ??
can u send for me on hebbo7@yahoo.com
thanks
please if anybody have ccna thumbs plz send me abdulkhadhar1986@gmail.com
allow web from host c 2 financeweserver=access-list 100 permit tcp host 192.168.33.3 host 172.22.242.23 eq 80
deny any access from the network from accessing finance webserver= access-list 100 deny ip any host 172.22.242.23
othernetwork to be allowed= access-list 100 permit ip any any
to apply interface= interface fastethernt fa0/1
ip access-group 100 out
Got 100% in this sim
I passed today
DO concentrate on using commands only meant for CCNA level
i lost couple of marks as I used wild cards in EIGRP
the exam is easy
best of luck all
I passed CCNA on 8th July and really it fun. I was not expecting it to be so easy. Everyone who is just scared of appearing in the exam, just prepare well and go a head. You will get it by the Help of God.
Very good material on 9tut regarding LAB practice. ACL2, VTP & EIGRP were in my exams.
I passed today, July 10, 2013
947/1000
the exam is not that hard. . just focus studying, repeat repeat and repeat. . it’s the mother of all skills. .
sim Lab: EIGRP (wrong AS number/incomplete routing for network)
ACL (block host B)
VTP (show commands)
Dumps: Spike / Sekhar
thank you guys for the comments and words of encouragement. thank you 9tut.com =)
I have exam in next 2days…
had a question…
Can we edit our ACL for several times with “no acl ….” coomand in real exam or not?
in exam is it necessary to verify. ?
I mean in ACL sim ,,,can we edit our Config?!
One of my friend said he could not edit his Configs…
Can anyone say me if we can edit this in real exam or not???!!
Hello all, I bolo’ed my CCNA with a 815 needing the 825 to pass. I’ve been reading the sim here and remember getting. The following.
Allow host B to access web service of finance server
Deny host B and Core network to access any other services on Finance server
Allow access of public server for everything from everyone
Just now reviewing the 9tut info and realizing why the Permit Any Any is needed. It is a typical trick question. We need the permit any any because the Hosts still need access to the other servers on that network. Using the permit ip any host Public server would remove the DNS server and others due to the implicit deny all at the end of the ACL.
Thank 9tut am just passed exam today and i’m get 920 points
all the sims are valid and perfect for the exam i had given the exam on 20th june , and scored 1000
you might find some modification in the exam like ip address change throughout the three sim and some other modifications in access-list sim2.
Hi all, wondering if this solution is better:
access-list 100 permit ip host 192.168.33.3 host 172.22.242.23
access-list 100 deny tcp any host 172.22.242.23 eq www
access-list 100 permit ip any any
apply the acl 100 inbound to serial 1/0 and Fa0/0
If you follow the theory this is better because the extended acl should be applied as close as the source.
Exam takes into account just the solution (fullfilling the requirements) or looks also at the form?
I mean, if two different configurations work the same, is the lab passed anyway?
I completed ccna pass4sure v10 653 questions .Which was realy helpful .
refer this site latest exam questions available http://tr.im/4428f
Scheduled to take exam this Friday, July 19! wish me luck!!
Het Guys,
In the first modification, he said:
deny host B from accessing other servers (not the whole network), how could it be like this answer ?? access-list 100 deny ip host 192.168.33.2 172.22.242.16 0.0.0.15
I think we have to deny B from accessing other servers individually, but also we have to commit to Only 3 statements !!
Any suggestions ??
Hi,
For “deny host B from accessing other servers (not the whole network)” PW S., DNS S. and FW S. belong to 172.22.242.17 – 172.22.242.30 range.
As you have yo commit only 3 statements, you deny Host B from the subnet address 172.22.242.16 to .31 (broadcast).
Then access-list 123 deny ip host 192.168.33.3 172.22.242.16 0.0.0.15 is the correct command
192.168.33.2 for host B, not .3 ;-)
Yesterday, I passed CCNA Exam 640-802. 947/1000.
Thank 9tut.
I suggested all of you must prepared yourself with 9tut sim Lab espesially EIGRP, ACL & VTP SIM before taking exam.
Thanks to 9tut and all the dumps. Prepare for eigrp, acl, vtp sim for the exam.
the link is not working to download the sim ,
thnxx ,
hello ! 9tut Guys, thenx so much for ur awesome and unquantifiably biulful materials,GLORY TO GOD FOR UR EXISTENCE, I passed yesterday with 881/1000, all questions were from 9tut and spike dumps, with approximately minor modifications.
simulations were : ACCESS-LIST2, VTP, AND EIGRP-
(EIGRP sim had alot of problems in configurations, the second router was not responding during confinguration so i decided to leave it),
hello ! 9tut Guys, thenx so much for ur awesome and unquantifiably biulful materials,GLORY TO GOD FOR UR EXISTENCE, I passed yesterday with 881/1000, all questions were from 9tut and spike dumps, with approximately minor modifications.
simulations were : ACCESS-LIST2, VTP, AND EIGRP-
(EIGRP sim had alot of problems in configurations, the second router was not responding during confinguration so i decided to leave it),
access-list 100 deny tcp any host 172.22.242.23 eq 80 <<<———this line is not neccessary as access list will deny other host implicitly!!!!!!
but any way go as per tradition….!!!
link http://www.9tut.com/download/9tut.com_Access-list_sim2.pkt doesn’t work.
Passed CCNA 640-802 today during 1st attempt. Kudos to 9tut, Todd Lamle and Spike/Pass4sure dumps.
3 Simulations as mentioned by others. “show vtp status” didn’t display complete output.
Just Passed Today with 947/1000 score ..Thanksss to 9tUttt .. For conceptual purpose ..Do watch CBT nuggetts (Jeremy) which is quite helpull.
As far as for exams. Everything came from this website & Lead2Pass dumps. Labs were ACL2, VTP and Eigrp.
For test takers just practice the labs and you will get your certification.
Cheers !!!
@ Pearce .. For me also i didn’t get the full show VTP status display but after entering this command twice it showed me the ip of switch for Vlan Updates.. The output is out of order in the exam i don’t know why but you have to read it carefully for desired info.
Thanksss!!!
el 7amdu lel allah passed ccna yesterday score 920/1000 , valid dump sekhar and spic
passed ccna yasterday score 920/1000 , valid dumps sekhar and spic , labs vtp , eigrp , acl, note \\ make the configuration in 3 laps without help command as it is not working in the real exam so configure the full command by your self
passed today… 973/1000, simulation are.. VTP, ACL2,EIGRP with some changes, and… thank you.. 9tut and spike,,brar.. tood lammel..they are still valid.. all question from them..
drap drop question more..
Dears :
Anybody has the latest questions and answers , please update us as I am prpparing to set for the exam .
Please youe advice .
DATE 24/7/2013