CCNA Access List Sim 2
Question
A network associate is adding security to the configuration of the Corp1 router. The user on host C should be able to use a web browser to access financial information from the Finance Web Server. No other hosts from the LAN nor the Core should be able to use a web browser to access this server. Since there are multiple resources for the corporation at this location including other resources on the Finance Web Server, all other traffic should be allowed.
The task is to create and apply a numbered access-list with no more than three statements that will allow ONLY host C web access to the Finance Web Server. No other hosts will have web access to the Finance Web Server. All other traffic is permitted.
Access to the router CLI can be gained by clicking on the appropriate host.
All passwords have been temporarily set to “cisco”.
The Core connection uses an IP address of 198.18.196.65
The computers in the Hosts LAN have been assigned addresses of 192.168.33.1 – 192.168.33.254
Host A 192.168.33.1
Host B 192.168.33.2
Host C 192.168.33.3
Host D 192.168.33.4
The servers in the Server LAN have been assigned addresses of 172.22.242.17 – 172.22.242.30
The Finance Web Server is assigned an IP address of 172.22.242.23.
The Public Web Server is assigned an IP address of 172.22.242.17
Answer and Explanation
(Note: If you are not sure how to use access-list, please check out my access-list tutorial at: http://www.9tut.com/access-list-tutorial, also some modifications about the access-list have been reported so you should read the “Some modifications” section at the end of this question to understand more. You can also download this sim to practice (open with Packet Tracer) here: http://www.9tut.com/download/9tut.com_Access-list_sim2.pkt
Corp1>enable (you may enter “cisco” as it passwords here)
We should create an access-list and apply it to the interface which is connected to the Server LAN because it can filter out traffic from both Sw-2 and Core networks. The Server LAN network has been assigned addresses of 172.22.242.17 – 172.22.242.30 so we can guess the interface connected to them has an IP address of 172.22.242.30 (.30 is the number shown in the figure). Use the “show running-config” command to check which interface has the IP address of 172.22.242.30.
Corp1#show running-config
We learn that interface FastEthernet0/1 is the interface connected to Server LAN network. It is the interface we will apply our access-list (for outbound direction).
Corp1#configure terminal
Our access-list needs to allow host C – 192.168.33.3 to the Finance Web Server 172.22.242.23 via web (port 80)
Corp1(config)#access-list 100 permit tcp host 192.168.33.3 host 172.22.242.23 eq 80
Deny other hosts access to the Finance Web Server via web
Corp1(config)#access-list 100 deny tcp any host 172.22.242.23 eq 80
All other traffic is permitted
Corp1(config)#access-list 100 permit ip any any
Apply this access-list to Fa0/1 interface (outbound direction)
Corp1(config)#interface fa0/1
Corp1(config-if)#ip access-group 100 out
Notice: We have to apply the access-list to Fa0/1 interface (not Fa0/0 interface) so that the access-list can filter traffic coming from both the LAN and the Core networks. If we apply access list to the inbound interface we can only filter traffic from the LAN network.
In the real exam, just click on host C and open its web browser. In the address box type http://172.22.242.23 to check if you are allowed to access Finance Web Server or not. If your configuration is correct then you can access it.
Click on other hosts (A, B and D) and check to make sure you can’t access Finance Web Server from these hosts.
Finally, save the configuration
Corp1(config-if)#end
Corp1#copy running-config startup-config
(This configuration only prevents hosts from accessing Finance Web Server via web but if this server supports other traffic – like FTP, SMTP… then other hosts can access it, too.)
Notice: In the real exam, you might be asked to allow other host (A, B or D) to access the Finance Web Server so please read the requirement carefully.
Some modifications:
Modification 1:
| permit host B from accessing finance server | access-list 100 permit ip host 192.168.33.2 host 172.22.242.23 |
| deny host B from accessing other servers (not the whole network) | access-list 100 deny ip host 192.168.33.2 172.22.242.16 0.0.0.15 |
| permit everything else | access-list 100 permit ip any any |
Modification 2:
| Only allow Host C to to access the financial server | access-list 100 permit ip host 192.168.33.3 host 172.22.242.23 |
| Not allow anyone else in any way communicate with the financial server | access-list 100 deny ip any host 172.22.242.23 |
| Allow all other traffic | access-list 100 permit ip any any |
Modification 3:
| - Host C should be able to use a web browser(HTTP)to access the Finance Web Server | access-list 100 permit tcp host 192.168.33.3 host 172.22.242.23 eq 80 |
| - Other types of access from host C to the Finance Web Server should be blocked - All access from hosts in the Core or local LAN to the Finance Web Server should be blocked |
access-list 100 deny ip any host 172.22.242.23 (because the requirement says we can not use more than 3 statements so we have to use “any” here for the hosts in the Core and hosts in local LAN) |
| - All hosts in the Core and local LAN should be able to access the Public Web Server * | access-list 100 permit ip any host (If the question asks this, surely it has to give you the IP of Public Web Server) but in the exam you should use “access-list 100 permit ip any any” |
Modification 4:
| Host C should be able to use a web browser to access the financial web server | access-list 100 permit tcp host 192.168.33.3 host 172.22.242.23 eq 80 |
| Other types of access from host C to the finance web server should be blocked | access-list 100 deny ip host 192.168.33.3 host 172.22.242.23 |
| All hosts in the core and on the local LAN should be able to access the Public web server * | access-list 100 permit ip any host (The IP of Public Web Server will surely be given in this question) but in the exam you should use “access-list 100 permit ip any any” |
* There are some reports about the command of “All hosts in the core and on the local LAN should be able to access the Public web server” saying that the correct command should be “access-list 100 permit ip any any”, not “access-list 100 permit ip any host (IP of Public Web Server)”. Although I believe the second command is better but maybe you should use the first command “access-list 100 permit ip any any” instead as some reports said they got 100% when using this command (even if the question gives you the IP address of Public Web Server). It is a bug in this sim.
(Note: Don’t forget to apply this access list to the suitable interface or you will lose points
interface fa0/1
ip access-group 100 out
And in the exam, they may slightly change the requirements, for example host A, host B instead of host C… so make sure you read the requirement carefully and use the access-list correctly)
I created this sim in Packet Tracer v5.2.1 so you can practice with it. You will need new version of Packet Tracer to open it (v5.1+).
Download this sim here
Notice: After typing the commands above, if you make a “ping” from other hosts (PC0, PC1, PC3) then PC4 (Finance Web Server) can still reply because we just filter HTTP traffic, not ICMP traffic. To generate HTTP traffic, select “Web Browser” in the “Desktop” tab of these PCs. When a web browser opens, type the IP address of Finance Web Server and you can see how traffic flows in Simulation Mode.
And notice that in the initial configuration of this sim the Core network can ping Finance Web Server. We have to create an access-list that can filter this traffic too.
Other lab-sims on this site:
@loshmy hi i have a question.
Did you put a copy run start on every cpnfig on all sims? What if i forgot to put a copy run start? It will deduct my score?
@paek
It is of utmost importance to use copy running-config start-up config or copy run start to save all the configurations that you have made in the lab exam. Many have failed in CCNA exam just because they have not used copy running-config start-up config or copy run start command to save their configurations.
so please take care and start using it even if you practice the lab sim for exams.
to day my exam
@Anonymous
in modification 3: Other types of access from host C aswell as All access from hosts in the Core or local LAN to the Finance Web Server should be blocked. so ans is deny ip any host 172.22.242.23
where as in mod4: only host c is mentioned so answer is deny ip host 192.168.33.3 host 172.22.242.23
just pass today. score 1000/1000 labs were ACL, 100% the same; ACL2- IP’s are different, modification 3, host D, but all concepts are the same; EIGRP different AS no. – 122 and IP, remove wrong network on router3 and add the network of the new installed router, change AS no on new router. really the same on the sims just different AS numbers and IP.
ALL QUESTIONS ARE ON DUMPS JUST PRACTICE IT MANY MANY TIMES sure you gonna perfect the exam. all questions and choices are the same just the answers are shuffled. I recommend WATSON DUMPS. IT IS THE BEST. just try and try until you memorize all. I swear you gonna perfect it. While im in the exam, i can answer the question without reading the questions because i practice many times. all questions are here in 9tut. thanks 9TUT! 9tut is enough!!!!! but if you want to practice you watson dumps ;)
Question – I dont understand why TCP is used instead of IP as protocol in the access list? Please explain. Thanks!
So I wrote my exam today and I passed 980/1000. I’m super excited and really thankful for this site. Labs were ACL 1 (Exactly as it is on this site), ACL 2 with modification 3 , host D, same concept but different IP addresses. I used the “access-list 100 permit ip any any” as my last statement and got the full mark. For EIGRP, the newly introduced router had a different AS from the others, had to change that and for the main router, a network was missing and it had a wrong network that had to be removed. That was fixed and I was able to ping all the other routers. There was a “passive-interface” command between the ISP and the main Router but I left it like that as advised on this site. Same concept again as what we have on this site just different IP addresses. Don’t forget to do all your verifications to check if you can ping and they can all “see” each other. I got 100% on Network Device Security.
Study, study, study and practise, practise, practise……This site is really helpful and the Watson dumps is still 100% valid and its really a good one to practise with. YOU can do it, all you need to do is to Read, Read, Read and put in all your effort in practicing with the labs here or better still, build your own labs with the simulation question in the dumps on packet tracer and practise like there’s no tomorrow, that’s what I did.
Thanks to everyone who shared their success stories, who gave explanations on different questions and to 9tut for this site. I hope this helps someone like every other comment here has helped me!!!!! Best of luck to everyone.
On to the next……….CCNP!
@Ddawg TCP is used because we are allowing traffic to the web. www is a web connection to an HTTP web server and TCP is used for a www connection. Some other common TCP port names & numbers are FTP (21), TELNET (23), SMTP (25) and WWW (80). When ever you want to create a telnet, ftp smtp or www traffic, use TCP.
We were asked in the question that host C should be able to use a web browser (HTTP) to access the financial web server and because it had to do with the web browser, we used TCP. If you just have to ping, use IP.
Hope this helps.
SIM QUESTIONS stay in begin, middle ou end test exam?
Hi, I passed in my exam today with 986/1000.
Thanks 9tut and all the community!! U all had been done a great job here!
The Labs were ACL1 (the same), ACL 2 with only two servers and a IP for the public web server, so it was “permit ip any host 177.20.22.17″ and EIGRP with an wrong IP address in serial interface to Core, something like 192.18.x.y 255.255.255.252… and a drag and drop question about cost, load, bandwidth, hop count, reliab and delay. The others were the same questions here inm 9tut…
PS: made at Brazil in english
@Edna17 – Thanks for the explanation. Makes perfect sense.
I passed today, got 931/1000
I had acl, acl2 and eigrp labs
Eigrp was also the same, simple changes (ip addresses and eigrp 2). Passive interface command was on R1 and ISP link. Don’t remove it!
I got acl2 modification 3 and as a last statement I used: permit ip any any! In server lan I had only public web server and finance web server. There was no dns server.
I used the following dumps from examcollection.com: watson, matthew, examtut and gillbeast, but I think that watson’s dump is the best and quite enough to pass. All questions were from dumps!
ACL Mod3
last requirement is to allow access to public web server. So strictly speaking the last line should be “access-list 100 permit tcp any host 172.22.242.17 eq www”. But 9tut answer of “access-list 100 permit ip any any” will also work
Any comments ?
@FR-I think because it is asking to access public web server and its not askingabout http- web browser of public web server in specific,so 9 tut answer is correct.
@Ddawg…..you’re welcome. Glad I could be of help!
@Warrior…..Sim questions can come at anytime or at whatever number when the exam starts (beginning, middle or end). I actually had 51 questions during the exam and my SIM questions were like no. 30, no 40 and no. 45…..I don’t think it matters at what point it comes, just be prepared for the SIM even if it comes as the first question. Bonne Chance!
@edna17 please send me watson Dumps , email ahmedbaha79@hotmail.com
@edna17 please send me watson Dump , email ahmedbaha79@hotmail.com
Can anyone please send me watson dump file?
Email: putrid_grinder@hotmail.com
Thanks!!
do people share dumps or I have to cough up 49.99 :)
when I took my ccna this lab was in it. if you put these 3 commands the way you see them here it will not work. ACL’s use the inverse mask to calculate the address. I know that because I spent 20 minutes on this question trying to put in the first command the way I saw it up there. I kept trying it the way I saw it up there, then I tried it with a normal subnet mask and they both were not working. the correct commands are
access-list 100 permit tcp host 192.168.33.3 0.0.0.1 host 172.22.242.23 0.0.0.1 eq 80
access-list 100 deny tcp any host 172.22.242.23 0.0.0.1 eq 80
access-list 100 permit ip any any
for all those searching for the watson dump:
http://www.examcollection.com/cisco/Cisco.Actualtests.200-120.v2013-12-10.by.Watson.314q.vce.file.html
you have to register here at http://www.examcollection.com (free) and after download the dump from the link
Cheers :D
I have heard that ccna exam paper would get change next month….does any one know about it???
@Ali Asghar
where did you hear that?
Just paid for my test…taking it this thursday @ 5PM…
Can we use ? and Tab key in exam simulations ?
i hv exam on 27th
from india
@Aniket
I read something about that says tabs sometimes doesn’t work
study the full command in case of that
Hi loshmy / all , thanks for the info. may i ask in mod 3 acl2 is the config is also the same even there is no dns server?
access-list permit 100 tcp host (ip address) host (ip address) eq www
access-list deny 100 ip any host (ip address)
access-list permit ip any any
please advice. Thanks :)
HEY GUYS PLEASE ANSWER ME WHAT ARE THE LATEST LABS EXAM ON THE CCNA 200-120 ?? THANKS ADVANCE FOR THE ANSWER LOVE <3
hi what are the actual labs on exam?
@Ali, I heard so too. Can anyone kindly confirm this. I’m doing my exam on 3rd september
@Eve
what kind of change?…will they change the whole exam or just a few questions?
I’m not quite sure but maybe 50% of the exam might change
@Eve
are you sure about that?
I’m taking the exam on 31-8…what do you think?
I’m hoping its not true coz am taking mine on 3rd… Somebody told me there is a high possibility of change
@Eve
I hope so
@Mahmoud, which dumps are you using?
@Eve
studied Watson, examtut, matthew, gillbeast and 9tut
only a few more questions in matthew..except that they are almost the same
@Mahmoud
okay, All the best!
i heard it from my cisco academy institution
has any1 given the paper today?
I passed today, got 1000/1000
I had acl 1, acl2 and eigrp labs
I used dump watson and this website (9tut) thanks, those two are enough to pass the exam.
Hey @ Al Hudaifi-Oman, did you have to use wildcard mask for the ACL2 sim??
when you configure the access-list
thank you!
Suri @ no
i didn’t used it
ACL 2….Modification3 (in my exam >>today)
@ Al Hudaifi-Oman
thank you friend!
I got a test today and my score = 1000/1000.
simul) ac1,2 and eigrp. almost the same as 9tut
muliple choices and drag and drops) 9tut and watson
thanks 9tut!
i also gave test on 28th…i scored 972
Prepare from Watson dumps!
Passed, used CBT Nuggets, Watson dumps and this page for the labs.
Sims
1) ACL: No change need, just need to do a show running, answers just like here.
2) ACL2: Got the same as the site, they changed the HOST to B.
3) EIGRP lab: got this same lab (EIGRP AS 12), no passive interface activated.
NOTE: Always remember to SAVE the config, forgot to do that on the ACL2 sim.
I’M a new student making its pathway in the IT field. Can we go straight to prepare for the CCNA or I should take first the CCENT? I have been studying for the 4 months to take the CCNA. Need your help. Thanks,
@soiree just do the CCNA, of course if you had the experience/practice.