CCNA Access List Sim 2
Question
A network associate is adding security to the configuration of the Corp1 router. The user on host C should be able to use a web browser to access financial information from the Finance Web Server. No other hosts from the LAN nor the Core should be able to use a web browser to access this server. Since there are multiple resources for the corporation at this location including other resources on the Finance Web Server, all other traffic should be allowed.
The task is to create and apply a numbered access-list with no more than three statements that will allow ONLY host C web access to the Finance Web Server. No other hosts will have web access to the Finance Web Server. All other traffic is permitted.
Access to the router CLI can be gained by clicking on the appropriate host.
All passwords have been temporarily set to “cisco”.
The Core connection uses an IP address of 198.18.196.65
The computers in the Hosts LAN have been assigned addresses of 192.168.33.1 – 192.168.33.254
Host A 192.168.33.1
Host B 192.168.33.2
Host C 192.168.33.3
Host D 192.168.33.4
The servers in the Server LAN have been assigned addresses of 172.22.242.17 – 172.22.242.30
The Finance Web Server is assigned an IP address of 172.22.242.23.
The Public Web Server is assigned an IP address of 172.22.242.17
Answer and Explanation
(Note: If you are not sure how to use access-list, please check out my access-list tutorial at: http://www.9tut.com/access-list-tutorial, also some modifications about the access-list have been reported so you should read the “Some modifications” section at the end of this question to understand more. You can also download this sim to practice (open with Packet Tracer) here: http://www.9tut.com/download/9tut.com_Access-list_sim2.pkt
Corp1>enable (you may enter “cisco” as it passwords here)
We should create an access-list and apply it to the interface which is connected to the Server LAN because it can filter out traffic from both Sw-2 and Core networks. The Server LAN network has been assigned addresses of 172.22.242.17 – 172.22.242.30 so we can guess the interface connected to them has an IP address of 172.22.242.30 (.30 is the number shown in the figure). Use the “show running-config” command to check which interface has the IP address of 172.22.242.30.
Corp1#show running-config
We learn that interface FastEthernet0/1 is the interface connected to Server LAN network. It is the interface we will apply our access-list (for outbound direction).
Corp1#configure terminal
Our access-list needs to allow host C – 192.168.33.3 to the Finance Web Server 172.22.242.23 via web (port 80)
Corp1(config)#access-list 100 permit tcp host 192.168.33.3 host 172.22.242.23 eq 80
Deny other hosts access to the Finance Web Server via web
Corp1(config)#access-list 100 deny tcp any host 172.22.242.23 eq 80
All other traffic is permitted
Corp1(config)#access-list 100 permit ip any any
Apply this access-list to Fa0/1 interface (outbound direction)
Corp1(config)#interface fa0/1
Corp1(config-if)#ip access-group 100 out
Notice: We have to apply the access-list to Fa0/1 interface (not Fa0/0 interface) so that the access-list can filter traffic coming from both the LAN and the Core networks. If we apply access list to the inbound interface we can only filter traffic from the LAN network.
In the real exam, just click on host C and open its web browser. In the address box type http://172.22.242.23 to check if you are allowed to access Finance Web Server or not. If your configuration is correct then you can access it.
Click on other hosts (A, B and D) and check to make sure you can’t access Finance Web Server from these hosts.
Finally, save the configuration
Corp1(config-if)#end
Corp1#copy running-config startup-config
(This configuration only prevents hosts from accessing Finance Web Server via web but if this server supports other traffic – like FTP, SMTP… then other hosts can access it, too.)
Notice: In the real exam, you might be asked to allow other host (A, B or D) to access the Finance Web Server so please read the requirement carefully.
Some modifications:
Modification 1:
| permit host B from accessing finance server | access-list 100 permit ip host 192.168.33.2 host 172.22.242.23 |
| deny host B from accessing other servers (not the whole network) | access-list 100 deny ip host 192.168.33.2 172.22.242.16 0.0.0.15 |
| permit everything else | access-list 100 permit ip any any |
Modification 2:
| Only allow Host C to to access the financial server | access-list 100 permit ip host 192.168.33.3 host 172.22.242.23 |
| Not allow anyone else in any way communicate with the financial server | access-list 100 deny ip any host 172.22.242.23 |
| Allow all other traffic | access-list 100 permit ip any any |
Modification 3:
| - Host C should be able to use a web browser(HTTP)to access the Finance Web Server | access-list 100 permit tcp host 192.168.33.3 host 172.22.242.23 eq 80 |
| - Other types of access from host C to the Finance Web Server should be blocked - All access from hosts in the Core or local LAN to the Finance Web Server should be blocked |
access-list 100 deny ip any host 172.22.242.23 (because the requirement says we can not use more than 3 statements so we have to use “any” here for the hosts in the Core and hosts in local LAN) |
| - All hosts in the Core and local LAN should be able to access the Public Web Server * | access-list 100 permit ip any host (If the question asks this, surely it has to give you the IP of Public Web Server) but in the exam you should use “access-list 100 permit ip any any” |
Modification 4:
| Host C should be able to use a web browser to access the financial web server | access-list 100 permit tcp host 192.168.33.3 host 172.22.242.23 eq 80 |
| Other types of access from host C to the finance web server should be blocked | access-list 100 deny ip host 192.168.33.3 host 172.22.242.23 |
| All hosts in the core and on the local LAN should be able to access the Public web server * | access-list 100 permit ip any host (The IP of Public Web Server will surely be given in this question) but in the exam you should use “access-list 100 permit ip any any” |
* There are some reports about the command of “All hosts in the core and on the local LAN should be able to access the Public web server” saying that the correct command should be “access-list 100 permit ip any any”, not “access-list 100 permit ip any host (IP of Public Web Server)”. Although I believe the second command is better but maybe you should use the first command “access-list 100 permit ip any any” instead as some reports said they got 100% when using this command (even if the question gives you the IP address of Public Web Server). It is a bug in this sim.
(Note: Don’t forget to apply this access list to the suitable interface or you will lose points
interface fa0/1
ip access-group 100 out
And in the exam, they may slightly change the requirements, for example host A, host B instead of host C… so make sure you read the requirement carefully and use the access-list correctly)
I created this sim in Packet Tracer v5.2.1 so you can practice with it. You will need new version of Packet Tracer to open it (v5.1+).
Download this sim here
Notice: After typing the commands above, if you make a “ping” from other hosts (PC0, PC1, PC3) then PC4 (Finance Web Server) can still reply because we just filter HTTP traffic, not ICMP traffic. To generate HTTP traffic, select “Web Browser” in the “Desktop” tab of these PCs. When a web browser opens, type the IP address of Finance Web Server and you can see how traffic flows in Simulation Mode.
And notice that in the initial configuration of this sim the Core network can ping Finance Web Server. We have to create an access-list that can filter this traffic too.
Other lab-sims on this site:
guys a very quick question, has anyone taken the CCNA for the second time? if you did, can you please tell me which lab you did in you exam. Any one has any idea. Thank you.
@Manchester Every day the questions change. I have seen that the lab are similar to those available here in 9TUT. ACL, EIGRP and OSPF.
This came out today. Twist is that only Host B can access the Finance Web Server via web browser and all other host are blocked. Then all traffic from all host are allowed in the Public Web Server.
I got the modification 3.
I used ‘access-list 100 permit ip any host (IP of Public Web Server)’ and lost the points.
So PAY ATTENTION!
USE
“access-list 100 permit ip any any”
!!!!
GOOD LUCK GUYS!
Anonymous, haven long u get the ccna exam in recent time ?
hi guys, if anyone have the avanset vce exam simulator pro v1.2 with crack….I have an exame on 26th and plz send to me on this ID…or if anyone have vce to pdf converter than tell me on my contact #03449021480.
good luck.wasalam
Passed yesterday, 974/1000. This was on the test along with ACL1 and Eigrp. The exam contains 3 simulations. This simulations was changed. You where not to alow anyting else into the server network instead of just tcp. “Deny ip any host …. “
I pass exam today score 890 , thanks 9tut really helpfull
Abdul Bari Ahmadzai,
Instead of VCE 1.2, you can use this solution:
https://www.youtube.com/watch?v=tmKGvu9TPKQ
It works..
Good luck
@karwan its normal to get this message just press enter and the configuration will be saved
@can anyone help
I have this way of knowing wildcard mask ,, I just know the increment number and subtract it by 1 , like for this example the network 172.22.242.16 -172.22.242.31 the increment is 16 subtract 1 and you get 15 so the wildcard mask is 0.0.0.15
just try it with multiple examples, it works every time.
srry for late reply
passed tody 972/1000 (acl 1-acl 2 Modification3 ) eigrp lab(12) -watson dump
thanxxxxxxxxxxxxxxxxxxxx 9tut good luck every one
i can’t open any .vce files. it says that i the files where created with a newer vce exam simulator. i have instaled 1.7 What can i do??? please help (i can’t find 1.2 on the internet)
hi all, someone can help me?.. i already passed the exam all question are almost the same here in 9 tut make sure that you know the concept on eigrp ,acl2 the rest same as here.
on acl2 i config a wrong ip address on host the lan PC B . access-list 100 permit ip host 192.x.x.x host 172.x.x.x. eq 80
access-list 100 deny ip any host 172.x.x.x
access-list 100 permit ip any any
* my question is how can i delete all the command since i already config the wrong ip address. I already did a command (no access-list 100 permit ip any any or doing a no command from bottom) but unfortunately the command was not recognized in the system is there any command should i do first ? please advise . Thanks
plz friends i m not getting this modification can any 1 explin me this modification
(deny host B from accessing other servers (not the whole network)
(access-list 100 deny ip host 192.168.33.2 172.22.242.16 0.0.0.15)
what is 0.0.0.15 over here :(
hi arif,
0.0.0.15 is a wildcard mast if you study wildcard mast for simply understanding in the last octet u have given 16 host so you have to minus it by 1 so you can get 0.0.0.15 or 172.x.x.16 has a subnet of 255.255.255.240 so if you’re going to change in wild card mast you must be subtract to 255.
255.255.255.240 – 255.255.255.255 = 0.0.0.15
hope its help you a lot :)
For the OSPF sim, Does it require configuration or is it just multiple questions? I have exam tomorrow. please let me know. Thanks in advance.
@heli
multiple choice only .. just study and memorize the answer :)
took the exam and fail 12/19/14 this sim was on there but when i click on the router 2 to access the CLI it wouldnt let me. any ideas as what i wasnt doing right?
@ kj
you supposed to click a PC icon that is connected to router.
@kj go to the pc that is connected with console cable and click the hypertermal for the CLI too bad for you man.
الحمد لله I got 986 marks. Watson and Examtut valid 100%. ACL1, ACL2 MOD.3 & EIGRP still valid.
@moazzam ali khan from where i get these labs kindly guide me i have to take exam in ist week of January..
Thanks
@test from where i get these labs kindly guide me i have to take exam in ist week of January..
Thanks
@Aamir: download packet tracer and download topology from 9 tut. practices 3 to 4 times before real exam. passed ccnc 992/1000. ACl1, acl2 and eigrp 23
@ test: thanks a lot dear
@Aamir I have a question for you Eigrp troubleshoting sim or eigrp lab was in your exam?
Aamir Khalil don’t worry brother…..just chill and full prepare 9tut labs then u’ll get good scores… thats it
passed today 1000/1000 at VDC Da Nang (acl 1-acl 2 Modification3 ) eigrp lab(221) -watson dump & Matthew dump(2-3 question)
“permit ip any any” correctly 100% :D
Thanks 9tutttt
@tuan what acl 2 Modification3 mean? what did u really have to do?
Passed 1000/1000
Just want to point out a bug I encountered in the ACL2 SIM:
While assigning the ACL to the Fa0/1 interface, it somehow managed to erase the IP address of the interface! I noticed it quickly, and then i configured the interface myself, like so:
interface Fa0/1
ip address x.x.x.x 255.255.255.x
ip access-group 100 out
no shutdown
Everything was OK after that :) Also, “permit ip any any” works!
@Shee
i write
access-list 100 permit tcp host 192.xx.xx.xx(ip host C) host 172.xx.xx.xx (ip Finance Web Server) eq 80
access-list 100 deny ip any host 172.xx.xx.xx(ip Finance Web Server)
access-list 100 permit ip any any
@groliks Except ACL2 SIM What other 2 Simulations u have got in the exam ?
hi guys! is just want to know if anybody experienced this kind of scenario? its from Karwan experienced (i dont know why i am not able to save the config on corp#1 whenever i use command copy running-config satartup-config “Destination filename [startup-config]?” this command appera i dont know what to do now can any one help me with this . that what should i do)..
your comment will be a big help for us CCNAexaminer this coming january thanks!
hi guys,yesterday 26th dec 2014 I passed my ccna 200-120 exam 1000/1000.almost all questions from 9tut. Eigrp (23) , one unnecessary network on router 1. Removed it and worked fine. ACL 1 multiple choice question. no need to configure anything .
anyone wana dumbs I have it,but in some cost,coz its latest purchased dumbs,all the question came from this
Brava you are right this cammand appear, I solve this with pressing question mark (?)when you write “copy run start…”then press ? and then enter.
best of luck.
networkingenginer@gmail.com
03449021480
Latest CCNA 200-120 dumps 316 Questions & Answers available.
316 question dumps are 100% valid. I already purchased that If you needed, share nominal fee.
Thanks
Azeem Sarwar
azeemsarwar1@hotmail.com
skype: azeem.sarwar1
Thanks Estefano, reason being, I have taking my exam last year and failed. Am taking it again on the 30th of December, so did not know whether the labs will be the same when taking the exam the second time or whether it will be changed coompletely.
27-12-14 m take the ccna exam 200-120 score 986/1000. all paper frm Watson dumps 314
4 to 5 Q frm outside of dumps. labs r ACL1, ACl 2 , eigrp. acl1 is same but Q is gives the ans with sh cmand. eigrp is same sanireo with different ips and as no and passive intnterface with litle bit changes. acl2 (modification 3) with access host D and different ips. All labs frm 9tut. if any one help mail me.
lots of thanksssssssssssssssssssssssssssssssssssss 9tut and Watson dunps.
samad frm Pakistan.
samadqureshi24@yahoo.com.
Passed today 1000/1000,ACL1, ACL2 MOD.3 & EIGRP alll questions from 9tut ,use permit ip any any “thanks 9tut :)
ACL MOD 3
Router(config)#access-list 100 permit tcp host 192.168.33.1 host 172.22.242.23 eq 80
Router(config)#access-list 100 deny ip any host 172.22.242.23
Router(config)#access-list 100 permit ip any any
Do i have to apply the access-list to Fa0/1 interface? i asking this because by adding it that will exceed the comment in the question which states” access-list with no more than three statements”
Can anyone help me get a better picture of the MOD complete configuration in the exam?
@Rago yes you must apply the access-list to interface fa0/1 beacuse the comment about three statment not included the interface command.
passed now with 986/1000 , all exam from waston dump and 9tut, ACL1,ACL2 MOD.2 with ip changes & EIGRP AS 221 , with ip changes also.
you should write all CLI < tab is not auto complete the CLI even to see the AS of the router , it doesn’t appear in #show running configuration.
good luck
you should write all CLI < tab is not auto complete the CLI
to see the AS of the router you should write #show ip eigrp interface
, it doesn’t appear in #show running configuration.
good luck
When I entered ( Copy running-conf….)
What is the name that I can safe my file in it cuz it not accepting any??
Thanks
Congratulations! Ali help me out i Have all dumps but dnt have latest version VCE software how can i run all dumps ??
for dumps which software you used plz tell me ?
what is the different between tcp host and ip host????
ali send me dumps please dear on wasifmehmod12@yahoo.com
@Tuan thanks alot.
Anyone with Watson Dump in PDF format plz email taylorintact@gmail.com Thank you.