CCNA Access List Sim 2
Question
A network associate is adding security to the configuration of the Corp1 router. The user on host C should be able to use a web browser to access financial information from the Finance Web Server. No other hosts from the LAN nor the Core should be able to use a web browser to access this server. Since there are multiple resources for the corporation at this location including other resources on the Finance Web Server, all other traffic should be allowed.
The task is to create and apply a numbered access-list with no more than three statements that will allow ONLY host C web access to the Finance Web Server. No other hosts will have web access to the Finance Web Server. All other traffic is permitted.
Access to the router CLI can be gained by clicking on the appropriate host.
All passwords have been temporarily set to “cisco”.
The Core connection uses an IP address of 198.18.196.65
The computers in the Hosts LAN have been assigned addresses of 192.168.33.1 – 192.168.33.254
Host A 192.168.33.1
Host B 192.168.33.2
Host C 192.168.33.3
Host D 192.168.33.4
The servers in the Server LAN have been assigned addresses of 172.22.242.17 – 172.22.242.30
The Finance Web Server is assigned an IP address of 172.22.242.23.
The Public Web Server is assigned an IP address of 172.22.242.17
Answer and Explanation
(Note: If you are not sure how to use access-list, please check out my access-list tutorial at: http://www.9tut.com/access-list-tutorial, also some modifications about the access-list have been reported so you should read the “Some modifications” section at the end of this question to understand more. You can also download this sim to practice (open with Packet Tracer) here: http://www.9tut.com/download/9tut.com_Access-list_sim2.pkt
Corp1>enable (you may enter “cisco” as it passwords here)
We should create an access-list and apply it to the interface which is connected to the Server LAN because it can filter out traffic from both Sw-2 and Core networks. The Server LAN network has been assigned addresses of 172.22.242.17 – 172.22.242.30 so we can guess the interface connected to them has an IP address of 172.22.242.30 (.30 is the number shown in the figure). Use the “show running-config” command to check which interface has the IP address of 172.22.242.30.
Corp1#show running-config
We learn that interface FastEthernet0/1 is the interface connected to Server LAN network. It is the interface we will apply our access-list (for outbound direction).
Corp1#configure terminal
Our access-list needs to allow host C – 192.168.33.3 to the Finance Web Server 172.22.242.23 via web (port 80)
Corp1(config)#access-list 100 permit tcp host 192.168.33.3 host 172.22.242.23 eq 80
Deny other hosts access to the Finance Web Server via web
Corp1(config)#access-list 100 deny tcp any host 172.22.242.23 eq 80
All other traffic is permitted
Corp1(config)#access-list 100 permit ip any any
Apply this access-list to Fa0/1 interface (outbound direction)
Corp1(config)#interface fa0/1
Corp1(config-if)#ip access-group 100 out
Notice: We have to apply the access-list to Fa0/1 interface (not Fa0/0 interface) so that the access-list can filter traffic coming from both the LAN and the Core networks. If we apply access list to the inbound interface we can only filter traffic from the LAN network.
In the real exam, just click on host C and open its web browser. In the address box type http://172.22.242.23 to check if you are allowed to access Finance Web Server or not. If your configuration is correct then you can access it.
Click on other hosts (A, B and D) and check to make sure you can’t access Finance Web Server from these hosts.
Finally, save the configuration
Corp1(config-if)#end
Corp1#copy running-config startup-config
(This configuration only prevents hosts from accessing Finance Web Server via web but if this server supports other traffic – like FTP, SMTP… then other hosts can access it, too.)
Notice: In the real exam, you might be asked to allow other host (A, B or D) to access the Finance Web Server so please read the requirement carefully.
Some modifications:
Modification 1:
| permit host B from accessing finance server | access-list 100 permit ip host 192.168.33.2 host 172.22.242.23 |
| deny host B from accessing other servers (not the whole network) | access-list 100 deny ip host 192.168.33.2 172.22.242.16 0.0.0.15 |
| permit everything else | access-list 100 permit ip any any |
Modification 2:
| Only allow Host C to to access the financial server | access-list 100 permit ip host 192.168.33.3 host 172.22.242.23 |
| Not allow anyone else in any way communicate with the financial server | access-list 100 deny ip any host 172.22.242.23 |
| Allow all other traffic | access-list 100 permit ip any any |
Modification 3:
| - Host C should be able to use a web browser(HTTP)to access the Finance Web Server | access-list 100 permit tcp host 192.168.33.3 host 172.22.242.23 eq 80 |
| - Other types of access from host C to the Finance Web Server should be blocked - All access from hosts in the Core or local LAN to the Finance Web Server should be blocked |
access-list 100 deny ip any host 172.22.242.23 (because the requirement says we can not use more than 3 statements so we have to use “any” here for the hosts in the Core and hosts in local LAN) |
| - All hosts in the Core and local LAN should be able to access the Public Web Server * | access-list 100 permit ip any host (If the question asks this, surely it has to give you the IP of Public Web Server) but in the exam you should use “access-list 100 permit ip any any” |
Modification 4:
| Host C should be able to use a web browser to access the financial web server | access-list 100 permit tcp host 192.168.33.3 host 172.22.242.23 eq 80 |
| Other types of access from host C to the finance web server should be blocked | access-list 100 deny ip host 192.168.33.3 host 172.22.242.23 |
| All hosts in the core and on the local LAN should be able to access the Public web server * | access-list 100 permit ip any host (The IP of Public Web Server will surely be given in this question) but in the exam you should use “access-list 100 permit ip any any” |
* There are some reports about the command of “All hosts in the core and on the local LAN should be able to access the Public web server” saying that the correct command should be “access-list 100 permit ip any any”, not “access-list 100 permit ip any host (IP of Public Web Server)”. Although I believe the second command is better but maybe you should use the first command “access-list 100 permit ip any any” instead as some reports said they got 100% when using this command (even if the question gives you the IP address of Public Web Server). It is a bug in this sim.
(Note: Don’t forget to apply this access list to the suitable interface or you will lose points
interface fa0/1
ip access-group 100 out
And in the exam, they may slightly change the requirements, for example host A, host B instead of host C… so make sure you read the requirement carefully and use the access-list correctly)
I created this sim in Packet Tracer v5.2.1 so you can practice with it. You will need new version of Packet Tracer to open it (v5.1+).
Download this sim here
Notice: After typing the commands above, if you make a “ping” from other hosts (PC0, PC1, PC3) then PC4 (Finance Web Server) can still reply because we just filter HTTP traffic, not ICMP traffic. To generate HTTP traffic, select “Web Browser” in the “Desktop” tab of these PCs. When a web browser opens, type the IP address of Finance Web Server and you can see how traffic flows in Simulation Mode.
And notice that in the initial configuration of this sim the Core network can ping Finance Web Server. We have to create an access-list that can filter this traffic too.
Other lab-sims on this site:
2 days from now i will take my CCNA exam.. Pray for me guys..
Passed my exam ccna yesterday with 986/1000 thanks 9tut all Q from it Acl1&2 mode 3 eigrp 212
passed yesterday with 1000/1000 mark
dear sadiq
please send me the dumps to sathamsheriffs@gmail.com i gonna take my exam
Salam to All
Al Hamdulillah Al hamdulillah
I hv passed my exam 4th Feb 2015 931/1000 thanks 9tut
but one lab has been changed Acl1 abd Acl2 (Mod3) but eigrp 212 changed with eigrp 12
be carefull
Best of luck to all
what is the lab changed(kamran abdul Razzaq) ?
Tomorrow is my examination for CCNA.. I will pass!i will.. will.. with the help of angel of God no other than 9tut. Pray for me guys!
Thanks God passed 7/FEB/2015 with score 1000, i study from watson and 9tut labs(ACL1,ACL2, EIGRP mod. 3); note I get some new questions I will put them as much as I remeber
1- On OSPF (choose 2) —–> answerone of them is : virtual link
2- On ethernet channel (show run of two switches failed to create chanel why?) ——> answer: speed mismatch
3- on SNMP —> answer: Trap
Acl1 abd Acl2 (Mod3) but eigrp 212?
what does mod 3 mean here?
Ive passed with 945/1000!!!! Big Thanks 9tut! mix emotions! God Bless!
I think mod 3 & 4 r same….but in mod 3 in second statement dey hav used any as src address and in mod 4 they have used particular host as a src address what is the difference
I have passed with 1000/1000 !!!! Big Thanks 9tut !!!
Labs were asked Acl1, Acl2 (Mod 3) & Eigrp 212?
Hi sujath….in acl1 multiple questions were asked or what??
luki28,Sujath, Yanous, Mohamed Bana, Jim Santos
hi
can one of plz tell as the Q that are in exam are the same as ones in the domp ?\
or have much mod?
thanks
i have passed with 1000/1000 thanks to 9tut
labs were questioned ACL1,ACL2 with mod 3 and Eigrp with autonomous 12.
thanks to my dear allah today i have passed CCNA exam today. And i got 1000/1000 marks
Thanks TO 9tut ,watson
iqbal hussian,
what are the qns that came out for you?
acl1 ,acl2 mod 3,eigrp,watson,and one question from mathews
what is the one qns from matthews?
ALHAMDULILLAH, today i passed CCNA 200-120 exam, i got EIGRP , ACL sim & ACL2 sim labs. The DNS Server was removed and Public Server was given an IP. All IP’s were changed.In The EIGRP Lab, The routers were named as HUB router and SERVERS router, AS No. on Servers router was misconfigured and Network between HUB and SERVER router was not advertised on HUB router. I tested the functionality by Pinging the ISP router and saved all the labs before clicking NEXT. There were 51 Qs. my score is 972/1000. The Dumps of 316 Qs. were really helpful.
@AZkhan,
In the ACL2 simulation in which you were given the IP address of the Public Server, did you use that specific IP to allow access or did you use “permit ip any any” ?
Since not using any any and permitting only the specific IP address of Public Server will result in loss of connectivity of Hosts with any other servers which may be present?
@Rafay,
I used “ip any any” , but both will work ” ip any any” or ” permiting just to the destination of Public web server” bcoz all hosts whether form core or lan are permitted to the only available destination i.e. Public web Server. i checked the functionality by opening the web browser from each host and as per requirement only host A was able to access the Finance web server, other host were unable to access the finance server. but you should also checked the access of each host to the other hosts which i did’nt. i just tested the finance server.
Passed CCNA Composite today! Thanks 9tut. many of your tutorial questions were very similar to questions seen on my exam.
passed composite 200-120 on 10-feb-2015 as well!
Thanks 9tut!
The terminal i am working at does not allow 1 to write mem nor save configurations. Once you are done, simply click next.
3 lab qns (eigrp, acl mod2, acl – multiple choice, same as 9tut ans)
Eigrp changed router name to mgp, egp and etc. From router eigrp 22 to 12 And add network statement on main mgp router
Acl mod2 – allow host b to access finance web, all other hosts blocked to finance but allowed on private web server
Sorry i meant acl mod1
Hi Younous,
I gonna take my exam please HELP ME ON THIS, IF YOU HAVE ANY DUMPS PLEASE SEND ME
sathamsheriffs@gmail.com
hi A,
Please send me dumps if you have, i have exam sathamsheriffs@gmail.com
Today I passed 200-120 exam on 12-feb-2015 with 1000/1000. Thanks 9tut.
Labs: ACL1. ACL2, EIRGP. 97% in dump.
Passed exam 945/1000
valid dump!
ACL1, ACL2, EIRGP
Thanks alot 9tut!
Passed exam 945/1000
valid dump!
ACL1, ACL2, EIRGP
Thanks alot 9tut!
passed today in egypt with 972/1000
labs acl , acl 2 mod 3 , eigrp
watson dump valid 95 %
Email me for primium dump
ma.dawy0027@gmail.com
please help how many Qs are in the exam?
yesterday passed 917. this sim was in the exam. tnx 9tut!
Passed today 986/1000
Dumps are good for exam
Labs ACL 1, Eigrp AS 212 and Acl 2
ACL 2 Mod 3 was indeed in the exam, as well as the usual Eigrp and ACL 1.
Passed.
Labs : ACL 2 (Mod 3) & EIGRP AS 23.
THANK YOU 9TUT.
Keep up the good work.
I have tried to configure Modification 1
access-list 100 permit tcp host 192.168.33.2 host 172.22.242.23 eq 80
access-list 100 deny tcp any host 172.22.242.23 eq 80
access-list 100 deny tcp host 192.168.33.2 172.22.242.16 0.0.0.15
access-list 100 permit ip any any
first 2 commands are working only host 2 is able to access finance but when i am tring to block it for other servers by last 2 commands , host B still able to ping other servers , please help why its happening…
ooohhhh sorry i have not seen below notice got the answer….Thanks
I plan on taking the exam next week. Can anyone help with the latest dumps? Thanks! naldars@hotmail.com
Hi ,
I am going to seat for test tomorrow at 11:30. But i have a last minute question all. Please answer my question .
Question: When i write “copy runnning-config startup-config” on packet tracer it ask for the location where to save
and i just enter, i dont know where it save . What about test center , there system will ask the same . If asking than what location i have to choose ? Pleseeee let me know asap
passed with 903/1000 acl 1, 2 mod 1 eirgp lab. could not have done it without 9tut thank you so much
All hosts in the Core and local LAN should be able to access the Public Web Server *
I answered this with “access-list 100 permit ip any host ___” and got 1 mistake.
I guess the answer really is access-list 100 permit ip any any
Hi All,
I have just completed my CCNA 200-120. If anybody need any help regarding CCNA, i will love to help them. I have the latest CCNA dump, if anyone need let me know. On the exam Sim was ACL-1, ACL-2 and EIGRP.
Thanks 9tut and everyone
Hi
I have Modification 3 which is a trick and you can’t really test it. It said deny any type of access from host to access finance server,core, or local land. I answer “access-list 100 deny ip host __ any” I didn’t understand why the answer here is host finance server when they told you to deny Core and Lan as well. Please explain.
I’m taking mine next week can you help me? Email dsd470@gmail.com
@dsd470
What kinds of help u need ?
wow…such a great experiance writing the exam.. gracefully scored 958… dumbs are so valid …. eigrp and acl sim2 were the lab questions…. all the best guys