CCNA Access List Sim 2
Question
A network associate is adding security to the configuration of the Corp1 router. The user on host C should be able to use a web browser to access financial information from the Finance Web Server. No other hosts from the LAN nor the Core should be able to use a web browser to access this server. Since there are multiple resources for the corporation at this location including other resources on the Finance Web Server, all other traffic should be allowed.
The task is to create and apply a numbered access-list with no more than three statements that will allow ONLY host C web access to the Finance Web Server. No other hosts will have web access to the Finance Web Server. All other traffic is permitted.
Access to the router CLI can be gained by clicking on the appropriate host.
All passwords have been temporarily set to “cisco”.
The Core connection uses an IP address of 198.18.196.65
The computers in the Hosts LAN have been assigned addresses of 192.168.33.1 – 192.168.33.254
Host A 192.168.33.1
Host B 192.168.33.2
Host C 192.168.33.3
Host D 192.168.33.4
The servers in the Server LAN have been assigned addresses of 172.22.242.17 – 172.22.242.30
The Finance Web Server is assigned an IP address of 172.22.242.23.
The Public Web Server is assigned an IP address of 172.22.242.17
Answer and Explanation
(Note: If you are not sure how to use access-list, please check out my access-list tutorial at: http://www.9tut.com/access-list-tutorial, also some modifications about the access-list have been reported so you should read the “Some modifications” section at the end of this question to understand more. You can also download this sim to practice (open with Packet Tracer) here: http://www.9tut.com/download/9tut.com_Access-list_sim2.pkt
Corp1>enable (you may enter “cisco” as it passwords here)
We should create an access-list and apply it to the interface which is connected to the Server LAN because it can filter out traffic from both Sw-2 and Core networks. The Server LAN network has been assigned addresses of 172.22.242.17 – 172.22.242.30 so we can guess the interface connected to them has an IP address of 172.22.242.30 (.30 is the number shown in the figure). Use the “show running-config” command to check which interface has the IP address of 172.22.242.30.
Corp1#show running-config
We learn that interface FastEthernet0/1 is the interface connected to Server LAN network. It is the interface we will apply our access-list (for outbound direction).
Corp1#configure terminal
Our access-list needs to allow host C – 192.168.33.3 to the Finance Web Server 172.22.242.23 via web (port 80)
Corp1(config)#access-list 100 permit tcp host 192.168.33.3 host 172.22.242.23 eq 80
Deny other hosts access to the Finance Web Server via web
Corp1(config)#access-list 100 deny tcp any host 172.22.242.23 eq 80
All other traffic is permitted
Corp1(config)#access-list 100 permit ip any any
Apply this access-list to Fa0/1 interface (outbound direction)
Corp1(config)#interface fa0/1
Corp1(config-if)#ip access-group 100 out
Notice: We have to apply the access-list to Fa0/1 interface (not Fa0/0 interface) so that the access-list can filter traffic coming from both the LAN and the Core networks. If we apply access list to the inbound interface we can only filter traffic from the LAN network.
In the real exam, just click on host C and open its web browser. In the address box type http://172.22.242.23 to check if you are allowed to access Finance Web Server or not. If your configuration is correct then you can access it.
Click on other hosts (A, B and D) and check to make sure you can’t access Finance Web Server from these hosts.
Finally, save the configuration
Corp1(config-if)#end
Corp1#copy running-config startup-config
(This configuration only prevents hosts from accessing Finance Web Server via web but if this server supports other traffic – like FTP, SMTP… then other hosts can access it, too.)
Notice: In the real exam, you might be asked to allow other host (A, B or D) to access the Finance Web Server so please read the requirement carefully.
Some modifications:
Modification 1:
| permit host B from accessing finance server | access-list 100 permit ip host 192.168.33.2 host 172.22.242.23 |
| deny host B from accessing other servers (not the whole network) | access-list 100 deny ip host 192.168.33.2 172.22.242.16 0.0.0.15 |
| permit everything else | access-list 100 permit ip any any |
Modification 2:
| Only allow Host C to to access the financial server | access-list 100 permit ip host 192.168.33.3 host 172.22.242.23 |
| Not allow anyone else in any way communicate with the financial server | access-list 100 deny ip any host 172.22.242.23 |
| Allow all other traffic | access-list 100 permit ip any any |
Modification 3:
| - Host C should be able to use a web browser(HTTP)to access the Finance Web Server | access-list 100 permit tcp host 192.168.33.3 host 172.22.242.23 eq 80 |
| - Other types of access from host C to the Finance Web Server should be blocked - All access from hosts in the Core or local LAN to the Finance Web Server should be blocked |
access-list 100 deny ip any host 172.22.242.23 (because the requirement says we can not use more than 3 statements so we have to use “any” here for the hosts in the Core and hosts in local LAN) |
| - All hosts in the Core and local LAN should be able to access the Public Web Server * | access-list 100 permit ip any host (If the question asks this, surely it has to give you the IP of Public Web Server) but in the exam you should use “access-list 100 permit ip any any” |
Modification 4:
| Host C should be able to use a web browser to access the financial web server | access-list 100 permit tcp host 192.168.33.3 host 172.22.242.23 eq 80 |
| Other types of access from host C to the finance web server should be blocked | access-list 100 deny ip host 192.168.33.3 host 172.22.242.23 |
| All hosts in the core and on the local LAN should be able to access the Public web server * | access-list 100 permit ip any host (The IP of Public Web Server will surely be given in this question) but in the exam you should use “access-list 100 permit ip any any” |
* There are some reports about the command of “All hosts in the core and on the local LAN should be able to access the Public web server” saying that the correct command should be “access-list 100 permit ip any any”, not “access-list 100 permit ip any host (IP of Public Web Server)”. Although I believe the second command is better but maybe you should use the first command “access-list 100 permit ip any any” instead as some reports said they got 100% when using this command (even if the question gives you the IP address of Public Web Server). It is a bug in this sim.
(Note: Don’t forget to apply this access list to the suitable interface or you will lose points
interface fa0/1
ip access-group 100 out
And in the exam, they may slightly change the requirements, for example host A, host B instead of host C… so make sure you read the requirement carefully and use the access-list correctly)
I created this sim in Packet Tracer v5.2.1 so you can practice with it. You will need new version of Packet Tracer to open it (v5.1+).
Download this sim here
Notice: After typing the commands above, if you make a “ping” from other hosts (PC0, PC1, PC3) then PC4 (Finance Web Server) can still reply because we just filter HTTP traffic, not ICMP traffic. To generate HTTP traffic, select “Web Browser” in the “Desktop” tab of these PCs. When a web browser opens, type the IP address of Finance Web Server and you can see how traffic flows in Simulation Mode.
And notice that in the initial configuration of this sim the Core network can ping Finance Web Server. We have to create an access-list that can filter this traffic too.
Other lab-sims on this site:
Hi, could somebody please send me VCE player v1.3.0 or higher to grandeurxg@gmail.com ? Thank you !!
in mod 4 in the last term which command i should use “access-list 100 deny ip any host 172.22.242.17″ or “access-list 100 deny ip any any ” ?
ooooh sorrry this the correct Q ::: in mod 4 in the last term which command i should use “access-list 100 permit ip any host 172.22.242.17″ or “access-list 100 permit ip any any ” ?
i opserved that if i use “access-list 100 permit ip any any ” any host can access finance
throw web not only host B but if use “access-list 100 permit ip any host 172.22.242.17″ the only host C authorize to access finance throw web
I couldn’t able to deny host B from accessing other servers (not the whole network). Please anyone help me
to Dragon: thanks a lot now i get it :-) so sorry for the bother :-p anyway one more clarification hope you don’t mind :-)…….. about the interface where to apply the access list out bound.. is it always on interface fa0/1 or anywhere as long as it gives the ip add of the server? kinda confuse because of the different modifications :-(
its official. i am CCNA. 958/1000 Thanks 9tut. U guys rock!
over to CCNP!
ahmdllah i cleared thw exaaaaaaaaaaam with degree 972 very very very easy jsut relax
refrence : watson 314 + 9tut(new QS and (eigrb , acl,acl2 )) >> all the best for all
this lab was there
vivan >> do u have the matrial of ccnb ??
I can’t understand the difference between ACL1 and ACL2, are they both simulations? or only one is a simulation?
I think ACL1 is the sim where you just do show commands and answer multiple questions and ACL2 is this sim. :-)
please all, is time enough to do all the questions or what strategy should i use to make sure time doesn’t squeeze me so much
arthur >> just do it relax dont wory there is enogh time to do every thing just realx when u in exam
Alhamdllah I just passed my Exam 15/4/2015 with Score 917 all Question from 9tuuuuut and dump watson
for labs Acl1 , Acl 2 and EIGRP
note :- just review notification in ACL Sim 2
modification 3 was in my exam
i can not understand the differance b/w Acl mod#3 And mod # 4 plz help me
@abbasi
mod 3: you must deny all network
mod 4: you must deny only single host which is host c
Can someone please send me the Watson dump. Please send to lovinglonnie@gmail.com
hei do any one know if the is issue the exam centre keyboard i gues i fail becouse keyboard. i was doing access-list sim2 lab and i enter conf t access-list 101 permit tcp host 192.168.33.3 host 172.22.242.23 eq 80 and it coud not execp my configuration and i try severaly time and it did not except .so do any had some issue before and where can contact inorder to complain
passed my exam today 972/1000, ACL 2 mod 3
Hello friends, please do me a favor of sending latest valid dumps on ajinkshirsat@gmail.com plz plz it will be very helpful ! thanx
hey guys can anybody please….. send me latest dumps on suyashc.15@gmail.com
You people requesting dumps, go download them from http://www.examcollection.com/200-120.html . Register for free account, and download the dumps you want.
passed 16/4/2015 score 1000/1000
konrad (338 questions)dump is 100% valid
labs : ACL 1&2 , EIGRP 212 ( 122 in the exam)
note : they asked me to deny all other connection from the host C ( D in the exam ) to the finance web server so you may have to change the deny command in the access list to
from (access-list 100 deny tcp any host 172.22.242.23 eq 80) to (access-list 100 deny ip any host 172.22.242.23 )
i did this and i got 1000/1000
good luck .
Thanks 9tut. Finally a CCNA. This question was there on 17th.
Thanks guys, @ Omar, and whoever can help me, how will you know what you need to use in EIGRP either is 212 or 122, or anything else. any buddy out there who can help me to understand this ?
In the exam can i assign the ‘access-group 100′ for interface 0/0
eg:int fa0/0
ip access-group 100 in
OMar please can u send dump?
judsoncapepa20@hotmail.com
Nadith ,, fa0/0
ip access-group 100 in. its wrong . because it can’t filter core router . so ip access-group 100 out . its correct
Could someone pls send latest dumps to pclontz@yahoo.com?
hey guys, passed CCNA R&W on 17/04/15.
preparing for CCNA Wireless and Security next. if anyone has study material for it, please let me know.
raffaynadeem@hotmail.com
Hi Everyone;
Actually I have downloaded latest dumps from http://www.examcollection.com but there is problem with VCE simulator. It does not support or compatible with latest dumps version. Could anybody have VCE latest setup. Please share with me. Your help will be appreciated.
I have the working vce.along with the examtut dumps(278 questions) from the examcollection.which works on it.I paid for it..so if u want the vce and the dumps then u have to pay a nominal fee.contact me.
email:safridi1993@yahoo.com
hey guys ,
I have passed my ccna exams with 1000/1000. All questions were from 9tut ..dumps are 100% valid on 9tut…
Lab: ACL Sim 1 &2 and eigrp 212…remember in my eigrp question it was eigrp 12 which I had to configure and that too on the router which was on the right side in the topology…so pls read the name of the router carefully… Thanks to 9tut…
Passed today with 972/1000 ..
Refer 9 tut its enough …..
Had Acl1 Acl2 and EIGRP 212 SIM …. Router names will be changed and IPs will be changed ..
There were some modifications in ACL2 as u can see above in Modification 3 ….
Hello.
Passed today 22/04/2015. All questions were here on 9tut. No other dumps needed.
Lab: ACL Sim 1&2, EIGRP 112 (just AS is different). Thanks to 9tut. Cheers.
I have passed the exam on 18 April. I’ve got this simulation on my exam with Some modification: Host D should be able to use a web browser(HTTP)to access the Finance Web Server, All others part of this question same as Modification 3. Other two simulation was ACL1 and EIGRP AS 2. All the question came from 9tut. I got 1000/1000.
this one came .. today i pass it
Can anyone please help me with the last version of the VCE Simulator? I can´t open many VCE files with the version that I have. Please my e-mail is cliche0025@gmail.com. Thanks.
pls can someone email me vce the latest one i want to do my exams tomorrow roselinekn@yahoo.com
Passed today 23/04/2015. in Paris Lab: ACL Sim 1&2, EIGRP 22
Alhamdulillah passed my CCNA Exam 21/04/2015 acl1 acl 2 with modification 3 host B instead of host c hosts and server IP change and EIGRP 221 little tricky….
Hey… I read here acl2 with modification 3.. what does that mean? Please explain that guys.
“access-list 1 permit 192.168.100.16 0.0.0.15″
can any one explain this cording.. how they get “192.168.100.16″?????
hey adnana…
what is acl 2 with modification 3
hey Adnan
what is acl 2 with modification 3
hey john
modification # 3 host c access web browser of finance server and host c
can not ping to finance server
Hi, could somebody please send me VCE player v1.3.0 or higher to wahid.engr@gmail.com ? Thank you
Thank you so much abbasi. One more question for all of you guys.. in the exam.. do u have to do the lab on packet tracer? or u choose right answer as well?