Lab: standard and extended access control lists

Aim and what you need

The aim is to turn a written policy into ACL lines, apply them in the right place and direction, and prove they work with hit counters. The policy for this lab is:

1. Only the STAFF network may open SSH sessions to the router.
2. STUDENTS may reach the web server 192.168.30.10 on TCP 80 and 443 only, and nothing else in the SERVERS VLAN.
3. All other traffic between VLANs is allowed.

• The inter-VLAN routing lab extended with a third VLAN (30, SERVERS) and subinterface g0/0.30 at 192.168.30.1.
• SSH already configured on R1 (as in the switch SSH lab).

Design

Every ACL ends with an invisible implicit deny: anything not permitted is dropped. Lines are checked top to bottom and the first match wins, so put specific lines before general ones.

Steps

1. Write the policy as lines on paper first, including what must still be allowed.
2. Create the standard ACL for management and apply it to the VTY lines with access-class.
3. Create the extended ACL and apply it inbound on the STUDENTS subinterface, close to the source.
4. Test allowed and denied traffic, then read the counters.

ip access-list standard MGMT-SSH
 remark Only STAFF may manage R1
 permit 192.168.10.0 0.0.0.255
 deny any log
line vty 0 15
 access-class MGMT-SSH in
exit
ip access-list extended STUDENTS-IN
 remark Students: web only to the server VLAN
 permit tcp 192.168.20.0 0.0.0.255 host 192.168.30.10 eq 80
 permit tcp 192.168.20.0 0.0.0.255 host 192.168.30.10 eq 443
 deny ip 192.168.20.0 0.0.0.255 192.168.30.0 0.0.0.255 log
 permit ip any any
interface g0/0.20
 ip access-group STUDENTS-IN in
end

Check wildcard masks with the wildcard mask calculator and port numbers with the port lookup.

Verify

From a student PC, browse to http://192.168.30.10 (should work) and ping 192.168.30.10 (should fail). From a staff PC, SSH to R1 (should work); from a student PC, SSH to R1 (should be refused). Success also means the matching lines show increasing match counts.

show access-lists
show ip interface g0/0.20
show running-config | section line vty
clear access-list counters

ping 192.168.30.10
ssh -l admin 192.168.10.1

Troubleshooting and clean-up

• Everything from students is blocked: you forgot the final permit ip any any, so the implicit deny caught it.
• Nothing is blocked: the ACL is applied in the wrong direction or on the wrong subinterface. show ip interface shows what is applied.
• Return traffic fails: a basic ACL is stateless. If you filter in the other direction, allow replies (for example with the established keyword for TCP).
• Locked yourself out over SSH: on real kit, use reload in 10 before risky changes, and reload cancel once you have confirmed access.

To clean up, remove the bindings first (no ip access-group STUDENTS-IN in, no access-class MGMT-SSH in), then delete the lists. Named ACLs let you insert or remove single lines by sequence number, which is why most engineers prefer them at work.