Task 1:
For reference information on configuring hostnames, please refer to:
Lab 21 Configuration and Verification Task 1
Lab 35 Configuration and Verification Task 1
Task 2:
R1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#int s0/0
R1(config-if)#no shutdown
R1(config-if)#clock rate 768000
R1(config-if)#ip add 172.16.1.2 255.255.255.192
R1(config-if)#end
R1#
R3#config term
Enter configuration commands, one per line. End with CNTL/Z.
R3(config)#int s0/1
R3(config-if)#ip address 172.16.1.2 255.255.255.192
R3(config-if)#no shut
R3(config-if)#end
R3#
R1#ping 172.16.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R1#
R3#ping 172.16.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R3#
R1#config t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#ip route 0.0.0.0 0.0.0.0 serial0/0 172.16.1.2
R1(config-if)#end
R1#
R3#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R3(config)#ip route 0.0.0.0 0.0.0.0 serial0/0 172.16.1.1
R3(config)#int loo 10
R3(config-if)#ip address 10.10.10.3 255.255.255.128
R3(config-if)#exit
R3(config)#int loo 20
R3(config-if)#ip address 10.20.20.3 255.255.255.240
R3(config-if)#exit
R3(config)#int loo 30
R3(config-if)#ip address 10.30.30.3 255.255.255.248
R3(config-if)#end
R3#
Task 3:
R3#ping 172.16.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/5/8 ms
R3#ping 172.16.1.1 source loopback10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
Packet sent with a source address of 10.10.10.3
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/6/8 ms
R3#ping 172.16.1.1 source loopback20
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
Packet sent with a source address of 10.20.20.3
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
R3#ping 172.16.1.1 source loopback30
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
Packet sent with a source address of 10.30.30.3
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
Task 4:
R1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#access-list 10 remark ‘Permit From R3 Loopback10’
R1(config)#access-list 10 permit 10.10.10.0 0.0.0.127
R1(config)#access-list 10 remark ‘Deny From R3 Loopback20’
R1(config)#access-list 10 deny 10.20.20.0 0.0.0.15
R1(config)#access-list 10 remark ‘Permit From R3 Loopback30’
R1(config)#access-list 10 permit 10.30.30.0 0.0.0.7
R1(config)#int s0/0
R1(config-if)#ip access-group 10 in
R1(config)#end
R1#
R1#show ip access-lists
Standard IP access list 10
10 permit 10.10.10.0, wildcard bits 0.0.0.127
20 deny 10.20.20.0, wildcard bits 0.0.0.15
30 permit 10.30.30.0, wildcard bits 0.0.0.7
| NOTE: The wildcard masks uses in ACLs are configured in the same way as those for EIGRP and OSPF. To determine the wildcard mask, you can simply subtract the network mask for the network on which you want to match with the ACL from the Broadcast mask. This concept is illustrated in the subtraction table shown below:
In our example, the subnet mask of the 10.10.10.0/25 subnet is 255.255.255.128. If this is subtracted from the Broadcast mask of 255.255.255.255 the result is 0.0.0.127, which is the wildcard mask we use to use in the ACL match for this subnet. Using the same concept, the subnet mask of the10.20.20.0/28 subnet is 255.255.255.240. If we use the above table to determine the wildcard mask, we would get the following:
And finally, the subnet mask of the 10.30.30.0/29 subnet is 255.255.255.248. If we used the same table to get the wildcard mask, we would end up with the following:
It is extremely important to practice creating wildcards for ACLs. Take time out to practice these until you are extremely comfortable with them. ACLs are a very important part of the CCNA certification and in the real world.
While it is not mandatory, I prefer to use the access-list [number] remark [description] statement so that I know which ACL line is matching what. This makes it easier for you. You may or may not want to do so, but I feel that is it good practice to do so. Do whatever you feel comfortable doing.
|
R3#ping 172.16.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
U.U.U
Success rate is 0 percent (0/5)
R3#ping 172.16.1.1 source loopback10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
Packet sent with a source address of 10.10.10.3
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R3#ping 172.16.1.1 source loopback20
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
Packet sent with a source address of 10.20.20.3
U.U.U
Success rate is 0 percent (0/5)
R3#ping 172.16.1.1 source loopback30
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
Packet sent with a source address of 10.30.30.3
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
| NOTE: Whenever you see a ping fail and the router shows U.U.U it is typically because your ping request was administratively prohibited by an ACL on the other end.
The second lesson to be learned in this exercise is that even though our ACL configuration focused on R3 Loopback10, Loopback20, and Loopback30, because we did not explicitly allow the Serial0/0 subnet between R1 and R3, this is implicitly denied at the end of the ACL. Keep this in mind, i.e. if traffic is not explicitly permitted, it is implicitly denied. It is very important to understand this aspect in regards to Access Control Lists. The explicitly configured statements show as matches against ACL entries, but implicit deny matches do not.
R1#show access-lists Standard IP access list 10 10 permit 10.10.10.0, wildcard bits 0.0.0.127 (15 matches) 20 deny 10.20.20.0, wildcard bits 0.0.0.15 (11 matches) 30 permit 10.30.30.0, wildcard bits 0.0.0.7 (15 matches) |