Lab 61:
Restricting Inbound Telnet Access using Extended ACLs
Lab Objective:
The objective of this lab exercise is for you to learn and understand how to create and apply extended Access Control Lists to restrict Telnet access to a router or switch.
Lab Purpose:
Configuring and applying extended ACLs to restrict Telnet access is a fundamental skill. Extended ACLs filter based on source and destination address, as well as Layer 4 protocols TCP and UDP. Extended ACLs and should be applied as close to the source as possible. As a Cisco engineer, as well as in the Cisco CCNA exam, you will be expected to know how to restrict inbound Telnet traffic to the router or switch using ACLs.
Certification Level:
This lab is suitable for CCNA certification exam preparation
Lab Difficulty:
This lab has a difficulty rating of 8/10
Readiness Assessment:
When you are ready for your certification exam, you should complete this lab in no more than 20 minutes
Lab Topology:
Please use the following topology to complete this lab exercise:
Task 1:
Configure the hostnames on routers R1 and R3 as illustrated in the topology.
Task 2:
Configure R1 S0/0 which is a DCE to provide a clock rate of 2Mbps to R3. Configure the IP addresses on the Serial interfaces of R1 and R3 as illustrated in the topology.
Task 3:
Configure a static default route on R1 pointing to R3 over the Serial connection between the two routers. Next, configure the Loopback interfaces specified in the diagram on R3. Finally, configure R1 to allow Telnet sessions. Use a password of CISCO for Telnet login.
Task 4:
To test connectivity, ping R1 from R3 Loopback10, Loopback20 and Loopback30 interfaces.
Task 5:
Create an extended named ACL called TELNET-IN on R1. This ACL should permit Telnet traffic from host 10.10.10.3 to any IP address on R1; deny Telnet from host 10.20.20.3 to any IP address on R1; permit Telnet from host 10.30.30.3 to any IP address on R1. Apply this ACL to the Telnet lines on R1 for inbound traffic.
Task 6:
To test your ACL configuration, Telnet to R1 from R3 Loopback10, Loopback20, and Loopback30 interfaces using the telnet <ip_address> /source-interface <interface> command. If your ACL configuration is correct, only Telnet from R3 Loopback10 and Loopback20 should work. Verify matches against your ACL.