Topology
Purpose
Learn how to configure an extended ACL.
Walkthrough
- Configure the network above. Add a static route on Router B so any traffic for any network leaves the Serial interface. You are doing this because, though not a routing lab, you still need the traffic to route.
RouterB(config)#ip route 0.0.0.0 0.0.0.0 s0/1/0
- Add an extended ACL to Router A. Permit Telnet traffic to your Loopback interface only. Remember to permit Telnet also.
RouterA(config)#access-list 100 permit tcp any host 172.20.1.1 eq 23
RouterA(config)#int s0/1/0
RouterA(config-if)#ip access-group 100 in
RouterA(config-if)#line vty 0 15
RouterA(config-line)#password cisco
RouterA(config-line)#login
RouterA(config-line)#^Z
RouterA#
The ACL line above is number 100, which tells the router it is extended. What you want to allow uses TCP. It is allowing TCP from any network destined for host 172.20.1.1 on the Telnet port, which is 23. When you issue a show run command, the router actually replaces the port number with the name, as illustrated below:
access-list 100 permit tcp any host 172.20.1.1 eq telnet
- Now test a Telnet from Router B. First, Telnet to the Serial interface on Router A, which should be blocked. Then test the Loopback interface.
RouterB#telnet 10.0.0.1
Trying 10.0.0.1 …
% Connection timed out; remote host not responding
RouterB#telnet 172.20.1.1
Trying 172.20.1.1 …Open
User Access Verification
Password: ←password won’t show when you type it
RouterA> ←Hit Control+Shift+6 together and then let go and press the X key to quit.
Note: We will be covering ACLs in other labs, but you really need to know these cold. For this reason, try other TCP ports, such as 80, 25, etc. In addition, try UDP ports, such as 53. You won’t be able to test them easily without a PC attached to Router B.
Going further, mix up the IP addresses, permitting Telnet (in this example) to the Serial interface but not the Loopback interface. Then put an ACL on Router B instead. I can’t over-emphasise how important this is. If you need to wipe the ACL, you can simply type the following:
RouterA(config)#no access-list 100