Learning by Doing: CISCO Certified Network ... - SCN Research

2. Test ping from each workstation to each other and to the loopback interface.
3. Write an extended ACL to deny icmp from 192.168.1.2 to everywhere. Step 1: create
the ACL:
gates(config)#access-list 138 deny icmp host 192.168.1.2 any
gates(config)#access-list 138 permit ip any any
Isn’t that weird how with extended ACL’s you have to use “ip any any” and with
standard ACL’s you only needed “ip any?”
4. Step 2: apply the ACL to an interface. Since this is an extended ACL it should be
placed nearest the source as possible using “in.”
gates(config)#int e0/0
gates(config-if)#ip access-group 138 in
5. From 192.168.1.2 try to ping 192.168.3.3. It should not work and be unreachable:
C:\WINDOWS\Desktop>ping 192.168.3.3
Pinging 192.168.3.3 with 32 bytes of data:
Reply from 192.168.1.1: Destination net unreachable.
Reply from 192.168.1.1: Destination net unreachable.
Reply from 192.168.1.1: Destination net unreachable.
Reply from 192.168.1.1: Destination net unreachable.
Ping statistics for 192.168.3.3:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
C:\WINDOWS\Desktop>
6. Try to ping from 192.168.1.2 to 192.168.3.2 and 172.16.1.1…both will not work.
7. Let’s assume this person will need to be able to ping to 172.16.1.1 but not to
192.168.3.0. So let’s modify our ACL a bit:
gates(config)#no access-list 138
**(you can see where a text editor would be helpful right?)
gates(config)#access-list 138 deny icmp host 192.168.1.2 192.168.3.0
0.0.0.255
gates(config)#access-list 138 permit icmp any any
Let’s look at our statement. We set up ACL 138 to deny ICMP from (source) host
192.168.1.2 to (dest) 192.168.3.0 (network) with a wildcard mask to match the
network 0.0.0.255.
348