Learning by Doing: CISCO Certified Network ... - SCN Research

8. Now let’s try the show access lists again:
gates#sh access-list
Extended IP access list 138
deny icmp host 192.168.1.2 192.168.3.0 0.0.0.255 (14 matches)
permit icmp any any (4 matches)
gates#
Aha! With extended ACL’s we can see the number of matches (or attempts) to get
through our little router “mini-firewall.” We can even see from who it comes and
how many times an attempt was made. Hmmm…almost like a protocol inspector.
The debug ip packet details will show similar results.
9. Let’s add another ACL to stop 192.168.3.2 from telnetting to 172.16.1.1. But first
let’s try to telnet to be certain it works. If it works you should see:
10. Now let’s create the extended ACL:
gates(config)#access-list 150 deny tcp host 192.168.3.2 any eq 23
gates(config)#access-list 150 permit tcp any any
11. And apply it to the interface:
gates(config)#int e0/1
gates(config-if)#ip access-group 150 in
12. Now telnet should work on 192.168.3.3 but not on 192.168.3.2. You will see this
type of message if telnet is not working:
349