Learning by Doing: CISCO Certified Network ... - SCN Research

Background:
We just learned about the standard, extended, and named access control lists (ACL’s) and
how they work. We were told that too many ACL’s effectively turn the router into a
firewall and severely degrades its overall performance. In fact routers and firewalls are
very close in construction…they just have slightly different operating systems. Plus they
cost about the same. Here is the front and rear views of a CISCO PIX Firewall.
“front view” of PIX 515
“rear view” of PIX 515
Not too different huh? In this lab you will learn about a fourth type of access control list
called a “reflexive” access control list. The reflexive access control list allows certain
information out of a router port with a time to live counter. If the requested information
returns before the timer expires then it is let back into that interface. Only information
that originates from that interface is therefore allowed out and back in. Kind of like
having a back stage pass huh? Take me to the green room! Typically firewalls allow
private addresses (and address translation) on an “inside” portion of a network—totally
shielded from the outside. Plus they have a “DMZ” zone which is not shielded from the
outside…we tend to put our pesky sales people who are only contract employees out
there. If you leap into the CISCO security certificate training then this lab provides a
nice transition into the PIX firewall course.
Step-By-Step Instructions:
1. Cable the lab as shown.
2. Set up the basics and interfaces for each router. Use EIGRP or RIP version 2 for
your routing protocol.
3. Put the IP addresses, masks, and gateways on the workstations.
4. Test ping from each workstation to the others. It should work just fine.
5. Let’s make an ACL to simulate a firewall:
BrFW(config)#access-list 1 permit 10.0.0.0 0.255.255.255
BrFW(config)#access-list 1 deny any
BrFW(config)#int e0/0
BrFW(config-if)#ip access-group 1 out
6. Test ping again. Workstation B and C should be able to ping each other but not to
A. Workstation A should not be able to get past any interface on its router
(request times out).
360