FREE CCNA Lab 031: Named ACLs (Access Control Lists Part 3)

[@JeremysITLab]

I hope you're enjoying the labs! If you want another great set of FREE packet tracer labs for the CCNA, check out Neil Anderson's lab guide here: jeremysitlab.com/ccna-lab-guide

[@glenntembo2693]

Thanks for the three parts . The distinguishing is brilliant == all practice now, Good day

[@JeremysITLab]

Good luck with your practice!

[@MrBh4life]

Thank you very much for your practice labs, they are amazing! I do have a question. If you make a standard acl and set it as out going on a interface, does it also block in coming on that acl? And am I correct to say that if you make one deny acl on f1/0 for 192.168.2.0 0.0.0.255 inbound, you have met all the requirements?

[@JeremysITLab]

Hey Victor! If you set an ACL as outgoing, it won't block incoming traffic on that interface. You are correct, that will meet the requirements. That's fine for this lab, but in a real network these routers would probably be connected to the Internet, and that ACL would prevent hosts in 192.168.2.0/24 from reaching anywhere outside of their LAN. But as far as this lab goes, that's no problem!

[@KunalShah-uh6zl]

Hi Jeremy. The labs are too good. It is really helping me revise my previous hands-on knowledge. I have a question about the ACL labs and previous RIP labs as well, for example to configure the whole network in a way that all desired PCs ping each other and the ones that we don't want, they wont ping, for that we apply the concepts of RIP and ACL (S/E), but do we use the commands that we used in labs 1- 20 OR are the concepts of RIP/ACL are enough for the desired connections to work?

[@JeremysITLab]

It depends on the situation. For example, for PCs to ping each other you'd use RIP to routers can learn the routes. But you'd also want to configure SSH (Lab 23) so you can connect to the routers and configure them without having to be right next to them with a console cable. Different networks need and use different features.

[@dantecarrasco9304]

For whatever reason, I'm having a lot of trouble with ACL's. For this one, I followed along closely, but instead of host 3/4 getting "Destination is unreachable" for the two servers, I get "Request timed out." instead.

[@BijouBakson]

i have a question Jeremy - I noticed that once a computer has been denied access to another computer, the receiving end is also denied access to the source. In our case, the servers wouldn't access the computers that where not permitted to access them. Is the access list denial/permission 2-way then? Thanks

[@JeremysITLab]

The access-list denial/permission only works 1-way, however since communication is usually two-way, blocking one-way effectively cuts off all communication between the hosts.. For example, if PCA is blocked from sending traffic to PCB, PCB can still send a ping request to PCA, but PCA can't send the ping reply back to PCB, so the ping will fail.

[@BijouBakson]

@@JeremysITLab O that makes sense now. So the ping fail simply because PCb cannot reply. I should have understood that stupid. That clear things out so much. Oopf! I was waiting on this reply. Thank you Jeremy.

[@sadiafarzana3732]

hi jeremy what i don't understand is why do we need a out command 'acces-group 2to3 out' for example even after we denied the specific address ? could u plz explain that

[@JeremysITLab]

ACLs don't have any effect if you don't apply them anywhere.

[@turalrustamli347]

HI sir, for the second requirements can we use 192.168.3.0 instead of 192.168.2.0? like below ip access-list standard 2to3 deny 192.168.3.0 0.0.0.255 permit any

[@JeremysITLab]

Where will you apply the ACL?

[@turalrustamli347]

@@JeremysITLab int s2/0 ip access-group 2to3 in like this.is it possible?