Packet Tracer Configure Extended Acls Scenario 1

Packet Tracer Configure Extended ACLs Scenario 1

Introduction

Extended Access Control Lists (ACLs) in Cisco Packet Tracer are critical tools for securing network traffic by filtering packets based on specific criteria such as source and destination IP addresses, port numbers, and protocols. In Packet Tracer Configure Extended ACLs Scenario 1, learners typically set up a basic network topology and apply ACLs to control access between different network segments. This article provides a step-by-step guide, scientific explanation, and practical tips to help you master this essential networking skill Took long enough..

Scenario Overview

Imagine a small office network with the following components:

• Router connected to the internet (ISP)
• Switch connecting multiple devices (PCs, servers)
• Two departments: Sales (192.168.10.0/24) and HR (192.168.20.0/24)
• Goal: Restrict HR from accessing the Sales department’s file server (192.168.10.10), while allowing Sales full access to HR resources.

This scenario demonstrates how extended ACLs enforce granular security policies in real-world networks.

Step-by-Step Configuration Guide

Step 1: Create the Network Topology

1. Open Cisco Packet Tracer and create a new workspace.
2. Place a Router (e.g., ISR 4000) and a Switch (e.g., Catalyst 2960).
3. Connect the Router’s GigabitEthernet0/0 interface to the Switch using a crossover cable.
4. Add two PCs (PC0 and PC1) to the Switch. Assign static IP addresses:
   • PC0: IP = 192.168.10.2, Subnet Mask = 255.255.255.0 (Sales)
   • PC1: IP = 192.168.20.2, Subnet Mask = 255.255.255.0 (HR)
5. Add a server (e.g., File Server) to the Sales network (192.168.10.10).

Step 2: Configure Router Interfaces

1. Click the Router and go to the CLI tab.
2. Enter enable mode and configure the interfaces:

   Router> enable  
   Router# configure terminal  
   Router(config)# interface gigabitethernet0/0  
   Router(config-if)# ip address 192.168.10.1 255.255.255.0  
   Router(config-if)# no shutdown  
   Router(config-if)# exit  
   Router(config)# interface gigabitethernet0/1  
   Router(config-if)# ip address 192.168.20.1 255.255.255.0  
   Router(config-if)# no shutdown  
   

   • G0/0 handles the Sales network (192.168.10.0/24).
   • G0/1 handles the HR network (192.168.20.0/24).

Step 3: Create the Extended ACL

1. From the Router’s CLI, create an extended ACL named SALES_ACCESS:

   Router(config)# access-list 100 permit ip 192.168.20.0 0.0.0.255 host 192.168.10.10 eq 80  
   Router(config)# access-list 100 deny ip 192.168.20.0 0.0.0.255 host 192.168.10.10 any  
   Router(config)# access-list 100 permit ip any any  
   

   • Rule 1: Allow HR (192.168.20.0/24) to access the Sales server (192.168.10.10) on HTTP (port 80).
   • Rule 2: Deny all other HR traffic to the Sales network.
   • Rule 3: Permit all remaining traffic (implicit allow for Sales to HR).

Step 4: Apply the ACL to the Interface

1. Apply the ACL to the inside interface (G0/1, connected to HR):

   Router(config)# interface gigabitethernet0/1  
   Router(config-if)# ip access-group 100 in  
   

   • The “in”