Free CCNA | Standard ACLs | Day 34 Lab | CCNA 200-301 Complete Course

Main Ideas / Lessons

• Goal of the lab: Configure OSPF to establish full IP connectivity, then use Standard ACLs (plus a small amount of OSPF setup) to restrict traffic based on source IP addresses.
• Key ACL concept (Standard ACLs):
  • Standard ACLs match traffic by source IP.
  • Actions are permit or deny (with an implicit deny at the end of ACLs).
  • Best practice: apply standard ACLs as close to the destination as possible (so filtering occurs near where traffic is headed).

---

Methodology / Steps From the Lab

Step 1 — Enable OSPF for Full Connectivity

Configure OSPF on R1 and R2 so routers can reach each other’s networks.

On R1

enable
conf t
router ospf 1
network 172.16.0.0 0.0.255.255 area 0
network 203.0.113.0 0.0.0.3 area 0

Verify:

• show ip ospf interface

On R2

enable
conf t
router ospf 1
network 192.168.0.0 0.0.255.255 area 0
network 203.0.113.0 0.0.0.3 area 0

Verify:

• show ip ospf interface
• show ip ospf neighbor
• show ip route

Outcome Asserted

• OSPF neighbors form (in full state on the serial link).
• Each router learns the other router’s routes and connectivity works.

---

Step 2 — Restrict Access Using Standard ACLs

The video describes four requirements, then demonstrates one ACL per requirement.

ACL Placement Principle

• Standard ACLs are applied near the destination networks they control.

---

Requirement 1 — Only Certain Hosts May Access 192.168.1.0/24

Configured on R2 using a standard named ACL.

On R2

ip access-list standard TO_192.168.1.0/24
permit 172.16.1.1
permit 172.16.2.1

Note: The lab relies on implicit deny, and it also mentions that adding deny any is considered good practice (though the shown config uses implicit deny).

Apply ACL to the interface (using access-group):

interface g0/0
ip access-group TO_192.168.1.0/24 out

Testing Demonstrated

• Ping to a server in 192.168.1.0/24:
  • PC1 succeeds
  • PC2 fails (unreachable message from R2)
  • PC3 succeeds
  • (PC4 would fail, per description)

---

Requirement 2 — Hosts in 172.16.2.0/24 Cannot Access 192.168.2.0/24

Configured on R2 using a standard named ACL.

On R2

ip access-list standard TO_192.168.2.0/24
deny 172.16.2.0 0.0.0.255
permit any

Apply ACL near the destination:

interface g0/1
ip access-group TO_192.168.2.0/24 out

Testing Demonstrated

• From PC1 → ping 192.168.2.100: works after ARP
• From PC3 → ping 192.168.2.100: fails

---

Requirement 3 — Prevent 172.16.1.0/24 and 172.16.2.0/24 from Communicating With Each Other’s Networks

Configured on R1 using numbered standard ACLs (ACLs 1 and 2).

ACL 1 (deny 172.16.1.0/24, permit all else)

access-list 1 deny 172.16.1.0 0.0.0.255
access-list 1 permit any

ACL 2 (deny 172.16.2.0/24, permit all else)

access-list 2 deny 172.16.2.0 0.0.0.255
access-list 2 permit any

Verify:

• show access-lists (to view match counters)

Apply ACLs to interfaces (standard ACL application uses access-group):

interface g0/1
ip access-group 1 out

• Blocks traffic from 172.16.1.0/24 toward 2.0/24

interface g0/0
ip access-group 2 out

• Blocks traffic from 172.16.2.0/24 toward 1.0/24

Testing Demonstrated

• Use continuous ping:
  • On PC1: ping -t 172.16.2.1 → cannot reach
  • On PC3: ping -t 172.16.1.1 → cannot reach
• Confirm counters increasing on R1:
  • show access-lists (deny entries match count increases)

---

Additional Demonstrated Command: Inspect ACL Match Counters

• show access-lists

Shows each ACL and how many packets matched each ACE (useful for verifying correct blocking).

---

Boson NetSim CCNA Lab Preview (ACL Practice)

• The instructor promotes Boson NetSim for CCNA and previews a lab:
  • Lab name shown: ACL practice lab 2: standard ACLs
  • Objective: practice configuring standard ACLs on Cisco routers

Topology Overview

• Router1 connects to Switch1 and PC1
• Router2 connects to Switch2 and Switch3 and PC2/PC3 in different VLANs (VLAN2 and VLAN3)
• Router2 uses router-on-a-stick for inter-VLAN routing
• Routers have loopback interfaces

Lab Tasks Mentioned (Key ACL Tasks)

Task 1

• Verify ping connectivity between PCs and router loopbacks

Task 3

• Verify Telnet access to Router1 loopback0 from PCs

Task 4 — Standard ACL1

• Create standard ACL1 to deny traffic from VLAN2 and VLAN3 to Router1 networks
• Uses numbered standard ACL syntax:

access-list 1 deny <VLAN2/VLAN3 source>
access-list 1 permit any

• Applies ACL to the correct Router1 interface/direction:
  • ip access-group 1 in on FastEthernet0/0 (as described)

Testing result (as described):

• Telnet/ping succeed from PC1, fail from PC2/PC3

Task 8 — Standard ACL2

• Create standard ACL2 to deny traffic from VLAN1, permitting all else
• Uses:

access-list 2 deny <VLAN1 source>
access-list 2 permit any

• Applies:
  • Outbound on a Router1 interface (FastEthernet1/0 in the narration) using ip access-group 2 out

Instructor explanation (security concept):

• Prevents “source-IP spoofing / pretending” to be on VLAN1, so traffic can’t enter VLAN1.

Completion Verification

• “Grade lab” indicates correct configuration (nothing highlighted).

---

Speakers / Sources Featured

• Jeremy (Jeremy’s IT Lab) — primary speaker/instructor (autogenerated subtitles refer to “Jeremy’s IT Lab”).
• Boson NetSim — referenced as the source of the lab environment and guided practice.
• JCNP-level channel members — thanked by name (supportive channel members), including:
  • Junhong, OJ, Magrathea, TheGunguy, l33america, Njabulo, Benjamin, Tshepiso, Justin, Prakaash, Nasir, Erlison, Apogee, Marko, Flodo, Daming, Joshua, Jhilmar, Ed, Value, John, Funnydart, Scott, Hassan, Marek, Velvijaykum, C Mohd, Mark, Yousif, Sidi, Boson Software, Devin, Lito, Yonatan, Vance.