First, the essential ideas
- Extended ACL
- An extended access control list matches a protocol plus source and destination addresses. TCP and UDP entries can also match ports. All fields specified in one entry must match.
- TCP and port
- Transmission Control Protocol provides a reliable byte stream. A port identifies a transport endpoint. The lab server listens on destination TCP port 8080; the client normally chooses a different temporary source port.
- ICMP and ping
- Internet Control Message Protocol carries control and error messages. Ping uses echo messages, not TCP port 8080, so ping and a web request can have different filtering outcomes.
- Stateless filter
- A basic extended ACL evaluates packets against entries without tracking an authenticated application session. The TCP established keyword tests certain flags; it is not a stateful firewall.
- HTTP and curl
- HTTP is an application request-and-response protocol. curl is a command-line client. This lab uses unencrypted HTTP only on an isolated synthetic network with no sensitive files.
- First match and direction
- The first matching ACL entry decides the action; unmatched IPv4 traffic is denied. Inbound means arriving on the specified router interface, not arriving at the final application.
- Console and shell
- A console opens a named device's text interface. IOS commands belong in R1; Ubuntu commands belong in that VM's Linux shell. sudo requests authorized local administrative privilege.
Write a packet as protocol, source address, source port, destination address and destination port. The service port belongs to the destination in the client's request. Reverse direction reverses these endpoint roles; never paste the same rule on both sides without reasoning.
See the idea
One host, two different tests
A TCP service can be permitted while ICMP echo is deliberately denied.
Match the service
The request from Client to Server uses destination TCP 8080. Every condition in the permit must match.
What this model leaves out: This compares rule conditions, not physical links or observed captures. HTTP is unencrypted only inside this disposable lab.
Full visual explanation and references
Comparison records show TCP 8080 allowed, ICMP denied and a wrong destination port that misses the permit.
This compares rule conditions, not physical links or observed captures. HTTP is unencrypted only inside this disposable lab.
- Match the service
The request from Client to Server uses destination TCP 8080. Every condition in the permit must match.
www.cisco.com - Keep the denied control
ICMP echo is not TCP. Its failure is expected while the web response remains available.
www.cisco.com - Repair the wrong field
A permit for 8081 misses requests to 8080. Restore the destination port, then repeat both tests.
www.cisco.com
One idea at a time
Start with something familiar.
Before touching a router, write a client request as TCP from 192.0.2.10 with a temporary source port to 198.51.100.10 port 8080. Mark the destination port. Now read the rule left to right and locate where eq 8080 belongs.
Why learn this?
Putting a port test beside the source address instead of the destination can block every normal client request. More detail in an ACL gives more control, but also creates more ways to express a policy different from the one intended.
An everyday comparison
Think of addressing a letter to a particular department at a street address. The address identifies the building, while the department selects where it should be delivered. This is only a memory aid for separate address and service fields.
What happens in a network
The server IP resembles the building address, and the destination TCP port resembles the department. The client has its own return address and temporary port for the reply.
Where the comparison stopsA port number does not authenticate the application, encrypt the payload or guarantee that the expected service is really running. A basic ACL only evaluates the fields it supports.
Follow one worked example
- Prove the server works before filtering.
Client curl receives an HTTP response from the isolated server; a baseline ping also works. The later denied ping can then be compared with this known start.
Why: A stopped server and a dropped TCP request can both look like a failed application test.
- Permit the complete request tuple.
The named entry permits TCP from the one client to the one server's destination port 8080. The next entry denies all other IPv4 traffic entering R1 from that client network.
Why: The policy must match the service field in its correct position and operate on the intended ingress interface.
- Change one field and retest precisely.
Replacing destination port 8080 with 8081 makes the real request miss the permit. Restore 8080 and verify HTTP succeeds while ping remains denied.
Why: The correct outcome is selective permission, not simply restoring every packet to an unrestricted state.
Your first small task
Compare permit tcp host 192.0.2.10 host 198.51.100.10 eq 8080 with permit tcp host 192.0.2.10 eq 8080 host 198.51.100.10. Decide which one matches a client request sourced from port 49152 and destined for 8080.
Show a hint
A port operator follows the endpoint whose port it tests. Read the address and its nearby operator as a pair.
Check the expected result
Only the first expression matches that request; the second requires source port 8080.
Pause and explain it in your own words
HTTP works but ping is denied after this policy. Is that automatically a fault?
Show a hint
Compare the intended protocol allowance with what ping actually sends.
Show the explanation
No. The intended policy permits TCP to destination 8080 and denies other IPv4 packets on this ingress path. ICMP echo does not match that permit. Record both results as selective behavior, not a general network outage.
Short answer
What should you understand today?
An extended IPv4 ACL can distinguish a service from other traffic between the same hosts. Specify protocol, source, destination and the correct port position, then verify the attached direction and both allowed and denied tests. A successful ping neither proves a TCP service is allowed nor proves the service is listening.
Before you begin
Learning targets
- Complete Day 49 source matching and first-match reasoning.
- Use GNS3 2.2, an entitled CSR1000v IOS XE 17.3 and two fresh Ubuntu 24.04 VMs.
- Install Python 3.12, curl, iproute2 and ping before disconnecting; use only synthetic data.
- Read source and destination port positions correctly in an extended entry.
- Build and verify named and numbered extended ACLs for one explicit service.
- Use a working application baseline and a denied protocol test together.
- Repair a destination-port fault and explain return-path and stateless-filter limitations.
Words you will meet
Open a word when you need its meaning. You do not need to memorize the whole list before reading.
Extended ACL
An extended access control list matches a protocol plus source and destination addresses. TCP and UDP entries can also match ports. All fields specified in one entry must match.
TCP and port
Transmission Control Protocol provides a reliable byte stream. A port identifies a transport endpoint. The lab server listens on destination TCP port 8080; the client normally chooses a different temporary source port.
ICMP and ping
Internet Control Message Protocol carries control and error messages. Ping uses echo messages, not TCP port 8080, so ping and a web request can have different filtering outcomes.
Stateless filter
A basic extended ACL evaluates packets against entries without tracking an authenticated application session. The TCP established keyword tests certain flags; it is not a stateful firewall.
HTTP and curl
HTTP is an application request-and-response protocol. curl is a command-line client. This lab uses unencrypted HTTP only on an isolated synthetic network with no sensitive files.
First match and direction
The first matching ACL entry decides the action; unmatched IPv4 traffic is denied. Inbound means arriving on the specified router interface, not arriving at the final application.
Console and shell
A console opens a named device's text interface. IOS commands belong in R1; Ubuntu commands belong in that VM's Linux shell. sudo requests authorized local administrative privilege.
Read an extended entry as a complete condition
An entry beginning permit tcp must match TCP as well as the source and destination conditions. A host keyword matches one address. The eq operator compares a port to one value; placed after the destination host, eq 8080 means destination TCP port 8080. Other protocol choices include udp, icmp and ip, where ip covers IPv4 rather than one application. A match still uses the first-entry rule learned in Day 49.
- Every specified field must match; one matching address is insufficient.
- Do not assume a client's temporary source port equals the server's listening port.
Design the allowed and denied matrix
Start with a small, explicit matrix: HTTP to server port 8080 allowed; ICMP echo to that server denied. This lab's deny ip any any intentionally rejects all remaining IPv4 input on the client-facing interface. A real deployment needs a broader requirements analysis including management, name resolution, control traffic and other applications. Do not transplant this educational policy into a production interface.
- A negative control needs a known working baseline to isolate the filter's effect.
- The lab does not infer IPv6 protection from an IPv4 ACL.
Placement changes the traffic under examination
Extended ACLs are often placed near the source to discard unwanted traffic before it consumes resources farther along the path. That is a starting heuristic, not a mandatory location. We use inbound on R1 GigabitEthernet1, directly facing the client. This attachment inspects client requests as they enter. The server response enters GigabitEthernet2 and leaves GigabitEthernet1, so it does not cross this one inbound list.
- Map both request and reply before adding a second attachment.
- Direct console management remains available even when this lab blocks network traffic.
Do not confuse flags with session validation
A traditional extended ACL is stateless. The TCP established keyword matches packets with ACK or RST set; it does not prove a valid authenticated conversation was established through the router. A port permit also cannot ensure that the process listening on that port is the desired application. Stateful inspection and application security are distinct topics and are not silently supplied by this exercise.
- A TCP port number is a selector, not an identity guarantee.
- Counters and flags need context rather than a blanket claim that traffic is trusted.
Change named and numbered policies deliberately
Named WEB-IN uses sequence entries; numbered extended lists use 100-199 or 2000-2699. The lab builds number 100 completely before replacing the attachment. Keep the same permit and explicit deny meanings and retest; the number is just an identifier, not the service port. For the wrong-port experiment, replace sequence 10 in the named list using an explicit removal followed by the new entry. The brief gap rejects requests under the final deny, so use only the isolated lab.
- Never remove a shared active list to experiment with syntax.
- Read back the final entry order and attachment before interpreting tests.
State the version and evidence boundary
This chapter supplies extended named and numbered configuration practice for v1.1 objective 5.6 and announced v2.0 objective 4.6. Day 49 covers the standard-list portion; neither chapter claims IPv6 filtering or a full security architecture. v1.1 remains current through 2 February 2027, with v2.0 from 3 February. Technical documentation supplies syntax and limits, while the learner must supply actual observations.
- Preserve actual failures instead of replacing them with the expected answer.
- Paper alternatives teach matching but cannot demonstrate configured hardware behavior.
Real-world walkthrough
The application is down, yet someone keeps testing ping
In a fictional help-desk case, a team added a service-specific ACL and now tests only ICMP echo. A blocked ping is reported as proof that the application is down, while the service itself has not been requested. Conversely, another team sees ping succeed before filtering and assumes TCP 8080 must work. Both reports substitute one protocol for another.
- Ask for the actual application endpoint, protocol and listening port, then write the complete request tuple.
- Confirm the server process and local response before treating a remote timeout as network filtering.
- Inspect the installed ACL and its attachment; distinguish source and destination port operators.
- Run the intended client request and the deliberately denied control test, preserving actual response text and counters.
- Repair only the documented mismatch, repeat both tests and state the limited result rather than declaring every service healthy.
Guided GNS3 lab
Permit TCP 8080 while denying ICMP on one ingress
Build a harmless isolated web service, apply an extended filter, break one port match and restore it. This is a reproducible instruction set with predicted observations, not a report of executed router or VM tests.
Addressing plan
| Device | Interface | Address | Purpose |
|---|---|---|---|
| Client | ens3 | 192.0.2.10/24; gateway 192.0.2.1 | Only permitted source for the web test. |
| R1 | GigabitEthernet1 | 192.0.2.1/24 | Inbound WEB-IN attachment. |
| R1 | GigabitEthernet2 | 198.51.100.1/24 | Server subnet gateway. |
| Server | ens3 | 198.51.100.10/24; gateway 198.51.100.1 | HTTP listening on TCP 8080 only. |
Set up the lab
- Use fresh VMs with only the named lab NIC and no preexisting routes or firewall rules blocking the baseline. Do not disable a production firewall.
- Inspect ip -br link on each VM and show ip interface brief on R1. Substitute actual labels consistently if ens3 or the router ports differ.
- Create an empty ~/ccna50-web directory in Server's file manager. Serve only that directory; never use a home directory containing private files.
- Keep Server's foreground HTTP process running in its console during tests. Use the GNS3 VM console rather than a remote SSH path.
- If the software or Cisco entitlement is unavailable, trace the tuple matrix on paper. An entitled CML router plus Linux hosts is a practical alternative with different port mappings.
Configure the routed link baseline
In GNS3, right-click R1 and choose Console before typing. Verify the release and cable labels before entering these commands on a fresh router. Both networks are directly connected; no NAT or static route is needed.
enable
configure terminal
interface GigabitEthernet1
ip address 192.0.2.1 255.255.255.0
no shutdown
interface GigabitEthernet2
ip address 198.51.100.1 255.255.255.0
no shutdown
end
show ip interface briefWhat each command means
enable- Enter privileged EXEC on this authorized lab device; stop if access is not authorized.
configure terminal- Enter global configuration from privileged EXEC; changes affect the active configuration.
interface GigabitEthernet1- Select the Client-facing routed port.
ip address 192.0.2.1 255.255.255.0- Assign the Client subnet gateway address.
no shutdown- Enable this isolated Client-facing port.
interface GigabitEthernet2- Select the Server-facing routed port.
ip address 198.51.100.1 255.255.255.0- Assign the Server subnet gateway address.
no shutdown- Enable the isolated Server-facing port.
end- Return to privileged EXEC without saving or undoing the accepted changes.
show ip interface brief- Check both addresses and link states before traffic tests.
- What you should see
- Expect two enabled routed interfaces with the planned addresses.
- Why this step matters
- An explicit routed baseline prevents a missing path from being mistaken for an ACL decision.
Address Server and start the harmless service
In GNS3, right-click Server and choose Console before typing. Use its Ubuntu shell, not IOS. Confirm ens3 is the mapped isolated NIC and ~/ccna50-web is empty. The last command stays in the foreground; leave this console open until cleanup.
sudo ip address add 198.51.100.10/24 dev ens3
sudo ip link set ens3 up
sudo ip route add default via 198.51.100.1
python3 -m http.server 8080 --bind 198.51.100.10 --directory ~/ccna50-webWhat each command means
sudo ip address add 198.51.100.10/24 dev ens3- Add Server's lab address to the verified data NIC.
sudo ip link set ens3 up- Enable the Server lab NIC.
sudo ip route add default via 198.51.100.1- Give Server a return route through R1.
python3 -m http.server 8080 --bind 198.51.100.10 --directory ~/ccna50-web- Serve only the empty lab directory on the lab address and TCP 8080.
- What you should see
- Expect the foreground server to report its listener; this is not a production-grade web service.
- Why this step matters
- Binding the service to a synthetic lab address and empty directory limits accidental exposure of data.
Establish Client's application and echo baseline
In GNS3, right-click Client and choose Console before typing. In the Ubuntu shell, address the isolated NIC and test both protocols. Stop if either baseline fails; record the actual HTTP status and ping results before introducing a filter.
sudo ip address add 192.0.2.10/24 dev ens3
sudo ip link set ens3 up
sudo ip route add default via 192.0.2.1
curl --max-time 5 -I http://198.51.100.10:8080/
ping -c 3 198.51.100.10What each command means
sudo ip address add 192.0.2.10/24 dev ens3- Assign the permitted Client source address.
sudo ip link set ens3 up- Enable Client's isolated NIC.
sudo ip route add default via 192.0.2.1- Set R1 as Client's default gateway.
curl --max-time 5 -I http://198.51.100.10:8080/- Request HTTP headers with a five-second maximum duration.
ping -c 3 198.51.100.10- Send three ICMP echo probes for the negative-control baseline.
- What you should see
- Expect an HTTP response and echo replies before filtering; exact timing is unmeasured.
- Why this step matters
- A working service and working ICMP baseline make later selective failures interpretable.
Install the named extended ingress filter
In GNS3, right-click R1 and choose Console before typing. Create the entire WEB-IN list, then apply it inbound on the Client-facing port. This intentionally denies all other IPv4 traffic arriving there, so it belongs only in the disconnected exercise.
configure terminal
ip access-list extended WEB-IN
10 permit tcp host 192.0.2.10 host 198.51.100.10 eq 8080
20 deny ip any any
exit
interface GigabitEthernet1
ip access-group WEB-IN in
end
show ip interface GigabitEthernet1What each command means
configure terminal- Enter global configuration from privileged EXEC; changes affect the active configuration.
ip access-list extended WEB-IN- Create the named extended IPv4 list.
10 permit tcp host 192.0.2.10 host 198.51.100.10 eq 8080- Permit the exact Client-to-Server TCP destination service.
20 deny ip any any- Deny remaining IPv4 input explicitly for visible counters.
exit- Return from ACL mode to global configuration.
interface GigabitEthernet1- Select the interface where Client requests enter R1.
ip access-group WEB-IN in- Attach WEB-IN to this inbound direction.
end- Return to privileged EXEC without saving or undoing the accepted changes.
show ip interface GigabitEthernet1- Verify the installed inbound list name.
- What you should see
- Expect WEB-IN inbound on GigabitEthernet1 with the intended two entries.
- Why this step matters
- Matching fields and attachment jointly determine which traffic is examined.
Test selective access
In GNS3, right-click Client and choose Console before typing. Repeat the exact two baseline tests. An HTTP response together with denied ping is the intended result, not evidence that the network is partly broken.
curl --max-time 5 -I http://198.51.100.10:8080/
ping -c 3 198.51.100.10What each command means
curl --max-time 5 -I http://198.51.100.10:8080/- Retest the allowed service using the same Client and URL.
ping -c 3 198.51.100.10- Retest ICMP, which does not match the TCP permit.
- What you should see
- Expect HTTP response and no echo replies; preserve the actual messages.
- Why this step matters
- The required result includes a working permitted service and a rejected previously working protocol.
Record evidence and change only the port
In GNS3, right-click R1 and choose Console before typing. Record counters, then replace sequence 10 with the wrong destination port 8081. Keep the explicit deny and the attachment unchanged; do not save this deliberately faulty state.
show access-lists WEB-IN
configure terminal
ip access-list extended WEB-IN
no 10
10 permit tcp host 192.0.2.10 host 198.51.100.10 eq 8081
endWhat each command means
show access-lists WEB-IN- Inspect permit and deny matches following both tests.
configure terminal- Enter global configuration from privileged EXEC; changes affect the active configuration.
ip access-list extended WEB-IN- Select the exact named list for the controlled experiment.
no 10- Remove only the original service permit entry.
10 permit tcp host 192.0.2.10 host 198.51.100.10 eq 8081- Insert the deliberately incorrect destination-port permit.
end- Return to privileged EXEC without saving or undoing the accepted changes.
- What you should see
- Expect the list now permits 8081 rather than the real listening port 8080.
- Why this step matters
- This single changed field isolates a common syntax mistake without changing the service process or topology.
Observe the actual service fail
In GNS3, right-click Client and choose Console before typing. Leave the Server process running. Request 8080 again, not the accidentally permitted 8081. Do not start a new service to make the wrong policy appear correct.
curl --max-time 5 -I http://198.51.100.10:8080/What each command means
curl --max-time 5 -I http://198.51.100.10:8080/- Test the original required service against the wrong-port policy.
- What you should see
- Expect no completed HTTP response within the bounded test; exact error text can vary.
- Why this step matters
- Changing the test to match the mistake would conceal the regression instead of diagnosing it.
Restore the correct destination-port match
In GNS3, right-click R1 and choose Console before typing. Read the wrong entry, replace only sequence 10 with the original 8080 permit, and leave the final denial in place. Keep the source, destination and interface unchanged.
configure terminal
ip access-list extended WEB-IN
no 10
10 permit tcp host 192.0.2.10 host 198.51.100.10 eq 8080
end
show access-lists WEB-INWhat each command means
configure terminal- Enter global configuration from privileged EXEC; changes affect the active configuration.
ip access-list extended WEB-IN- Select the same list containing the wrong-port fault.
no 10- Remove only the faulty service permit.
10 permit tcp host 192.0.2.10 host 198.51.100.10 eq 8080- Restore the intended destination TCP port.
end- Return to privileged EXEC without saving or undoing the accepted changes.
show access-lists WEB-IN- Verify the restored entry and retained explicit denial.
- What you should see
- Expect the original permit and deny policy restored in configuration.
- Why this step matters
- A targeted inverse preserves the security boundary while repairing only the known mistake.
Retest the repaired service policy
In GNS3, right-click Client and choose Console before typing. Repeat both tests after repair. Record any unexpected result and inspect server availability before broadening permission or deleting the ACL.
curl --max-time 5 -I http://198.51.100.10:8080/
ping -c 3 198.51.100.10What each command means
curl --max-time 5 -I http://198.51.100.10:8080/- Verify HTTP returns after restoring destination 8080.
ping -c 3 198.51.100.10- Verify unrelated ICMP remains denied.
- What you should see
- Expect HTTP recovery with ICMP still denied, matching the pre-fault policy.
- Why this step matters
- Restoration means recovering the intended selective policy, not making every test pass.
Apply the numbered extended equivalent
In GNS3, right-click R1 and choose Console before typing. Build ACL 100 while WEB-IN is still active, then replace only the inbound attachment. The numbered identifier does not change the port value in its permit.
configure terminal
access-list 100 permit tcp host 192.0.2.10 host 198.51.100.10 eq 8080
access-list 100 deny ip any any
interface GigabitEthernet1
ip access-group 100 in
end
show ip interface GigabitEthernet1
show access-lists 100What each command means
configure terminal- Enter global configuration from privileged EXEC; changes affect the active configuration.
access-list 100 permit tcp host 192.0.2.10 host 198.51.100.10 eq 8080- Build numbered extended ACL 100 with the same service allowance.
access-list 100 deny ip any any- Add the equivalent explicit final IPv4 denial.
interface GigabitEthernet1- Select the existing Client ingress attachment point.
ip access-group 100 in- Replace WEB-IN with the completed numbered list.
end- Return to privileged EXEC without saving or undoing the accepted changes.
show ip interface GigabitEthernet1- Confirm ACL 100 is attached inbound.
show access-lists 100- Inspect the numbered entries before retesting.
- What you should see
- Expect ACL 100 on the ingress interface with equivalent matching conditions.
- Why this step matters
- A name or number identifies a list; evidence must still establish installed behavior.
Verify the numbered matrix
In GNS3, right-click Client and choose Console before typing. Retest the same application and ICMP cases under ACL 100. Do not substitute a router-generated test or a different URL.
curl --max-time 5 -I http://198.51.100.10:8080/
ping -c 3 198.51.100.10What each command means
curl --max-time 5 -I http://198.51.100.10:8080/- Check the permitted HTTP service under the numbered policy.
ping -c 3 198.51.100.10- Check the denied control case under the numbered policy.
- What you should see
- Expect the same HTTP success and ICMP failure as the repaired named list.
- Why this step matters
- The repeated matrix establishes the intended equivalence without relying on visual similarity of syntax.
Detach filters and restore unrestricted routing
In GNS3, right-click R1 and choose Console before typing. In the disposable project, remove the attachment first and then only the two exercise lists. Leave both routed addresses intact for the final baseline check.
configure terminal
interface GigabitEthernet1
no ip access-group 100 in
exit
no access-list 100
no ip access-list extended WEB-IN
endWhat each command means
configure terminal- Enter global configuration from privileged EXEC; changes affect the active configuration.
interface GigabitEthernet1- Select the only exercise attachment interface.
no ip access-group 100 in- Detach the numbered inbound filter.
exit- Return to global configuration.
no access-list 100- Remove the now-unused numbered exercise list.
no ip access-list extended WEB-IN- Remove the unused named exercise list.
end- Return to privileged EXEC without saving or undoing the accepted changes.
- What you should see
- Expect no exercise ACL attached; confirm with the interface display.
- Why this step matters
- Cleanup restores the declared baseline rather than leaving a permissive temporary rule hidden in an active list.
Verify baseline recovery and stop the service
In GNS3, right-click Client and choose Console before typing. Run the original two tests after detachment. Then open Server Console and press Ctrl+C to stop only the foreground HTTP process. Preserve notes and stop all three disposable nodes.
curl --max-time 5 -I http://198.51.100.10:8080/
ping -c 3 198.51.100.10What each command means
curl --max-time 5 -I http://198.51.100.10:8080/- Confirm the service still responds before stopping it.
ping -c 3 198.51.100.10- Confirm the original unrestricted echo baseline returns.
- What you should see
- Expect HTTP and ICMP both working before Server's process is stopped.
- Why this step matters
- The final check distinguishes ACL cleanup from accidentally stopping a service earlier in the experiment.
Verify
- Capture unrestricted HTTP and ICMP baselines from the actual Client.
- Record each attached list name or number, ingress direction, source and destination.
- With the correct filter require HTTP response and ICMP denial, not universal connectivity.
- During the wrong-port fault keep the requested URL and server listener unchanged.
- After restoration and numbered replacement repeat both cases; after detachment verify both original protocols.
Troubleshoot
- A connection refusal can indicate no listener; inspect the Server console and address before declaring an ACL drop.
- A timeout with no permit counter change calls for checking the active ingress list, exact protocol and port position.
- If baseline ping fails before attachment, resolve VM address, gateway, NIC mapping or endpoint firewall prerequisites first.
- Do not add permit ip any any as a repair; it defeats the intended deny and hides the actual mismatch.
GNS3 does not provide Cisco images. A license or entitlement must permit the image in the selected environment; do not share or redistribute image files. Cisco Modeling Labs is an official alternative. Its supplied Cisco reference images are licensed for use within CML, not automatically for export to GNS3. An unlicensed learner must use the explicitly labeled paper alternative, not report simulated Cisco execution.
- Detach ACL 100 and remove only ACL 100 and WEB-IN from this isolated project.
- Stop the foreground Server process with Ctrl+C after the final baseline tests, then stop the VMs.
- Discard the disposable nodes or restore their pre-lab snapshots; do not export licensed router images.
Practice set
Answer before you reveal
01Why does source-port eq 8080 usually fail for this client?
Port operators attach to the preceding address condition. Inspect the request tuple rather than assuming both ports are the same.
02What does the ip protocol keyword cover here?
The explicit deny ip any any therefore catches ICMP too. IPv6 requires its own supported policy and is not filtered by this list.
03Why can HTTP work while ping fails?
The protocols differ. A failed echo test cannot be used as proof that every application to the host fails.
04Does established prove a genuine authenticated TCP session?
Flags alone do not provide a stateful session table or application authentication. Avoid treating a stateless filter as a firewall replacement.
05Why build ACL 100 before changing the attachment?
Reviewing the full list first makes the change boundary clear. The final attachment and traffic matrix still need verification.
06Which return-path packets cross WEB-IN in this topology?
They enter the Server-facing port and leave the Client-facing port. A second ACL would require separately reasoned reverse-direction rules.
Knowledge check
Quiz: prove the reasoning
Keep these
Technical takeaways
- Read protocol, source and destination conditions together.
- Destination service ports and temporary client source ports are different roles.
- Named and numbered extended ACLs need deliberate interface attachment.
- A denied ping can be correct while a permitted TCP service works.
- Basic ACLs do not supply encryption, authentication or session validation.
- Repeat allowed and denied tests after a narrow repair.