CIS 244 Accessing the WAN ACL Exercise Page 1

1. Standard IP ACLs use which of the following to permit/deny packets?

A) Source address
B) Destination address
C) Protocol
D) Port
E) All of the above

2. Extended IP ACLs use which of the following to permit/deny packets?

A) Source address
B) Destination address
C) Protocol
D) Port
E) All of the above

3. Valid ways to refer to only host 172.16.30.55 in an ACL? (pick all that apply)
A) 172.16.30.55 0.0.0.255
B) 172.16.30.55 0.0.0.0
C) any 172.16.30.55
D) host 172.16.30.55
E) 0.0.0.0 172.16.30.55
F) ip any 172.16.30.55

Use a Standard IP ACL to answer questions 4 through 7

4. Stop subnet 200.1.1.0 / 24 from sending packets in to E0.

A: Deny the subnet ________________________________________
B: Implicit deny, so permit others ________________________________________
C: Bind it to an interface ________________________________________

5. Permit the entire subnet 203.2.4.128 / 28

A: Permit the subnet ___ ____________________________________

6. Permit the subnet 176.2.96.0 / 19

A: Permit the subnet ________________ _________________________

7. Deny the range of IP subnets 157.89.16.32 thru 157.89.31.63

A: Deny the range _________________________________________
B: Implicit deny, so permit others __________________________________________

ACL-exercise.doc 10/6/2010 Page 1

CIS 244 Accessing the WAN ACL Exercise Page 2

Use an Extended IP ACL to answer questions 8 & 9

8. Deny ftp traffic from the 172.19.0.0 /16 network to reach the FTP server at 172.23.45.33, but
permit all other traffic.
A: Deny _____________________________________________
B: Allow others _____________________________________________
C: Apply to interface _____________________________________________

9. Stop host 172.6.55.1 from telneting to host 173.56.44.1 & stop subnet 172.6.55.0 / 24
from web surfing anywhere.
A: Deny telnet _____________________________________________
B: No web surfing: _____________________________________________
C: Implicit deny, so permit: _____________________________________________
D: Bind to interface _____________________________________________

Notes:

To match an entire subnet: Wildcard mask = 255 – subnet mask

Example: Permit 203.2.4.128 (subnet mask 255.255.255.240) 255 – 240 = 15

Access-list 1 permit 203.2.4.128 0.0.0.15

To match a range: Wildcard mask = higher – lower

Example: Permit the range 157.89.16.0 to 157.89.31.255 157.89.31.255

157.89.16.000
0. 0. 15.255
Access-list 1 permit 157.89.16.0 0.0.15.255

Caution: Above examples assume the IP address is on a subnet boundary

ACL-exercise.doc 10/6/2010 Page 2

CIS 244 Accessing the WAN ACL Exercise Page 3

Part 1: Create network

10. Create the network below in Packet Tracer. Use a compatible IP addressing scheme and install
routes so that connectivity is established from all points. Do not create access lists until
instructor verifies routing tables and Telnet session.

Instructor verify: 7 routes in each routing table

Instructor verify: OK to Telnet from Router First to Home

Part 2: Restrict Telnet traffic

The Home router contains sensitive material and the network administrator wants Telnet sessions
available only from PC2 and PC3. All other devices must be blocked Telnet access. Use a Standard
IP access-list to accomplish this.

Instructor verify: Telnet works from PC2, is blocked from Router First

Due date: Week 10 Weight: 20 Points

ACL-exercise.doc 10/6/2010 Page 3