So let's work through this tricky
lab, don't be worried if you didn't get it working, it's very tricky.
So the first thing we need to do is bind access list 100 in the most efficient place on router 1 with
extended IP access lists.
You want to bind traffic as close to the source as you can.
So we're going to bind the access list to gigabit 0/0/0.
We're told that inside PC 1, this PC can only access HTTP server 1 and 2 on subnet 10.1.1.
0/24 using HTTP and HTTPS, and we only allowed to use two lines in an access list to do this.
So first thing, this server
has an IP address of 10.1.1.100.
This server
has an IP address of 10.1.1.101.
And now this is where it's important to know your binary.
That IP address and that IP address, 10.1.1.100.
Let's start the Windows calculator and put one hundred into the calculator notice that's what the
binary value of 100 is.
So both 10.1.1.100 and 101 have the first three octets the same.
So if we want to match both of those IP addresses, we would match that followed by something.
So what's the difference between 100 and 101?
100 looks like that.
101
looks like this.
And what you'll notice is the only difference between these two IP addresses is the last bit 100 and
101 are exactly the same in binary except for the lost bit.
So if we want to match both those IP addresses, we would use an inverse mask that looks like that.
Remember, if we want to match that portion, we would write 0.0.0 in our access list and to
match both of those IP addresses, we would make a mask like that.
This means we're matching 10.
This means we're matching 1 second octet.
This means we're matching 1 in the third octet.
And this means we're matching both 100 and 101 in the fourth octet.
So if we want to match both those hosts, we would create an access list, so access list 100 permit
and in this example we have to permit HTTP and HTTPS.
Both those protocols use TCP, the source that we matching is PC 1.
So 10.1.
and if you look at the IP address 2.101, so this is the IP address of the source.
So 2.101 you could tie this down to ephemeral port numbers or random port numbers, but
for now, I'm not going to do that.
I'm going to simply say destination is 10.1.1.100
mask 0/0/1 equal, and we need to match HTTP and HTTPS so I'm going to say port 80 and do another line,
port 443.
So let's confirm that show run, they are our two access control list entries that meet the criteria.
You've got to think in binary.
So pretend that you're in The Matrix and look at the binary, don't look at the decimal, look at the
binary, this is an inverse mask.
Zero means match.
One in binary means don't match.
This actually looks like we've got eight zeros, followed by eight zeros, followed by eight zeros followed
by
seven zeros and a one.
That's what we're looking at here.
OK, so the next step is no other PCs on the subnet can access the 10.1.1.0/24 subnet.
So Access List 100 deny and we want to deny all traffic from this subnet going to 10.1.1.0,
that subnet.
I think this a bit bigger, so it's easier to read.
So show run, that's what our access list looks like at the moment.
The next step is we should be able to access any other network, so access list 100, permit IP 10.1
.2.0 with our mask and we want to permit traffic going to any destination.
So again, show run.
That's our access list.
Show access lists will show you something similar.
There's the access list in the running configuration is the access list and seen with a show command.
OK, so that's the first part we then need to bind it onto our interface using the IP Access Group Command
and then we need to specify a direction.
And I should remember to put the number in, so access group 100 inbound.
So, again, show run on the router, we bound the access list inbound.
On this interface, it's the most efficient place to bind the access list, we want to drop traffic
as quickly as possible if it needs to be dropped.
We don't want the router to process and route the traffic and then simply drop it.
And again, that's what our access list looks like.
So that's the first part.
Now, what you could do at this point is verify that things work as expected.
So on your first host, as an example, verify things, remember to take small steps.
So 101.1.100, that's the IP address of the first server, as we can see here.
So on the PC, we can access both servers using HTTP.
Let's try HTTP to the first server.
HTTPS works.
There's our image, what about HTTPS to the second server that works, but notice I can't browse to the third
server.
In other words, this server here I can't get
to 10.1.1.102 from the client, request times out.
What about the fourth server?
IP config 10.1.1.103,
I'm not able to get to that server either.
But I can get to the second server as well as the first server using my Web browser.
It's also a good idea to check what's going on by using the show access lists, command notice we're
getting a bunch of matches here.
So let's do some more tests.
This is over 100, so we should be able to access pages, so that works.
We previously had 19 matches.
Notice it's gone up to 51 matches because that was actually HTTPS so 51 matches from 39 matches.
So go back here, click to a small page, 51 matches has now increased to 61 matches, so I'll change that
to HTTP notice 24 matches, which is up from 19 matches.
Click back, go to the image page.
It was 24 matches, now it's 41 matches.
So that's definitely working.
And what about when we go to PC 2?
And try and browse to one of the servers.
At the moment, we have 24 matches on this line, let's browse to10.1.1.100.
Notice 28 matches, 32 matches, so that's definitely working.
Go to 101,
39 matches, 42 matches and so forth, go to another server, 103.
Notice this is also increasing.
And if we go back to PC one, we've got 60 matches at the moment, but let's try and go to server
4 notice
the matches are increasing.
So that's definitely working.
Last test is, can we get to Cisco.com? Now
the verifications are here.
I'm doing it.
Firstly to check that first access list will have to do more checks once we add additional access list.
But we can do some initial testing here, so can we get to Cisco.com?
Yes, we can.
Now, in your lab, it may take a while for that page to display, but notice we've got 72 matches,
whereas previously we had no matches on the last line, Facebook.com, we can get to Facebook.
com notice we have 140 matches.
So that definitely works.
So I'm happy with the first access list.
Now we need to configure the second access list.