Lab 90.

Configuration and
Verification

Task 1:
For reference information on configuring hostnames, please refer to
earlier labs.

Task 2:
For reference information on configuring IP addresses and static
routes, please refer to earlier labs.

Task 3:
For reference information on pinging IP addresses, please refer to
earlier labs.

Task 4:
R1#conf t
Enter configuration commands, one per line. End with CTRL/Z.
R1(config)#ip access-list standard LOOPBACK-10-30-ACL
R1(config-std-nacl)#remark “Deny Traffic From R3 Loopback10”
R1(config-std-nacl)#deny 10.10.10.0 0.0.0.127
R1(config-std-nacl)#remark “Permit Traffic From R3 Loopback20”
R1(config-std-nacl)#permit 10.20.20.0 0.0.0.15
R1(config-std-nacl)#remark “Deny Traffic From R3 Loopback30”
R1(config-std-nacl)#deny 10.30.30.0 0.0.0.7
R1(config-std-nacl)#remark “Permit Traffic From Serial0/0 Subnet”
R1(config-std-nacl)#permit 172.16.1.0 0.0.0.63
R1(config-std-nacl)#exit
R1(config)#int s0/0
 R1(config-if)#ip access-group LOOPBACK-10-30-ACL in
R1(config-if)#end
R1#

R3#ping 172.16.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms

R3#ping 172.16.1.1 source loop10

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
Packet sent with a source address of 10.10.10.3
U.U.U
Success rate is 0 percent (0/5)

R3#ping 172.16.1.1 source loop20

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
Packet sent with a source address of 10.20.20.3
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms

R3#ping 172.16.1.1 source loop30

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
Packet sent with a source address of 10.30.30.3
U.U.U
Success rate is 0 percent (0/5)

NOTE: Take note of the different syntax for creating a named ACL
versus a numbered ACL. Named ACLs perform the same way as
numbered ACLs but allow for easier identification of what the ACL is
used for because they can be assigned a name. You can view
named ACLs using the same commands as you would for numbered
ACLs:

R1#show ip access-lists LOOPBACK-10-30-ACL

Standard IP access list LOOPBACK-10-30-ACL
10 deny 10.10.10.0, wildcard bits 0.0.0.127 (11 matches)
20 permit 10.20.20.0, wildcard bits 0.0.0.15 (15 matches)
30 deny 10.30.30.0, wildcard bits 0.0.0.7 (11 matches)
40 permit 172.16.1.0, wildcard bits 0.0.0.63 (15 matches)

To view ACLs applied to an interface, you can use either the show run
interface <name> command or the show ip interface <name> command as
illustrated below:

R1#show running-config interface serial 0/0

Building configuration...

Current configuration : 139 bytes

!
interface Serial0/0
ip address 172.16.1.1 255.255.255.192
ip access-group LOOPBACK-10-30-ACL in
clock rate 768000
no fair-queue
end

R1#show ip interface serial 0/0

Serial0/0 is up, line protocol is up
Internet address is 172.16.1.1/26
Broadcast address is 255.255.255.255
Address determined by setup command
MTU is 1500 bytes
Helper address is not set
Directed broadcast forwarding is disabled
Outgoing access list is not set
Inbound access list is LOOPBACK-10-30-ACL