Sorting out ACL's

[test32343252353]

I am currently running a packet tracer lab for practice and I ran into a question when messing with ACL's during the lab. I have two routers one is named Branch the the other is named HQ. HQ has a network attached to it with the network address of 172.16.0.0/18 this network has 1 Server and 1 computer connected via a switch. The Branch has a network connected to it with the network address of 172.16.128.0/19 with just 1 computer connected via a switch as well. Now if I put an ACL on the HQ router blocking all network traffic from the 172.16.128.0 network from accessing the 172.16.0.0 network it is going to block access to both the server and the computer that are connected. The question that came to mind is am I able to deny that whole 172.16.128.0 network from accessing just the Server but still be able to access the PC connected to that 172.16.0.0 network.

[Seb Rupik · Accepted solution]

Hi there,

Instead of your ACL specifying a destination subnet, specify just a single host instead. Apply this inbound on the link between the HQ and branch.

So instead of:

!
  deny ip 172.16.128.0 255.255.224.0 172.16.0.0 255.255.192.0
!

..use:

!
  deny ip 172.16.128.0 255.255.224.0 host <server_ip>
!

cheers,

Seb.