ACCESS-CONTROL LIST

[catalinmatei112]

I have 3 departments, each have a router and 10 pc's, and I have to configure access-control list based on the below exercises:

1.first department should have access to second but not to third

2.second department should not have access to any departments

3.third department should have access to all departments.

I did the first exercise, and I don't know how to do the rest. This subject is new for me 

I can share the file if you need, an explanation or something will be useful. Thank you!

[paul driver · Accepted solution]

Hello
sounds like the request is not clear - from an ip perspective this cannot be done with just an access-list as the return traffic from the second department to the third for udp is connection-less  however it can be done with extended ACLs,at a protocol level (tcp) or even maybe with reflective ACLs to include udp where the secondary department will return traffic but not be able to initiate it- So can you confirm if this is just for tcp traffic

[catalinmatei112 · Accepted solution]

Well, yes this is just for tcp traffic

[Georg Pauwen · Accepted solution]

Hello,

my guess is that this is a Packet Tracer project ? Post the (zipped) Packet Tracer project (.pkt) file...

[catalinmatei112 · Accepted solution]

That's the file, I did a static routing, I configured a DHCP server, and now I have to control the access-between departments  

[Georg Pauwen · Accepted solution]

Hello,

below is the basic procedure:

# Create an ACL to allow the first department access to the second but not the third

access-list 100 permit ip <first_department_subnet> <wildcard_mask_of_first_department> <second_department_subnet> <wildcard_mask_of_second_department>
access-list 100 deny ip <first_department_subnet> <wildcard_mask_of_first_department> <third_department_subnet> <wildcard_mask_of_third_department>
access-list 100 permit ip any any

# Create an ACL to deny the second department access to any other departments

access-list 101 deny ip <second_department_subnet> <wildcard_mask_of_second_department> any
access-list 101 permit ip any any

# Create an ACL to allow the third department access to all departments

access-list 102 permit ip <third_department_subnet> <wildcard_mask_of_third_department> any
access-list 102 permit ip any any
Replace <first_department_subnet>, <wildcard_mask_of_first_department>, <second_department_subnet>, <wildcard_mask_of_second_department>, <third_department_subnet>, and <wildcard_mask_of_third_department> with the actual subnet information for your departments.

Then, apply these ACLs to the appropriate interfaces using the ip access-group command. For example:

interface <interface_number>
ip access-group 100 in # Apply ACL 100 inbound on the interface for the first department
exit

interface <interface_number>
ip access-group 101 in # Apply ACL 101 inbound on the interface for the second department
exit

interface <interface_number>
ip access-group 102 in # Apply ACL 102 inbound on the interface for the third department
exit

Remember to replace <interface_number> with the actual interface number where the departments are connected. Also, adapt the ACLs based on your network topology and addressing scheme.

[catalinmatei112 · Accepted solution]

Thank you so much, I'll be back after I will try this!

[paul driver · Accepted solution]

Hello @Georg Pauwen 
If i am reading this correctly Im quite sure this will not work, the acl on the secondary department will negate the return traffic to the other departments

[catalinmatei112 · Accepted solution]

Yes, you are right, so is there any option to solve this? Maybe exist something to permit/deny access between departments, without using ACL

[catalinmatei112 · Accepted solution]

I tried using static routing but that doesn't work either because all 3 routers are connected in line

[catalinmatei112 · Accepted solution]

So I did what you said, but still not working:)) I entered to see the simulation, but for ex when the data come from first department and entered in second, when he left it gives me error, and I got the failed message.

[Georg Pauwen · Accepted solution]

Hello,

I opened your lab file, but I do not understand your IP addressing. What is the purpose of the IP addresses on the physical LAN interfaces ? You have Vlans 10,20 and 30 on the routers respectively, but they all have a subinterface with an IP address in the x.x.25.0/25 address space ? Send the full instructions of your project...

[catalinmatei112 · Accepted solution]

1. At least 30 computers distributed among 3 departments: the Accounting Department, the Marketing Department and the Programming Department.

2. Start from the ip address 196.240.17.0 and share it in the most optimal way

3. You must use VLANs

4. Communication between departments will be carried out as follows:

a. The Accounting Department has access to the Marketing Department but does not have access to the Programming Department

b. The Marketing Department does not have access to any department

c. The Programming Department has access to all departments

5. The distribution of IPs to computers will be done automatically

So that's a project that I got, and that's all I got for VLANS.I found so many videos where I saw that to create a vlan on a router I should create a subinterface 

[paul driver · Accepted solution]

Hello

---

@catalinmatei112 wrote:

1.first department should have access to second but not to third
2.second department should not have access to any departments
3.third department should have access to all departments.

Well, yes this is just for tcp traffic

---

First of all - Your ip addressing is incorrect , you have the same lan subnet in the different departments attach to 3 separate routers, this is not applicable

Attached is a working PT with amended ip addressing and added dynamic routing instead of static along with a working basic extended access-list that will obtain the result you desire above.

[catalinmatei112]

So, I opened your file, and I have a question: The access between departments still doesn't working, what can I do to solve it?..I'm sorry if I'm asking but I'm kinda new,and I started like 3 days ago