how to configure ACL on routers?

[ahmadqayyum7]

I am given a topology in which I have to apply ACL. The PCs in the left bottom side are not to be accessed by any other PCs. This was done successfully as follows:

access-list 1 deny any

access-list 1 permit any

int fa 0/0

ip access-group 1 out

Now the next task is that the top router should be only accessed by the the PCs in the left side and the ones in the left bottom. How do I do that?

[Joseph W. Doherty · Accepted solution]

"The PCs in the left bottom side are not to be accessed by any other PCs."

Your ACL also blocks the routers and servers; don't know if you intended that too. Also since your first ACL statement is deny any, the subsequent permit any will never be reached.

"Now the next task is that the top router should be only accessed by the the PCs in the left side and the ones in the left bottom. How do I do that?"

That depends on what you mean by "accessed" and also by your network addressing.

[ahmadqayyum7]

by "accessed" I mean that if I ping the top PCs from the PCs in the left side the ping should be successful. also should following be my new configuration for the PCs of left bottom?:
access-list 1 permit any
access-list 1 deny any
int fa 0/0
ip access-group 1 out
I tried this too but now the deny statement is not working.

[Joseph W. Doherty]

When I wrote your original ACL's 2nd ACE wasn't reached, I wasn't suggesting you swap the 1st and 2nd ACEs. I meant you didn't need the 2nd ACE. When you swap them, all again matches on the first ACE, but as it's a permit, nothing is blocked.

Regarding the meaning of "accessed", an ACL can block or only allow "ping" packets. Is that what you want or do you also want to be selected with other traffic? Your original ACL is an all or nothing ACL.

[ahmadqayyum7]

yes by accessed i mean ping. can you please modify the commands?

[Joseph W. Doherty]

To only allow ping or to only not allow ping?

[ahmadqayyum7]

to only allow pings

[Joseph W. Doherty · Accepted solution]

(NB: I don't have access to a Cisco router, so my syntax may be correct.)

access-list extended AllowOnlyPings
permit icmp any any type 0
permit icmp any any type 8

Applied the above (named) ACL to the interfaces facing into the switches whose hosts you want to control. Applying for either in or out should do the job but you can also apply the ACL for both in and out.

BTW, if you're wondering, every ACL has an implicit deny all as the last entry.

[Giuseppe Larosa]

Hello,

if accessing the top router means be  able to telnet/ssh to the router the exercise is asking you to build an ACL that will be applied to the line vty (that are the logical entities that can accept incoming telnet/SSH sessions).

For example:

192.168.5.0/24

and

192.168.20.0/24 must be able to telnet to the router:

access-list 5 pemit 192.168.5.0 0.0.0.255

access-list 5 permit 192.168.20.0 0.0.0.255

line vty 0 4

access-class 5 in

login

Note the ACL is not applied to a physical interface but to the line vty range.

This is usually what is meant with control who can access the router shell.

Hope to help

Giuseppe