Extended ACL Not working?

[NobleCISCO1]

Hi All, 

Having trouble doing an extended ACL, Where I have to:

Setup an ACL to prevent Laptop 0 access the Web Server but allow all other traffic.Laptop 0 is allowed to ping the web services but not access the web page.

As well write a ACL to prevent Laptop 1 not allowed to access the FTP services but allowed to access the web services.

I have used commands on router 0

access-list 110 deny tcp host 172.16.10.2 host 177.20.40.2 eq 80

access-list 110 deny tcp host 172.16.10.2 host 215.15.15.2 eq ftp

access-list 110 permit ip any any

on fa0/1

ip access-group 110 in

[GRANT3779]

Looking at your topology the laptops are on different vlans and will have a different gateway. Do you have router on a stick configured on the left router? Is the switch on the left purely layer2? If yes to above you will need to apply ACLs on the sub interfaces I believe and will need two separate ACLs.

[NobleCISCO1]

Hi Grant, 

Thanks, yes both laptops are both on different Vlans and it is a 2 layer switch.

Only put both computers on one ACL to test, if I only put one deny command on the 110 ACL it still doesn't work. 

Tried to put both ACLs on the FA0/1 interface and only one is able to be accepted. 

[GRANT3779 · Accepted solution]

What is the full config of the fa0/1 router interface? If you are using sub interfaces the ACLs needs to be placed under these and not the physical one (if i am understanding your topology correctly).

[NobleCISCO1]

That worked!

Thank you very much!

[Julio E. Moisa]

Hi

It could be applied on the Serial 0/1/0 on outbound direction. 

interface se0/1/0

ip access-group 110 out

Also be sure before to apply the ACL that everything is working fine.

Hope it is useful

:-)