0

enter image description here

I am trying to understand the concept of standard and extended ACL. In the given topology, the top router is Front Desk(192.168.11.0/24). The left router is Nurses (192.168.7.0/24), left bottom is Doctors (192.168.8.0/24), right bottom is administration (192.168.9.0/24) and right router is accounts (192.168.10.0/24).

As the doctors' computers have confidential patient health data, no other department can access Doctor's Network

Front desk network can only be accessed by Nursing Staff and Doctors' networks.

Users in Doctors' network and Nursing staff cant access Accounts department.

Accounts department cannot access any other network but Front desk can access

Accounts department in order to check payment status of patients.

Now how should I add the ACLs?

Improve this question
12
  • 2
    Your statements are contradictory. If all PCs can't access doctor PCs, then doctor PCs can't access them. Remember that all traffic is two-way.
    – Ron Trunk
    Commented Jun 6, 2019 at 17:20
  • @RonTrunk, but I am asked that the top router can only be accessed by the doctor PCs and by the ones in the top left side. How do I tackle this problem?
    – Muhammad Ahmad
    Commented Jun 6, 2019 at 17:24
  • 2
    The ACL 1 on the bottom router blocks everything (deny any). So nothing will reach the PCs from the rest of the network. Your goal isn't clear.
    – Ron Trunk
    Commented Jun 6, 2019 at 17:49
  • @ahmad qayyum just define what destination network needs to be reached, once you have defined that modify the access-group in the out direction and add the rule first.
    – DRP
    Commented Jun 6, 2019 at 17:51
  • 1
    @AhmadQayyum network 101, remember that traffic is bi-directional, so if you block one way, you are basically disrupting traffic. So, based on your requirements, you need to block everything (any) except one network, so meaning you need to open a hole. ACL 's as you know are followed/executed in the order assigned, so the idea would be to permit whatever traffic you need first, in this case the top router network, then after that you would finish with the 'deny any' clause.
    – DRP
    Commented Jun 6, 2019 at 17:57

1 Answer 1

Reset to default
2

Networking overview: remember that traffic is bi-directional, so if you block one way, you are basically disrupting traffic.

Case Scenario: Based on your topology and requirements, you need to block everything (any) except one network to the Doctors devices, meaning you need to open a 'hole' in your access list statements.

ACL 's as you know are followed/executed in the order assigned, a good practice is you leave some numbering space should you include something in the future, so the idea would be to permit whatever traffic you need first. In this case the top router network contains your target destination that must be allowed, then after that has been allowed you would finish with ACL configuration with the 'deny any' clause hence blocking all other traffic.

Improve this answer
9
  • first i wrote permit any statement followed bydeny any statement but the problem is that the denied statement is not working.
    – Muhammad Ahmad
    Commented Jun 6, 2019 at 18:21
  • 1
    @AhmadQayyum you need to put the rule more specific, if you allow everything by the 'permit any' then anything afterwards will not be denied, you need to be specific with your ACL, only use 'deny any' at the end, at the beginning you need to put a granular statement, i.e: access-list acl_permit permit ip 192.168.3.0 0.0.7.255
    – DRP
    Commented Jun 6, 2019 at 18:24
  • i think i know what the problem is. I will add 5 statements of permit all the IPs one by one and then in the end add deny any statement. right?
    – Muhammad Ahmad
    Commented Jun 6, 2019 at 18:27
  • can you add the commands?
    – Muhammad Ahmad
    Commented Jun 6, 2019 at 18:57
  • 1
    Create an access list on the Doctor router that denies everything (deny any).
    – Ron Trunk
    Commented Jun 7, 2019 at 17:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.