2

enter image description here In the diagram we are required to block all the external user ping requests to the sever. For this I have created the following ACL on R1:

access-list 105 deny icmp any any echo
access-list 105 permit ip any any
int fa 0/0
ip access-group 105 in

Now in my lab manual they created this list for R2. Why? they have clearly used Extended ACL and as far as I know, Extended ACL is used on source, so isn't our source the PCs? In the next part we are required to permit one host for the FTP access and again the router used for extended ACL is R2. Why is that so?

Improve this question
1
  • 1
    Extended ACLs should generally be placed as close to the source as possible, otherwise, you are wasting resources routing packets that are destined to be dropped, anyway. – Ron Maupin♦ Jun 11 '19 at 13:21
3

If you block from your R1 you are not able ping to any destination because icmp packets are dropped from R1. Therefore It is applied on R2. Then it will blocked on specific traffic to Server.

To permit FTP use following command

access-list 105 permit tcp <source address><wild card> host <Destination> eq Ftp

Follow this document for more details

Improve this answer
3
  • 1
    FTP also requires data connections in order to work. You need to define a range of server-side ports for passive mode and add those to the ACL as well. – Zac67 Jun 11 '19 at 6:25
  • 1
    If we apply ACL, do we need to open it separately.? I assume when we open FTP ports will be opened by default? am i wrong? – infra Jun 11 '19 at 6:30
  • 1
    With "open" do you mean port forwarding aka DNAT? That doesn't usually change the ACL, but that depends on the device at hand. I'd configure the passive ports explicitly in any case. – Zac67 Jun 11 '19 at 11:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.