i have make a network, an i have try to work with access-list but not working :( enter image description here can anyone help me with this pls

Pc1 can access server finance
server web can be access from all pc 
and server database can't be access from pc1

i have make accesslist

access-list 100 permit ip host
access-list 100 permit ip host
access-list 100 deny ip host host

interface FastEthernet0/1
 ip address
 ip access-group 100 in

But not work, please help me.

Thanks you !

2 Answers 2


Based on the precise requirements, it appears you only need to restrict PC1.

access-list 101 deny host host
access-list 101 permit any any
interface FastEthernet0/0
 ip access-group 101 out

You first need to ask yourself do you filter traffic that leaving LAN or you want to filter trafic that enters Server network ( Based on your ACL you filter trafic leaving LAN.

Try this ACL

access-list 100 permit tcp host host
access-list 100 deny tcp host host
access-list 100 permit tcp host eq 80
access-list 100 deny tcp host host
access-list 100 deny any any

Last condition is present by default so you don t have to type it. Conditions in ACL should be from more specific to more general one. This ACL should be applied as close as possible to source of traffic and that is

interface FastEthernet0/1
 ip access-group 100 in

Lets analyze your answer

access-list 100 permit ip host
access-list 100 permit ip host
access-list 100 deny ip host host

first condition allow IP trafic (this include tcp and udp) to following IP address, based on your wildcard;; ...

Wildcard looking for match, for bits that correspond to binary zero in wildcard mask and since your wildcard mask is 11110000 this means that first 4 binary digits in last octet will be ignored (can be whatever) and it will look for last 4 bits that must be equal to address in condition in order to apply this rule to incoming packet.Address that will result in last for binary zeros are:

00010000 - 16
00100000 - 32
00110000 - 48
01000000 - 64
01010000 - 80
01100000 - 96
01110000 - 112
10000000 - 128
10010000 - 144
10100000 - 160
10110000 - 176
11000000 - 192
11010000 - 208
11100000 - 224
11110000 - 240

Let me "translate" you condition in simple language it say: "if packet that arrive from host and have destination IP address permit this packet"

then it took incoming packet and use wildcard mask to map for example let say that destination IP address is

 IP address:   10101100. 00010000. 00000000.01100100 
 widcard mask: 00000000. 00000000. 00000000.11110000
 result :      10101100. 00010000. 00000000.xxxx0100

xxxx you could substitute with zeros so result will be

result :      10101100. 00010000. 00000000.00000100
and in order to apply rule result should be

required:    10101100. 00010000. 00000000.00000000

so, first condition in ACL will not be applied to this packet and ACL take second condition searching for rule that can be applied to packet. If there is no acceptable rule for packet, packet will be drop because of default deny any at the end of ACL.

Second condition is OK, you allowed all LAN to access web server Last condition you block one to one communication, but don t forget there is deny any at the end of every ACL and this will affect all other packets so this last condition is useless.

Hope this helped ...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.