Cisco Packet Trace Access-List

Question

i have make a network, an i have try to work with access-list but not working :( can anyone help me with this pls

Pc1 can access server finance
server web can be access from all pc 
and server database can't be access from pc1

i have make accesslist

access-list 100 permit ip host 192.168.1.2 172.16.0.0 0.0.0.240
access-list 100 permit ip 192.168.1.0 0.0.0.255 host 172.16.0.200
access-list 100 deny ip host 192.168.1.2 host 172.16.0.250


interface FastEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip access-group 100 in

But not work, please help me.

Thanks you !

Answer 1

Based on the precise requirements, it appears you only need to restrict PC1.

access-list 101 deny host 192.168.1.2 host 172.16.0.250
access-list 101 permit any any
!
interface FastEthernet0/0
 ip access-group 101 out

Answer 2

You first need to ask yourself do you filter traffic that leaving LAN or you want to filter trafic that enters Server network (172.16.0.0) Based on your ACL you filter trafic leaving LAN.

Try this ACL

access-list 100 permit tcp host 192.168.1.2 host 172.16.0.100
access-list 100 deny tcp host 192.168.1.2 host 172.16.0.250
access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 172.16.0.200 eq 80
access-list 100 deny tcp host 192.168.1.2 host 172.16.0.250
access-list 100 deny any any

Last condition is present by default so you don t have to type it. Conditions in ACL should be from more specific to more general one. This ACL should be applied as close as possible to source of traffic and that is

interface FastEthernet0/1
 ip access-group 100 in

Lets analyze your answer

access-list 100 permit ip host 192.168.1.2 172.16.0.0 0.0.0.240
access-list 100 permit ip 192.168.1.0 0.0.0.255 host 172.16.0.200
access-list 100 deny ip host 192.168.1.2 host 172.16.0.250

first condition allow IP trafic (this include tcp and udp) to following IP address, based on your wildcard 172.16.0.16; 172.16.0.32; ...

Wildcard looking for match, for bits that correspond to binary zero in wildcard mask and since your wildcard mask is 11110000 this means that first 4 binary digits in last octet will be ignored (can be whatever) and it will look for last 4 bits that must be equal to address in condition in order to apply this rule to incoming packet.Address that will result in last for binary zeros are:

00010000 - 16
00100000 - 32
00110000 - 48
01000000 - 64
01010000 - 80
01100000 - 96
01110000 - 112
10000000 - 128
10010000 - 144
10100000 - 160
10110000 - 176
11000000 - 192
11010000 - 208
11100000 - 224
11110000 - 240

Let me "translate" you condition in simple language it say: "if packet that arrive from host 192.168.1.2 and have destination IP address 172.16.0.0 permit this packet"

then it took incoming packet and use wildcard mask to map for example let say that destination IP address is 172.16.0.100

 IP address:   10101100. 00010000. 00000000.01100100 
 widcard mask: 00000000. 00000000. 00000000.11110000
--------------------------------------------------------
 result :      10101100. 00010000. 00000000.xxxx0100

xxxx you could substitute with zeros so result will be

result :      10101100. 00010000. 00000000.00000100
and in order to apply rule result should be

required:    10101100. 00010000. 00000000.00000000

so, first condition in ACL will not be applied to this packet and ACL take second condition searching for rule that can be applied to packet. If there is no acceptable rule for packet, packet will be drop because of default deny any at the end of ACL.

Second condition is OK, you allowed all LAN to access web server Last condition you block one to one communication, but don t forget there is deny any at the end of every ACL and this will affect all other packets so this last condition is useless.

Hope this helped ...