ACL Lab
Two modes: Placement uses the PAT edge topology (extended ACLs close to source, standard ACLs close to destination). Troubleshooting uses the dual-site R1/R2 diagram with PC subnets and a remote server — find every fix for broken HTTPS filtering.
How to play
Two modes: Placement uses the PAT edge topology (extended ACLs close to source, standard ACLs close to destination). Troubleshooting uses the dual-site R1/R2 diagram with PC subnets and a remote server — find every fix for broken HTTPS filtering.
ACL Placement Game
Identify the source, then choose where to place a standard or extended ACL.
Why source matters
ACL placement starts by identifying the traffic source. Extended ACLs match source, destination, protocol, and port — place them close to the source. Standard ACLs only match source IP — place them close to the destination.
PAT reminder
PAT changes internal private addresses at the internet edge. Decide what traffic you filter, where the source is, and whether the ACL should see the original inside address.
Block LAN-A users from reaching LAN-B server
Block 192.168.10.0/24 from accessing 192.168.20.10 on TCP port 80.
- Source
- LAN-A Users
- 192.168.10.0/24
- Destination
- LAN-B Web Server
- 192.168.20.10
- Filter
- TCP port 80
Step 1 — Who is the source?