CCNA Access List Simulation: Extended ACL Configuration

This CCNA access list simulation explains how to build and apply an extended IPv4 ACL that permits one host to reach a web server while denying web access from every other source. All non-web traffic remains permitted.

Work through the logic before checking the configuration. For more structured revision, see the 200-301 CCNA Premium PDF with the latest available questions and answers.

Simulation Requirements

• Host C: 192.168.33.3
• Finance Web Server: 172.22.242.23
• Permit Host C to use HTTP to the server.
• Deny HTTP from every other source to that server.
• Permit all remaining IP traffic.
• Use no more than three ACL statements.

Step 1: Translate the Requirement into ACL Logic

An extended ACL can match the source address, destination address, IP protocol, and destination port. Because this policy concerns HTTP traffic to a specific server, an extended ACL is the correct choice.

1. Permit TCP from Host C to the Finance server on port 80.
2. Deny TCP from any other source to that server on port 80.
3. Permit all other IP traffic.

Step 2: Create the Extended ACL

conf t
ip access-list extended FINANCE-WEB
 permit tcp host 192.168.33.3 host 172.22.242.23 eq 80
 deny tcp any host 172.22.242.23 eq 80
 permit ip any any
end

The first statement must appear before the broader deny statement. ACLs are processed from top to bottom, and processing stops at the first match.

Step 3: Choose the Correct Interface and Direction

Extended ACLs are generally placed close to the source so unwanted traffic is stopped early. Apply the ACL inbound on the router interface receiving traffic from the Hosts LAN. Confirm the real interface name with show ip interface brief.

conf t
interface GigabitEthernet0/0
 ip access-group FINANCE-WEB in
end

Replace GigabitEthernet0/0 with the interface connected to the Hosts LAN in your topology.

Step 4: Verify the Configuration

show access-lists
show ip interface
show running-config | section access-list

Test Host C with HTTP to 172.22.242.23; it should succeed. Test another host with HTTP; it should fail. Then test non-web traffic to confirm it is still permitted. Packet counters in show access-lists should increase on the expected lines.

Why the Final Permit Is Required

Every ACL ends with an implicit deny ip any any. Without the third statement, traffic that does not match the first two entries would also be denied, which violates the requirement to allow all other traffic.

Common Mistakes

• Reversing source and destination addresses.
• Using a standard ACL, which cannot match the destination port.
• Putting the deny statement above the specific permit.
• Forgetting the final permit ip any any.
• Applying the ACL on the wrong interface or in the wrong direction.
• Using eq 443 when the task specifically asks for HTTP port 80.

CCNA Review Points

Remember wildcard masks, host matching, top-down processing, the implicit deny, and interface direction. The current CCNA objectives include configuring standard, extended, numbered, and named IPv4 ACLs.

After completing the lab, review the Cisco CCNA notes and practise more scenarios with the Cisco 200-301 Premium PDF.

How to Practice This ACL Scenario

Build the topology in Packet Tracer or a lab environment, configure IP addressing, and confirm connectivity before applying the ACL. Add one access-control entry at a time, then test the permitted host, the blocked web traffic, and another allowed protocol. Use show access-lists to review match counters and show running-config to confirm the ACL placement. If the result is unexpected, check the wildcard mask, protocol, port, direction, and interface. This method turns the configuration into a repeatable troubleshooting exercise instead of a command-memorization task.