ACL Logging & Order: Correct Permit/Deny Sequencing

Bundle lab · $29.99

Three-router static-routing lab with two Linux endpoints. An extended IPv4 ACL is intentionally misordered inbound near the source, causing Telnet to be permitted unexpectedly. Learners must observe first-match behavior via hit counters, enable buffered logging to see ACL log entries, and then correct the ACL sequence so Telnet is blocked while SSH and ICMP are permitted. All routers include a complete SSH management plane. The final solution forwards end-to-end and is enterprise-clean.

Learning objectives

• Apply an extended IPv4 ACL inbound near the source to control Telnet, SSH, and ICMP.
• Demonstrate ACL first-match behavior by misordering, observing hits/logs, then correcting order.
• Enable and verify syslog (logging buffered) for ACL log entries.
• Maintain a functional SSH management plane while filtering data-plane traffic.
• Trace end-to-end paths from the hosts and isolate faults using show commands and counters.

Troubleshooting focus

• Verify every link's interface status and IP addressing (`show ip interface brief`) and correct any interface that is down or misaddressed.
• Confirm each device's running configuration matches the lab objective, and bring any interface, route, or service that is not in its expected state back to health.
• Trace end-to-end reachability with ping/traceroute and isolate the first hop where forwarding fails.