ACL Logging & Order: Correct Permit/Deny Sequencing

Bundle lab

Three-router static-routing lab with two Linux endpoints. An extended IPv4 ACL is intentionally misordered inbound near the source, causing Telnet to be permitted unexpectedly. Learners must observe first-match behavior via hit counters, enable buffered logging to see ACL log entries, and then correct the ACL sequence so Telnet is blocked while SSH and ICMP are permitted. All routers include a complete SSH management plane. The final solution forwards end-to-end and is enterprise-clean.

Learning objectives

• Apply an extended IPv4 ACL inbound near the source to control Telnet, SSH, and ICMP.
• Demonstrate ACL first-match behavior by misordering, observing hits/logs, then correcting order.
• Enable and verify syslog (logging buffered) for ACL log entries.
• Maintain a functional SSH management plane while filtering data-plane traffic.
• Trace end-to-end paths from the hosts and isolate faults using show commands and counters.

Troubleshooting focus

• If ping fails both directions: On each router, check interface status and IPs (show ip interface brief). A down/down or misaddressed port breaks routing.; Validate static routes: stubs should default to the hub; the hub should have specific routes to both LANs. Next-hop must be the neighbor’s IP, never the router’s own address.
• If ACL hit counters don’t move: Confirm the ACL is applied to RTR-A’s LAN-facing interface in the inbound direction; extended ACLs belong near the source, inbound.; Check that you are testing from the hosts (not from routers) to generate the correct source addresses.
• If you see no deny logs: Ensure logging buffered is enabled and sized, and the deny statements include the log keyword.
• If SSH to routers fails: Verify the SSH management plane: hostname, domain name, RSA keys, username/secret, ip ssh version 2, VTY login local and access-class permitting the site LANs.