Goldfish Networks wordmark
IntermediatePublished 2026-06-25

CCNA: ACL Placement – Std Near Dest, Ext Near Source

Bundle lab

Dual-router Branch/HQ lab with a branch client and an HQ server. You will apply an extended IPv4 ACL inbound near the source on the Branch LAN to block specific traffic (TCP/80) while permitting others (ICMP), and a standard IPv4 ACL outbound near the destination on the HQ LAN to admit only the approved source. Validate from real hosts, confirm ACL hitcounts, and keep inter-site connectivity via static routes over a /30 transit.

Track
Est. time
55 minutes
Difficulty
Intermediate
Topics

Learning objectives

  • Implement a standard ACL near the destination (outbound on the HQ LAN interface) to avoid over-blocking.
  • Implement an extended ACL near the source (inbound on the Branch LAN interface) to filter specific protocols precisely.
  • Verify permitted and denied traffic end-to-end from the client to the server and confirm ACL hitcounts.
  • Configure correct static routing with /30 transit addressing and neighbor next-hops.

Troubleshooting focus

  • ping 10.20.20.10 from CLIENT-BRANCH fails: confirm the port numbers in show ip interface brief match the diagram and that the IPs are correct. A single swapped interface breaks the entire path.
  • CLIENT-BRANCH pings its own gateway but not the HQ server: check show ip route for 10.20.20.0/24 via 10.12.12.2 on RTR-BR, and 10.10.10.0/24 via 10.12.12.1 on RTR-HQ.
  • show access-lists hitcounts stay at zero: the ACL is bound the wrong way. BR-LAN-FILTER must be in on RTR-BR's Branch LAN interface; HQ-LAN-SOURCE must be out on RTR-HQ's HQ LAN interface.
  • Traffic you expected to be dropped passes anyway: read the entry order in show access-lists. A broad permit sitting above the specific deny means the deny never matches.
  • curl http://10.20.20.10:80 returns a response instead of timing out: verify the extended ACL deny actually matches TCP/80 and targets the server's exact host address.

Topology

Subscribe to preview this lab's topology.

See plans

Related labs

More hands-on Cisco Modeling Labs practice on the same track and topics.

Study this topic

Free guides, a command cheat sheet, and graded practice for this lab's topic.

Learn Access Control Lists (ACLs)What Is an Access Control List (ACL)?

Grade your work

How this lab is graded
  • Build it your way. Where a lab lets you choose a value — a VLAN name, an interface description — grading checks that you configured it, not which name you picked. Names that another line has to reference, like an ACL applied with access-class, are stated in the guide and do have to match.
  • Addresses, modes and protocol keywords are exact. An IP address, a subnet mask, switchport mode trunk, an encapsulation — these carry the meaning of the lab, so they are graded as written in the guide.
  • Grading reads your saved configuration. Export the lab from CML after you have configured it, and make sure anything you set is in the running-config — a change that only exists in a terminal session never reaches the grader.
  • You can submit as many times as you like. Your best score stands, and each attempt tells you which checks passed so you can work the gaps.
  • Scored something you believe is correct? Use Report an issue on this page — that is exactly how the grading fixes in the changelog got found.

Create a free account to submit your lab for grading.

Create a free account
Found a problem with this lab?

Please sign in to report a problem — tying it to your attempts lets us reproduce and fix it faster.