ACL Segmentation Policy on Multi-LAN Router

Bundle lab · $29.99

Deploy and verify multiple IPv4 ACLs on a single router that terminates three distinct LANs (Client, Server, and Management). You will place an extended ACL inbound on the Client interface to allow only specific services to the Server and block access to Management, a standard ACL outbound on the Management interface to enforce destination-side protection by source, and a VTY access-class to restrict router SSH to the Management subnet only. Validate with end-host tests that permitted flows succeed while denied flows are provably blocked, and use ACL hit counts and logs to troubleshoot.

Learning objectives

• Configure and apply multiple ACLs on different router interfaces and directions.
• Enforce segmentation between client, server, and management networks using IPv4 ACLs.
• Verify policy from end hosts and interpret ACL hit counts and log outputs.
• Diagnose direction/placement mistakes and implicit deny behavior.
• Validate operational impact on critical services (SSH, HTTP, ICMP).

Troubleshooting focus

• Why does permitted traffic work one way but not the other?
• How do ACL hit counts and log messages expose the blocked flow?
• What changes when the same ACL is placed inbound vs. outbound?
• Which flows fail due to the implicit deny?
• How does a VTY access-class differ from an interface access-group?