Goldfish Networks wordmark
IntermediatePublished 2026-06-25

ACL App Filter: Permit SSH/HTTP, Block Telnet/ICMP

Bundle lab

Build a two-router, one-access-switch lab with a client and a server. Establish basic IP connectivity with static routing, then implement an extended IPv4 ACL inbound on the client-facing interface to permit SSH and HTTP to the server while denying Telnet and ICMP echo. Validate from the client and review ACL hit counters for proof.

Track
Est. time
55 minutes
Difficulty
Intermediate
Topics

Learning objectives

  • Design and deploy an extended IPv4 ACL to filter traffic by protocol and TCP/UDP port.
  • Place an extended ACL inbound near the source so only client-initiated traffic is filtered.
  • Permit SSH (tcp/22) and HTTP (tcp/80) to the server while denying Telnet (tcp/23) and ICMP echo.
  • Verify operation with client-side tests and router ACL hit counters.
  • Troubleshoot ACL order, placement, and basic IP reachability issues.

Troubleshooting focus

  • show access-lists APP-FILTER shows zero hits on every entry: the ACL never sees client traffic.
  • Add the catch-all as the last line.
  • Telnet to 10.20.20.10:23 still connects: check entry order in show access-lists APP-FILTER.
  • Nothing is reachable even before the ACL is applied: this is routing, not policy. From CLIENT01 ping 10.10.10.1 first, then verify the static routes on RTR-BRANCH and RTR-DC and the SRV-APP01 gateway 10.20.20.1.
  • HTTP or SSH to 10.20.20.10 fails while the ACL permits them: the listeners are the problem. Confirm SRV-APP01 is still listening on tcp/80 and tcp/22 during the test, and restart the temporary listeners if they exited.

Topology

Subscribe to preview this lab's topology.

See plans

Related labs

More hands-on Cisco Modeling Labs practice on the same track and topics.

Study this topic

Free guides, a command cheat sheet, and graded practice for this lab's topic.

Learn Access Control Lists (ACLs)What Is an Access Control List (ACL)?

Grade your work

How this lab is graded
  • Build it your way. Where a lab lets you choose a value — a VLAN name, an interface description — grading checks that you configured it, not which name you picked. Names that another line has to reference, like an ACL applied with access-class, are stated in the guide and do have to match.
  • Addresses, modes and protocol keywords are exact. An IP address, a subnet mask, switchport mode trunk, an encapsulation — these carry the meaning of the lab, so they are graded as written in the guide.
  • Grading reads your saved configuration. Export the lab from CML after you have configured it, and make sure anything you set is in the running-config — a change that only exists in a terminal session never reaches the grader.
  • You can submit as many times as you like. Your best score stands, and each attempt tells you which checks passed so you can work the gaps.
  • Scored something you believe is correct? Use Report an issue on this page — that is exactly how the grading fixes in the changelog got found.

Create a free account to submit your lab for grading.

Create a free account
Found a problem with this lab?

Please sign in to report a problem — tying it to your attempts lets us reproduce and fix it faster.