CCNA: Extended ACLs — Match Protocol, Port, Destination

Today's daily lab

Deploy an extended ACL inbound near the source to allow HTTP from a client VLAN to a server while blocking ICMP to that same server. The lab uses router-on-a-stick over a hardened access switch with a routed transit to a core router hosting the server VLAN. You will implement, verify from endpoints, and troubleshoot matching by protocol, port, destination, and placement/direction.

Learning objectives

• Design and place an extended ACL inbound close to the source
• Match source network, destination host, protocol, and TCP port in a single ACL
• Order ACEs correctly with an explicit final permit
• Bind an ACL to the correct interface and direction
• Verify allowed HTTP succeeds while ICMP to the server is blocked from the client

Troubleshooting focus

• Verify the ACL applies to the correct interface and inbound direction near the source
• Confirm ACE ordering: specific permits before denies and an explicit final permit
• Check the exact destination host IP and TCP port match
• Ensure trunks carry the correct VLANs so packets actually hit the filtered interface
• Validate static routes on both routers so the HTTP flow returns successfully