Extended ACL: Application Filtering at a Hardened Edge

Bundle lab · $29.99

Build a 5-node edge/DMZ topology. Implement a named extended ACL on the EDGE router to allow only TCP/80, TCP/443, and ICMP echo from the Inside LAN to a DMZ web server, deny all other traffic to that server with logging, and still permit general traffic elsewhere. Apply the ACL inbound on the EDGE inside LAN interface. Harden router SSH management with a standard ACL. Verify with wget, ping, and an intentionally denied SSH attempt that increments the deny log counter.

Learning objectives

• Design and place an extended ACL near the traffic source; match exact subnets and specific L4 ports.
• Apply an extended ACL inbound on the correct interface and verify ordering, direction, and default deny behavior.
• Harden router VTY access with a standard ACL and SSH-only remote access.
• Use Linux tools (ping, wget, ssh) to validate allowed and denied flows and interpret ACL hit counters.
• Troubleshoot reachability, ACL placement, and static routing on an edge/DMZ topology.

Troubleshooting focus

• Verify every link's interface status and IP addressing (`show ip interface brief`) and correct any interface that is down or misaddressed.
• Confirm each device's running configuration matches the lab objective, and bring any interface, route, or service that is not in its expected state back to health.
• Trace end-to-end reachability with ping/traceroute and isolate the first hop where forwarding fails.