Extended ACL Fundamentals: Permit HTTP, Deny Others

Bundle lab · $29.99

Deploy a numbered extended ACL on a router-on-a-stick topology to allow HTTP from a single approved client to a web server while denying all other TCP attempts to that server from the same user VLAN. Apply the ACL inbound near the source, verify with real client traffic, and troubleshoot using ACL hit counts and test flows.

Learning objectives

• Design and apply a numbered extended IPv4 ACL that matches source, destination, protocol, and TCP port.
• Place an extended ACL near the source and apply in the correct direction to filter intended traffic.
• Allow HTTP (TCP/80) from a specific client to a web server; deny other TCP flows to that server.
• Verify operational impact with ACL hit counts and real traffic generation from end hosts.
• Troubleshoot ACL order, placement, and direction issues that cause unexpected denials.

Troubleshooting focus

• Verify every link's interface status and IP addressing (`show ip interface brief`) and correct any interface that is down or misaddressed.
• Confirm each device's running configuration matches the lab objective, and bring any interface, route, or service that is not in its expected state back to health.
• Trace end-to-end reachability with ping/traceroute and isolate the first hop where forwarding fails.