Goldfish Networks wordmark
IntermediatePublished 2026-06-25

CCNA: Named ACLs & Editing by Sequence Number

Bundle lab

Hands-on ACL practice using named standard and extended ACLs, applied with correct placement and direction, edited by sequence number, and verified with counters and end-host tests. The lab adds a realistic NAT edge to expose order-of-operations pitfalls without obscuring data-plane ACL effects.

Track
Est. time
75 minutes
Difficulty
Intermediate
Topics

Learning objectives

  • Author named standard and extended IPv4 ACLs, referencing entries by name rather than by number.
  • Edit named ACLs by sequence number to insert and delete ACEs in place.
  • Apply extended ACLs inbound near the source and standard ACLs outbound near the destination.
  • Protect VTY access by binding a standard ACL as the inbound session filter on the router's VTY lines.
  • Verify ACL order and matches with show access-lists and hit counters.
  • Validate end-to-end effects with host-based tests and NAT-aware checks.

Troubleshooting focus

  • curl http://10.20.20.10 fails from CLIENT-A while NAT egress still works: check WEB-FILTER order. A broad deny ahead of the specific TCP/80 permit blocks the session — move the denies after the specific permits.
  • ping 10.20.20.10 from CLIENT-A gets replies: the ICMP deny to the server sits after a general permit. Re-insert it at a lower sequence.
  • ping 198.51.100.100 fails once the ACLs are applied: WEB-FILTER needs a general permit for the Branch subnet to any (NAT egress), applied near the source on RTR-A-BRANCH Ethernet0/1, not on the WAN transit.
  • Counters in show ip access-lists WEB-FILTER stay at zero: the ACL is on the wrong interface or direction. It must sit in the forward flow: CLIENT-A → RTR-A-BRANCH E0/1 in → RTR-A-BRANCH E0/0 → RTR-HQ-EDGE → RTR-HQ-EDGE E0/2 out → SRV-WEB.

Topology

Subscribe to preview this lab's topology.

See plans

Related labs

More hands-on Cisco Modeling Labs practice on the same track and topics.

Study this topic

Free guides, a command cheat sheet, and graded practice for this lab's topic.

Learn Access Control Lists (ACLs)What Is an Access Control List (ACL)?

Grade your work

How this lab is graded
  • Build it your way. Where a lab lets you choose a value — a VLAN name, an interface description — grading checks that you configured it, not which name you picked. Names that another line has to reference, like an ACL applied with access-class, are stated in the guide and do have to match.
  • Addresses, modes and protocol keywords are exact. An IP address, a subnet mask, switchport mode trunk, an encapsulation — these carry the meaning of the lab, so they are graded as written in the guide.
  • Grading reads your saved configuration. Export the lab from CML after you have configured it, and make sure anything you set is in the running-config — a change that only exists in a terminal session never reaches the grader.
  • You can submit as many times as you like. Your best score stands, and each attempt tells you which checks passed so you can work the gaps.
  • Scored something you believe is correct? Use Report an issue on this page — that is exactly how the grading fixes in the changelog got found.

Create a free account to submit your lab for grading.

Create a free account
Found a problem with this lab?

Please sign in to report a problem — tying it to your attempts lets us reproduce and fix it faster.