Goldfish Networks wordmark
BeginnerPublished 2026-06-25

Standard ACL: Permit Host & Subnet, Deny Others

Free preview — the first lab of Access Control Lists (ACLs)

Beginner CCNA ACL lab on a compact 5-node CML-Free topology. You will configure static routing end-to-end, implement source NAT (PAT) at the source edge, and then build a standard numbered ACL near the destination to allow a single NATed host and a specific subnet while denying all others. You will validate with pings from end hosts, observe ACL hit counters and NAT translations, and troubleshoot common mistakes such as ACL placement, wildcard masks, and pre-/post-NAT address matching.

Track
Est. time
55 minutes
Difficulty
Beginner
Topics

Learning objectives

  • Assign addressing to /24 LANs and /30 point-to-point links without overlap
  • Configure static routes so LAN-to-LAN traffic forwards end-to-end
  • Implement source NAT (PAT) on the source edge and verify translations
  • Create a standard numbered ACL to permit one host and one subnet with implicit deny
  • Apply the standard ACL near the destination in the correct direction so return traffic is not black-holed
  • Validate access with pings from hosts and observe ACL hit counters and NAT translations
  • Troubleshoot ACL placement, wildcard math, pre-/post-NAT matching, and mispointed static routes

Troubleshooting focus

  • CLIENT-A's ping 10.20.20.10 is denied and no permit line increments: the ACL matches the wrong source. RTR-DC-GW only sees the post-NAT address 10.0.12.1, so a permit written for 10.10.10.10 never matches.
  • SRV-APP's replies get dropped while client requests pass: the ACL is on the wrong direction. inbound there inspects server-sourced traffic instead.
  • CLIENT-B's ping 10.20.20.10 succeeds when it should fail: the wildcard is too broad. A /24 uses 0.0.0.255; something like 0.0.255.255 permits far more than the one approved subnet.
  • Nothing is reachable even before the ACL is applied: check the static routes. A next hop must be the neighbor's IP — RTR-A-EDGE toward 10.0.12.2, RTR-DC-GW toward 10.0.12.1. A route to your own address black-holes traffic.
  • The wrong entry takes the hits in show access-lists 11: statement order. the implicit deny handles the rest.

Topology

Lab topology diagram

Related labs

More hands-on Cisco Modeling Labs practice on the same track and topics.

Study this topic

Free guides, a command cheat sheet, and graded practice for this lab's topic.

Learn Access Control Lists (ACLs)What Is an Access Control List (ACL)?

Grade your work

How this lab is graded
  • Build it your way. Where a lab lets you choose a value — a VLAN name, an interface description — grading checks that you configured it, not which name you picked. Names that another line has to reference, like an ACL applied with access-class, are stated in the guide and do have to match.
  • Addresses, modes and protocol keywords are exact. An IP address, a subnet mask, switchport mode trunk, an encapsulation — these carry the meaning of the lab, so they are graded as written in the guide.
  • Grading reads your saved configuration. Export the lab from CML after you have configured it, and make sure anything you set is in the running-config — a change that only exists in a terminal session never reaches the grader.
  • You can submit as many times as you like. Your best score stands, and each attempt tells you which checks passed so you can work the gaps.
  • Scored something you believe is correct? Use Report an issue on this page — that is exactly how the grading fixes in the changelog got found.

Create a free account to submit your lab for grading.

Create a free account
Found a problem with this lab?

Please sign in to report a problem — tying it to your attempts lets us reproduce and fix it faster.