ACL practice labs

CCNA L3 Switching: Filters on the VLAN Gateways

Finance must be walled off from general users. Write two filters and put each where its VLAN's traffic enters the switch.

CCNA55 min3 objectives

CCNA Break/Fix: The Management Filter That Guards Nothing

A security audit showed that routers accepted SSH from outside the management LAN despite an existing filter. Diagnose how the management ACL is bound to the VTY lines and make it govern which inbound sessions the routers accept, without breaking data-plane reachability.

CCNA40 min5 objectives

CCNA Break/Fix: The ACL That Blocks Too Much

Branch staff cannot reach the server at 172.16.100.100, and they cannot close a day's tickets without it. Policy also requires Telnet from the user LAN to that server be denied while everything else passes, and the security review cannot confirm it is being enforced. Work the path from a client and find what is wrong.

CCNA65 min4 objectives

CCNA IPv6 Capstone: Dual-Stack Site with OSPFv3 & ACL

Build an enterprise-clean dual-stack site end-to-end. IPv4 is complete and forwarding on day start; you will deploy IPv6 across the same topology. Enable IPv6 routing, assign prefixes, bring up OSPFv3 with explicit router-ids, keep the access LAN autoconfiguring via SLAAC with stateless DHCPv6 for DNS, and enforce an IPv6 ACL to allow one client flow to the server while denying another. Verify from the hosts and troubleshoot like a real operator.

CCNA95 min6 objectives

CCNA Foundations: IPv6 ACLs — Filter Without Breaking Discovery

Build a dual-stack branch-to-datacenter topology with IPv6 static routing in place. Implement a named IPv6 ACL on the server-facing interface that permits an approved client while denying an unapproved source, and explicitly permits Neighbor Discovery (ND) so the LAN continues to function. Verify that the allowed source can reach the server over IPv6 while the unapproved source fails, without disrupting IPv6 neighbor resolution.

CCNA55 min4 objectives

CCNA: Secure Branch Edge Capstone (ACL/PAT/DHCP/SSH)

One-branch edge capstone that unifies DHCP for the LAN, PAT overload to an Internet server, an extended ACL that permits HTTP but denies SSH, and SSH-only management. The starting lab intentionally contains multiple faults across DHCP, NAT, and SSH so you must diagnose and repair the edge to achieve full end-to-end verification from the client.

CCNA90 min5 objectives

CCNA Foundations: Secure Remote Access — Restrict VTY with access-class

Harden SSH access to a production router by allowing only a designated management workstation to connect. You will apply a standard ACL to the router's VTY lines with access-class, verify that the permitted host can SSH in, and confirm that a second host on the same LAN is refused. End-to-end IP forwarding is pre-built with static routes so the focus stays on management-plane control.

CCNA40 min4 objectives

CCNA Foundations: Named ACLs — Readable Rules & Editing by Sequence

Intermediate CCNA lab focused on named extended ACLs. You will permit a specific business flow (HTTP from the branch client to a data center web server) while denying ICMP to that server, apply the ACL inbound on the branch LAN interface, and validate from real endpoints. The baseline provides static routing and full connectivity; your task is to implement a readable, ordered named extended ACL with a remark and bind it correctly so the intended policy is enforced.

CCNA55 min5 objectives

CCNA: Extended ACLs — Match Protocol, Port, Destination

Deploy an extended ACL inbound near the source to allow HTTP from a client VLAN to a server while blocking ICMP to that same server. The lab uses router-on-a-stick over a hardened access switch with a routed transit to a core router hosting the server VLAN. You will implement, verify from endpoints, and troubleshoot matching by protocol, port, destination, and placement/direction.

CCNA65 min5 objectives

CCNA Foundations: Standard ACLs — Filter Traffic by Source

Build a compact two-router, three-host topology. Implement a numbered standard ACL on the destination router to permit Client-A and deny Client-B from reaching a protected server based solely on source subnet. Verify from the end hosts that permitted traffic succeeds and denied traffic fails, and practice correct ACL placement and direction.

CCNA40 min4 objectives

NAT Troubleshooting Capstone: Interface Role + ACL

Advanced NAT capstone, run as a fault hunt. Inside hosts cannot reach the internet, the translation table stays empty, and one host cannot even reach its own gateway. The lab is called NAT, which is the trap: not every fault here is a NAT fault. You get symptoms and the required end state — no fault list. Faults span the router, the switch and the path beyond, and fixing the translation alone will not restore service.

CCNA65 min5 objectives

PAT onto the Outside Interface (SOHO Edge)

Implement and verify interface-based PAT (overload) on a single-edge SOHO router. Inside hosts on 192.168.10.0/24 share the router’s lone public IP (203.0.113.1) on its outside interface. Validate NAT translations, ACL matches, and simultaneous host access, and practice troubleshooting common misconfigurations (inside/outside role reversal, ACL selection errors).

CCNA45 min6 objectives

NAT Selection with an ACL: PAT a Single Host Only

Configure PAT on an edge router so only PC-A is translated using a standard ACL as the traffic selector. PC-B remains untranslated and fails to reach the ISP, illustrating that NAT occurs only for traffic explicitly matched by the ACL. Validate using host pings and IOS show commands, and interpret ACL hit counters and NAT tables.

CCNA45 min5 objectives

CCNA NAT3: Dynamic NAT with an Address Pool

Configure dynamic one-to-one NAT using a public address pool on an IOS router between a private LAN and a simulated ISP. Two inside hosts draw from a two-address public pool on-demand. Validate that no translations exist before traffic, that each host receives a distinct global address after generating traffic, and that entries age out when idle.

CCNA38 min5 objectives

NAT at the Internet Edge with Default Routing

Build an Internet-edge NAT design that reaches beyond the ISP to a real external network. You will configure dynamic PAT (overload) from a private LAN to a public /29 using a NAT pool on the edge router, with the router’s default route already pointing to the ISP. Verify that an inside host can reach a public server across the ISP and that translations, counters, and default routing reflect the expected state.

CCNA45 min5 objectives

CCNA NAT4: PAT Overload onto a Pool

Implement Port Address Translation (PAT) using a one-address NAT pool so multiple inside hosts share a single public IP. Reuse the same 5-node topology and addressing as the prior lab; convert the pool to a single address and enable overload. Verify simultaneous connectivity from two inside hosts, observe translations and counters, and contrast with prior pool-exhaustion behavior.

CCNA45 min5 objectives

CCNA NAT9: Verifying & Clearing NAT

Operate, observe, and clear Cisco IOS PAT translations on an internet edge. You will configure a standard PAT overload on R1, generate multiple concurrent sessions from an inside host, read translation/state counters, and clear single and all entries to see how the table repopulates immediately under live traffic.

CCNA45 min4 objectives

ACL Troubleshooting Capstone: Classic Faults, NAT, Placement

Advanced ACL and NAT capstone, run as a fault hunt. A branch site was cut over last night and the policy does not behave: the flow that should be blocked gets through, other traffic does not come back at all, and nobody recorded what changed. You get symptoms and the required end state — no fault list. The faults span all three routers and include a shadowed ACE and a policy applied on the wrong side of NAT, so translated addresses hide the very hosts the rules name. Expect fixing the first one to change the symptom rather than clear it.

CCNA75 min5 objectives

Extended ACL Fundamentals: Permit HTTP, Deny Others

Deploy a numbered extended ACL on a router-on-a-stick topology to allow HTTP from a single approved client to a web server while denying all other TCP attempts to that server from the same user VLAN. Apply the ACL inbound near the source, verify with real client traffic, and troubleshoot using ACL hit counts and test flows.

CCNA50 min5 objectives

Selective Inter-VLAN Reachability: Guest Isolation

Build a router-on-a-stick design with three VLANs (SALES, HR, GUEST) on a single router and single access switch, then enforce guest isolation using a single extended ACL applied inbound on the Guest subinterface. SALES and HR can reach each other; GUEST can reach only its default gateway and is blocked from internal subnets. The lab focuses on correct 802.1Q tagging, trunking, access port assignments, ACL placement/order, and end-host verification.

CCNA55 min5 objectives

Extended ACL: Application Filtering at a Hardened Edge

Build a 5-node edge/DMZ topology. Implement a named extended ACL on the EDGE router to allow only TCP/80, TCP/443, and ICMP echo from the Inside LAN to a DMZ web server, deny all other traffic to that server with logging, and still permit general traffic elsewhere. Apply the ACL inbound on the EDGE inside LAN interface. Harden router SSH management with a standard ACL. Verify with wget, ping, and an intentionally denied SSH attempt that increments the deny log counter.

CCNA55 min5 objectives

Standard ACL: Permit Host & Subnet, Deny Others

Beginner CCNA ACL lab on a compact 5-node CML-Free topology. You will configure static routing end-to-end, implement source NAT (PAT) at the source edge, and then build a standard numbered ACL near the destination to allow a single NATed host and a specific subnet while denying all others. You will validate with pings from end hosts, observe ACL hit counters and NAT translations, and troubleshoot common mistakes such as ACL placement, wildcard masks, and pre-/post-NAT address matching.

CCNA55 min7 objectives

Free with an account

Secure Router VTY with ACL: Only Management Host Allowed

Configure a standard IPv4 ACL and bind it to the VTY lines on the HQ router so only the dedicated management host can SSH to it. Confirm that regular routed traffic between sites is unaffected, and prove both a permitted and a denied management attempt.

CCNA45 min5 objectives

CCNA: Named ACLs & Editing by Sequence Number

Hands-on ACL practice using named standard and extended ACLs, applied with correct placement and direction, edited by sequence number, and verified with counters and end-host tests. The lab adds a realistic NAT edge to expose order-of-operations pitfalls without obscuring data-plane ACL effects.

CCNA75 min6 objectives