CCNA Cisco Certified Network Associate Study Guide - FTP Server

464 Chapter 9 � Managing Traffic with Access Lists
Lab 9.2: Extended IP Access Lists
In this lab, you will use an extended IP access list to stop host 172.16.10.2
from creating a Telnet session to router 2501B (172.16.20.2). However, the
host still should be able to ping the 2501B router. IP extended lists should be
placed closest to the source, so add the extended list on router 2501A.
1. Remove any access lists on 2501A and add an extended list to 2501A.
2. Choose a number to create an extended IP list. The IP extended lists
use 100–199.
3. Use a deny statement (you’ll add a permit statement in step 7 to allow
other traffic to still work).
2501A(config)#access-list 110 deny ?
An IP protocol number
ahp Authentication Header Protocol
eigrp Cisco's EIGRP routing protocol
esp Encapsulation Security Payload
gre Cisco's GRE tunneling
icmp Internet Control Message Protocol
igmp Internet Gateway Message Protocol
igrp Cisco's IGRP routing protocol
ip Any Internet Protocol
ipinip IP in IP tunneling
nos KA9Q NOS compatible IP over IP tunneling
ospf OSPF routing protocol
pcp Payload Compression Protocol
tcp Transmission Control Protocol
udp User Datagram Protocol
4. Since you are going to deny Telnet, you must choose TCP as a Transport
layer protocol:
2501A(config)#access-list 110 deny tcp ?
A.B.C.D Source address
any Any source host
host A single source host