cisco ccna 200-301 lab

cisco ccna 200-301 lab.Router(config)# access-list 2 anyRouter(config)# interface ethernet 0 word any. here is the modified configuration. Router(config-if)# ip access-group 1 outThere is actually one more problem with this configuration. As you may have guessed, the ACL number specified when activating the ACL on the interface is incorrect. Note that the number specified when creating the ACL is 2, while the number specified when applying the ACL on the interface is 1. To fix this problem, use the following configuration.Router(config)# interface ethernet 0Router(config-if)# no ip access-group 1 outRouter(config-if)# ip access-group 2 outNote that to apply the new ACL, you must first remove the old ACLo from the interfaceExam Point Be sure to be able to troubleshoot ACL configurations by checking the order of the ACL statements. The preceding example demonstrates a common ACL configuration error.Restricting Access to the Router via VTY In addition to filtering traffic entering or leaving the interface, standard IP ACLs can be used to restrict access to the router via VTY ( Telnet and SSH). You may want to do this so that only network administrators are allowed remote access to the CLI of the IOS device. this configuration is almost identical to restricting access to the IOS device through the interface. First, you need to create a standard ACL that contains permit statements that allow remote access to the network administrator; these statements contain the IP address of the network administrator's PC. Next, the ACL needs to be activated, but not on the router interface, otherwise it will allow all traffic from the administrator to pass through and discard all other traffic. As described in Chapter 16, when accessing the router via Telnet or SSH, the router associates this connection to a VTY line. Therefore, you need to apply this standard ACL to the VTY, as follows. Router(config)# line vty 0 4 Router(config-line)# access-class standard_ACL_# in|outAlso U forget that the router supports 5 VTY lines by default (0.4 ), and some IOS devices support more VTY lines. All VTYs can be configured at the same time, for which you can specify the starting and ending line numbers after the vty parameter. If you do not restrict all VTYs, you will be left with a back door into the router, which may lead to security issues.