Listas de Control de Acceso Estándar

1-Armado de Maqueta


2-Habilite protocolo de ruteo para que sean alcanzables todas las redes

Router3(config)#router rip
Router3(config-router)#net
Router3(config-router)#network 200.210.222.0
Router3(config-router)#network 200.210.222.132
Router3(config-router)#version 2 

3-Verifique mediante Ping que todas las PC se alcancen unas con otras

4-Habilite el acceso por terminal  virtual VTY

Username Admin secret cisco

Line vty 0 4

Secret class

Login local

5-Verifique que todas las PC pueden administrar remotamente todos los routers

login as: admin
Using keyboard-interactive authentication
Router_3>en
Router_3#
Password:

6-Aplicar listas de acceso a las interfaces para que las PC no accedan por administración remota.

access-list 10 deny   200.210.220.2
access-list 10 deny   200.210.221.2
access-list 10 deny   200.210.222.2
access-list 10 permit any
access-list 102 deny   tcp 10.96.0.0 0.31.255.255 10.64.0.0 0.31.255.255 eq smtp
access-list 102 permit ip any any

7-Conteste las siguientes preguntas 
    *¿Funcionan los Pings entre las PC? 
             Si 
    *¿Como se podría limitar solo el acceso a la consola sin limitar todo el tráfico? 
             Delimitando un rango en las redes que hay que negar 

8-Aplique la misma lista de control de acceso ahora a las terminales virtuales VTY

Router_3(config)#int g 0/0 
Router_3(config-if)#ip access-group 10 in 
Router_3(config-if)#line vty 0 4 
Router_3(config-line)#access 
Router_3(config-line)#access-class 10 in 
Router_3(config-line)#end 


9-Verifique el estatus de las terminales con el comando show lines

 Router_3#show running-config
Building configuration...

Current configuration : 2121 bytes
!
! Last configuration change at 02:39:47 UTC Fri May 6 2016
!
version 15.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router_3
!
boot-start-marker
boot-end-marker
!
!
enable secret 5 $1$Kv16$DTwQKzJs1NLNX2rEz5Lok/
!
no aaa new-model
!
!
!
!
!
!
!
!
!
!
!
ip dhcp excluded-address 10.96.0.1
!
ip dhcp pool pool
 network 10.96.0.0 255.224.0.0
 default-router 10.96.0.1
!
!
!
ip domain name cisco.com
ip cef
ipv6 unicast-routing
ipv6 cef
multilink bundle-name authenticated
!
!
cts logging verbose
!
!
license udi pid CISCO2901/K9 sn FJC1853A09U
!
!
username admin secret 5 $1$zRxs$XfZtH3OK0NtZXoggtZWy4/
!
redundancy
!
!
ip ssh version 2
!
!
!
!
interface Embedded-Service-Engine0/0
 no ip address
 shutdown
!
interface GigabitEthernet0/0
 ip address 10.96.0.1 255.224.0.0
 ip access-group 102 in
 duplex auto
 speed auto
!
interface GigabitEthernet0/1
 ip address 200.210.222.1 255.255.255.128
 ip access-group 10 in
 duplex auto
 speed auto
!
interface Serial0/0/0
 ip address 200.210.222.134 255.255.255.252
 clock rate 64000
!
interface Serial0/0/1
 ip address 10.192.0.1 255.224.0.0
 clock rate 64000
!
router ospf 1
 network 10.96.0.0 0.31.255.255 area 0
 network 10.160.0.0 0.31.255.255 area 0
 network 10.192.0.0 0.31.255.255 area 0
!
router rip
 version 2
 network 172.16.0.0
 network 200.165.200.0
 network 200.210.220.0
 network 200.210.221.0
 network 200.210.222.0
 network 209.165.200.0
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
!
ipv6 router rip process1
!
!
!
access-list 10 deny   200.210.220.2
access-list 10 deny   200.210.221.2
access-list 10 deny   200.210.222.2
access-list 10 permit any
access-list 102 deny   tcp 10.96.0.0 0.31.255.255 10.64.0.0 0.31.255.255 eq smtp
access-list 102 permit ip any any
!
control-plane
!
!
!
line con 0
line aux 0
line 2
 no activation-character
 no exec
 transport preferred none
 transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
 stopbits 1
line vty 0 4
 access-class 10 in
 login local
 transport input ssh
!
scheduler allocate 20000 1000
!
end