CCNA EXAM HAVE TWO SIMULATORS.
ACL SIM
CCNA CISA CCNP CISP
Answer:
Select the console on Corp1 router
Configuring ACL
Corp1>enable
Corp1#configure terminal
comment: To permit only Host C (192.168.33.3){source addr} to access finance server address (172.22.242.23) {destination addr} on port number 80 (web)
Corp1(config)#access-list 100 permit tcp host 192.168.33.3 host 172.22.242.23 eq 80
comment: To deny any source to access finance server address (172.22.242.23) {destination addr} on port number 80 (web)
Corp1(config)#access-list 100 deny tcp any host 172.22.242.23 eq 80
comment: To permit ip protocol from any source to access any destination because of the implicit deny any any statement at the end of ACL.
Corp1(config)#access-list 100 permit ip any any
Applying the ACL on the Interface
comment: Check show ip interface brief command to identify the interface type and number by checking the IP address configured.
Corp1(config)#interface fa 0/1
If the ip address configured already is incorrect as well as the subnet mask. this should be corrected in order ACL to work
type this commands at interface mode :
no ip address 192.x.x.x 255.x.x.x (removes incorrect configured ip address and subnet mask)
Configure Correct IP Address and subnet mask :
ip address 172.22.242.30 255.255.255.240 ( range of address specified going to server is given as 172.22.242.17 - 172.22.242.30 )
comment: Place the ACL to check for packets going outside the interface towards the finance web server.
Corp1(config-if)#ip access-group 100 out
Corp1(config-if)#end
Important: To save your running config to startup before exit.
Corp1#copy running-config startup-config
Verifying the Configuration :
Step1: show ip interface brief command identifies the interface on which to apply access list .
Step2: Click on each host A,B,C & D . Host opens a web browser page , Select address box of the web browser and type the ip address of finance web server(172.22.242.23) to test whether it permits /deny access to the finance web Server .
Step 3: Only Host C (192.168.33.3) has access to the server . If the other host can also access then maybe something went wrong in your configuration . check whether you configured correctly and in order.
Step 4: If only Host C (192.168.33.3) can access the Finance Web Server you can click on NEXT button to successfully submit the ACL SIM.
Any Questions on SIMULATOR welcomed.
Best of LUCK to your CCNA EXAM
CCNA CISA CCNP CISP
87 comments:
This is the first 'practice' SIM site that I have seen where you have to change the ip and mask on the int before you apply the acl to it. Does it vary from test to test?
Yes it varies. But for the NEW ACL SIM which is on exam we need to change the ip address and mask.
Its always better to check whether the interface ip are correctly configured.
cheers
Good explanation
what is the dif. between
access-list 100 permit any any
and
access-list 100 permit ip any any
Hi,
the difference is that if you don not specify protocol type(eg. IP) then the entry
access-list 100 permit any any applies to all protocols.
After creating/archieving our required permit and deny, shouldn't we permit all protocols as stated in the end of the question "All other traffic permited."
Hi,
For CCNA exam we are concerned only with IP protocol access-lists.
Cheers.
hello,
three questions? The access list range could be anything from 100-199 right?
secondly how sure can you be the fa o/1 interface was meant to be assigned 172.x.x.30 address?
Finally i notice #end I havent come across this as yet, is it required there especially on the interface menu. if required why did you have it in the global command when your were creating the acl?
Help appreciated
Hi,
1. Yes you are correct for extended-acl the acl no.s ranges from 100-199
2. Use the show ip interface brief command to identify the interface type and number by checking the ip address configured.
In the above config it is assumed that the fa 0/1 is on server side by checking the output of show ip interface brief command.
3. The #end command used on interface mode to exit directly to enable mode.
Hope this helps
Cheers
tht was a really good explanation. i hv one question though. shudn't the acl be placed on the interface connecting to the switch instead of interface connecting to the server, coz extended ACL is usually placed near to the source of the traffic. wud appreciate ur clarification on this point.
Hi chirag ,
You are correct that extended ACL should be placed near to source.
But the question also asks us to block all other web access to finance web server because the router corp1 has connection to core also chances of some hosts might access finance web server using this core for this reason the acl was placed near to the destination.
Hope this helps you,
Cheers
Hi,
Very good site. Very interewtng that you even have to change a wrongly configured IP address.
I have never taken a CCNA exam. Can you tell me do I have to retype somewhere all I have done for the LAB?
Or what I have done for the LAB in Console host is already the answer, so I don't have to retype all?
Hi belleangella,
All you need to do is configure the LAB via console .
No need to type it again but remember to save your config to startup before exit the LAB.
Cheers
Why you exactly use ip 172.22.242.30?
Are this SIM and questions still actual?
Hi,
This SIM is actual Question. However the ip address may be different for each user. If ur lucky you might get same IPs in real exam
Cheers
Friend, your blog is really helpful to me. Thank You very much for that.
I have one question, when you change the IP Address for the ACL, why do choose 172.22.242.30.
Even though i saw some explanations there, i still am not very clear on that.
I hope you would guide me.
Thanking You in Advance.
Regards,
Ganesh.P
Hi Ganesh,
your doubt about this command
ip address 172.22.242.30 255.255.255.240 ( range of address specified going to server is given as 172.22.242.17 - 172.22.242.30 )
Since the exhibit shows corp1 router has .30 ip address on server side interface configured and given information for Server side lan is 172.22.242.17 - 172.22.242.30
For this reason we choose to configure this 172.22.242.30 ip address on the interface.
Hope this helps
Cheers
Friend,
Many Thanks, for the explanation. I have a better picture now. I am attempting the exam this friday and its my third try.
Both the earlier trys, i only managed to get 745. So i am practicing hard. Hope i get through.
Thansk again, Friend,
Regards,
Ganesh.P
Hi,
I gave the ccna exam today & passed with 936 marks. I had 53 questions to answers in 120 mins and was required to score 839 marks. Overall I suggest anybody giving this exam to refer this blog and pass4sure 2.83 version. I found few wrong answers in the pass4sure (like acl sim), but this site had the great explanation with right answers.
thanks again for the help.
Bye
I failed the ICND exam twice in the past, i was using the home study guide to CCNA by Wendell ODOM
I was also using Exam Cram2, my advice to anyone is not to use that book, its crap. It does tie up some loose ends that the book doesnt cover but fot. the exam,wasnt much help
I read this website last night and downloaded p4s 2.83, i stayed up all night studying it and sat my exam today.
I passed the ICND exam today, 640-811, id say pass4sure 2.83 covered about 75-80% of the questions that came up on my exam today, word for word in alot of cases.
Ill do the intro exam next week,
Thanks to all who commented in this blog,
Cheers,
Gavin
no ip address 192.x.x.x 255.x.x.x
x here equal to what
Hi akrep,
no ip address 192.x.x.x 255.x.x.x
x here equal to what is configured on interface (depending on the ip address configured on fa 0/1 which is assumed here to be wrong.)
the exact value of x will be known using the command
show ip interface breif
look for fa 0/1 configured ip address.
Hope this helps
cheersw
How can I thank you for this explanation, now I get why you did it on the Fa0/1 going out of the router.
Thank you so much for taking the time, there are still good people out there willing to help others.
Take care and cheers!!!!
can you show an example of show ip interface brief, how it looks like when you see it, because I am not sure if it shows me the subnet mask. And how did u get the 255.255.255.240.
Pls explain.
Thanks.
Hi,
Show ip interface brief command provides you the ip address configured and the status of interface and protocol.
example of show ip interface command : http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a0080094707.shtml#topic1
Regarding the subnet 255.255.255.240 has been taken because in Question it tells that server LAN have been assigned address range 172.22.242.17-172.22.242.30
So for 14 usable host addresses the subnet mask is 255.255.255.240
Hope this helps
Cheers!!!
Thanks a lot; now it is clear.
i pass today same model ip address is different.
thanks to this simulation
Hi
Passed today 974.I found your help invaluable.Very educational. The ACL Sim's corp1 Fa0/1 port had the correct address and subnetmask so no need to change it But, you must check this as they do vary this.Luck of the draw etc...
Thanks once again for your help:)
Eddie
Hi,
I am a little confuse.
When you use the show ip int brief?
How do I define which is the right int that I should be use?
Hope you can explain this to me.
Thank a lots.
Hi,
The sim questions provides the exhibit with its ip address last octet.
use this for ref and also the question provides you the various ip addrress schemes used on different segments.
example in this question core connections uses 198.18.196.65
Hosts LAN uses 192.168.33.1 - 192.168.33.254
servers LAN uses 172.22.242.17 - 172.22.242.30
Based on above info you must identify the correct corresponding Interface from the Show ip int brief command
Hope this helps
Cheers!!!
THANK YOU FOR THIS SITE. I learned about it at Sadikhov forums. I Googled TI Blog as mentioned in Sadikhov and true enought the claims posted there that this site helps a lot. It is only now that I have understood in full the ACL SIM. I have stared at it over and over on a P4S reviewer but never was satisfied with their answer. I did have some doubts about their answer and then I read your answers here and now I am fully satisfied. Thanks for patience in answering the questions posted. I hope I will also pass the test this month.
I am scheduled to take the CCNa test on Fri the 21st and I believe that this site a great tool for preparing. I will argue with anyone that using this site is not cheating unless you have a photographic memory and happen to get the sme questions, but instead I think that it covers alot of grey areas that the book just doesn't explain and it offers real word terminology that really helps the adverage joe learn the finer points of the CCNA.
Keep up the great work and KUDOS!!
Great site and thanks loads for your contribution ^^
I had a question...it might be very naive. You said that the range for the servers are from 172.22.242.17 to 172.22.242.30 and that's why we chose to configure the interface with 172.22.242.30. I was wondering if it would be a problem if I used any ip from that range except for the one assigned for the Fin server 172.22.242.23.
Thanks for your time and keep up the good work.
Hi fatou,
Yes you can use a ip address for interface from the range 172.22.242.17 to 172.22.242.30 .
For good practise we use the first or the last usable ip for configuring the router interface address (here we have chosen the last useable ip address in the range bcoz in the exhibit we see .30 on the interface connecti ng to servers side).
Hope this helps.
Cheers
Hi A3tips,
Reading your blod is a pleasure because you explain in very simple way. Thank you for all efforts.
i m willing to give exam this month
the only problem is ACL!
i want to know the logic behind put ACL inbound or outbound ?
how to decide it?
if possible please explain it with any topology. It will be a great help for me.
thanks again!
TuSh!
Sir,
the "no shutdown" is required or not,after changing the lan interface ip and mask.
if we entered the following command
access list 100 permit tcp host 192.168.33.3 host 172.22.242.23 eq 80
is this sufficient becouse in the end of list there is implicit deny
Hi my albums,
You can use no shutdown command but its optional since the interface is already enabled.
So if you change ip address on interface it is not necessary to use no shut command if the interface is already enabled.
Hope this helps
Cheers
Hi tush,
Logic behind ACL inbound or outbound ...
Step 1 : Select the interface on which ur placing ACL statments.
this can be done based on standard or extended ACL type..
extended ACL should be placed near to source.
standard ACL should be placed near to destination
(Note: in our SIM we are placing extended ACL near to destination because the question also asks us to block all other web access to finance web server because the router corp1 has connection to core also chances of some hosts might access finance web server using this core for this reason the acl was placed near to the destination.)
Step 2: Once interface is selected its easy to identify in which direction to place the ACL.
Keep in mind that when placing ACL directions u imagine urself inside router and visualise the traffic flow direction.
If packets leaving the selected interface(step1) to our target ( destination address) then it is outbound acl i.e this outgoing packets are examined with acl statements to permit or deny.
if packets are coming in to the selected interface (step1) then it is inbound acl i.e this incoming packets are examined with acl statements to permit or deny.
Tip: In most cases if selected interface is near to source the acl is inbound
if selected interface is near to destination then acl is outbound
Hope this helps
Cheers!!!
Hey Man,
You are terrific..
Your explaination is very clear and specific.
u know u've solved my confusion about inbound and outbound buffer.
thank you very much!
now i m gonna take it on exam...
keep rocking!
TuSh!
Passed the CCNA today with an 885. This site and the pass4sure ver. 2.83, as stated by others, was very helpful.
Tman
Question? on the deny statement do you put the network to block then host or any and then the host? PS4 shows using the network.. and here shows using the any statement. I took and failed with an 839. I test again monday and then I did it with the network on the hosts were all able to access the finanace server which I figure now was a limitation of the sim?
Hi Andrew,
Consider this sequence of ACL statments for sim task
First ACL statement:
permit only host C to access finance web server web port.
Second ACL statement:
deny any other source to access finance web server web port
last ACL statement:
need to permit all other traffic
ACL statemenst are processed from the top to down once a match occurs for packet it ignores rest acl statements.
Example 1 as per exhibit Consider when host C tries to access finance web server web port since our first acl statement permits host C to access finance web server web port the packet is processed successfully.
Example 2:
Now Consider host B or any other host tries to access finance web server web port.
first acl statement has no match so it goes to second acl statement as per the second acl statement any source is denied to access finance server web port so packet is droped.
Example 3:
Now consider any source tries to access finance web server (except port 80) or dns server or any other destination address
Since first and second acl statements does not match here and only the last acl statement gets a match here and the packet is processed successfully.
For your doubt the deny statement consist any( any host or any ntw) as source address and finance web server web port as destination address.
Hope this helps
Cheers
Hi Andrew,
Consider this sequence of ACL statments for sim task
First ACL statement:
permit only host C to access finance web server web port.
Second ACL statement:
deny any other source to access finance web server web port
last ACL statement:
need to permit all other traffic
ACL statemenst are processed from the top to down once a match occurs for packet it ignores rest acl statements.
Example 1 as per exhibit Consider when host C tries to access finance web server web port since our first acl statement permits host C to access finance web server web port the packet is processed successfully.
Example 2:
Now Consider host B or any other host tries to access finance web server web port.
first acl statement has no match so it goes to second acl statement as per the second acl statement any source is denied to access finance server web port so packet is droped.
Example 3:
Now consider any source tries to access finance web server (except port 80) or dns server or any other destination address
Since first and second acl statements does not match here and only the last acl statement gets a match here and the packet is processed successfully.
For your doubt the deny statement consist any( any host or any ntw) as source address and finance web server web port as destination address.
Hope this helps
Cheers
Hi All
Thank you so much for the information. its help me a lot and pass the ccna exam on 10-10-07.
thank you.
Hi All,
As per Andrew's message. He used the (access-list 101 deny tcp any 172.22.242.23 eq 80) on the 2nd statement which I would agree that it would be the correct deny statement. But how could he failed the exam?
Which deny statement should we use, the one that denies the hosts LAN or the one that has "any" statement?
Please help.
Thanks,
Arruba
Hi Arruba ,
Yes the correct deny statement after permiting host C for webserver web port is
access-list 101 deny tcp any host 172.22.242.23 eq 80
That is what makes only host C capable to access the webserver web port.
last acl is to permit remaining all traffic from any to any.
Hope this helps
Cheeers
hey this website is cool ...i wrote CCNA exam on 19 th oct 2007 and got 974/1000 ....the sinulations explained here is very good ..Hats-off to person who created this cite ...please do it also for CCNP and other certifications
Hi all,
Thanks a3tips for giving us such a wonderful blog that makes ccna a cake walk. Cleared the exam, got 936.
@@@@@Few tips@@@@@
when u start the exam,there is instruction that it is good to clear sim questions in 10 min(not mandatory). Dont panic in exam on crossing 10 min. Take ur time. i dnt know whatz the advantage if u finish it in 10 min, but important thing is take your time to finish the sim. btw i took half n hr to finish access sim. I had problems saving the access list to startup config.
You may be prompted for filename. I gave some name and hit enter, did nt work and got a msg filename is "startup" followed by some err msg. checked sh start, access list was not saved.
then gain i entered cpy run start and this time saved the filename as "startup". this time it was saved and confirmed on sh startup-config.
Thanks
AmZ
could someone explain me why we assigning the acl on fa0/1 interface. extended acl are suppose to be assigned nearest to the source, so shouldnt we assign "ip access-group 100 in" on the 192.168.33.254 interface?
please explain.
Hi varunan,
Please check the comments sections above which is already explained
Hope this helps
Cheers
hey thanks. i figured out the reason. i read the question too fast and skipped the part where it stated that corp also shouldnt access the web server.
gotta remember to read the entire question slowly and carefully during the exam!!
thanks!!
Hi please help.
Which answer is correct?
the p4s' or the answer here?
Please let me know which deny statement is correct. and where to place the acl.
in p4s its:
access-list 100 deny tcp 192.168.33.0 0.0.0.255 host 172.22.242.23 eq 23
interface fa0/0 (.254)
ip access-group 100 in
Please help me figure out the real answer.
Thanks and more power
Confused.
Hi ,
P4s answer
deny statment denies only
192.168.33.0 network from accessing finance web server web port.
If you use this then u should place the acl on (.254) interface with IN direction.
blog deny statement denies all network traffic from accessing finance web server web port.
As per the Task on SIM is to deny all except permit Host C accessing finance web server web port.
Thats the reason ACL is placed in OUT direction on interface (.30) because there might be traffic from core trying to access finance web server web port.
Dont get confused.. both are correct except with above mentioned differences... so whatever method u choose stick to it. Dont mix both answers from P4s and here.
Hope this helps
Cheers
Really great for sharing your knowledge, i got 987 out of 1000 on 27 oct 2007.Thanks lot.
a3tips : Thank you very much for your help. I really appretiate it.
I passed today with 987 points
Bless you ;-)
can someone please tell me how you access the corp1 router console? do you click on the corp1 router or the pc console? Reason I asked is I could not access the console during the exam it would not open so I just skipped the question.
Click on the console PC attached to the crop1 router by doing so you should get the CLI of router.
Cheers!!
THANKS A LOT a3tips !!
I got through CCNA with 974 marks today. Your ACL Sim and VTP Sim explanations were really helpful.
I recommend using pass4sure and this website.
Cheers again for a3tips !!
You are great !!!
Hey guys,
Here is some more info on the simulations. There is one simulation I had last week which has two routers and two switches, one server and a workstation and a console. Router 1 connected to a server via switch. Console connection on this router. Router 2 connected to another switch connected to a workstation. You are provided with a ip range with /30 prefix for the two routers.
Just remember that this one requires you to use show cdp neighbor details command as router 1 attached to console does not have a IP address for s0.
CDP shows you ip address of router 2 serial interface as (so you need to know what the other router is using as the IP so you can set the second available IP address on router 1).
Later, It requires you to Telnet to the other router to setup that router 2's Fa0/0 interface to the workstation. You can then ping server to establish connection. Remember to copy running-config startup-config for both routers (don't know if its required but play safe).
I did not see that simulation here so thought would atleast explain it.
Hope this all helps and makes sense.
Cheers..
Hi All,
I passed the exam today scored 1000/1000. Thanks very much for all your help!!!
Just to let you guys know..The ACL question was the same but only host D was allowed to access the Finance server. I did the acl commands just as it is on the site but when I tried testing it,all the host were restricted(including host d). when I double checked the ip address subnet mask, interface all the details were correct. I spent 30 mins trying to figure this one out and still couldn't find out what was wrong so I saved it and skipped to the next ques. I got full marks which means the configurations were correct but for some reason the test wouldn't work. dunno how that is possible..
hi a3tips..
very nice explanation... i just passed the ccna with 987 marks... it really helped. God bless u for sharing ur knowledge unselfishly...
I was able to get the simulation correctly with Host B as the given problem...
with ur help i maybe be the last person to pass the ccna before the revision.. tnx a lot...
Cleared CCNA, 1000/1000.
Thank you all.
Confused
hi can enlighten me on this?
not sure if I can seek some answer here
I was a little confused here.
router is layer 3
switch is layer 2
vlan is layer 2 technic
if i had a router connecting to a switch configured with vlan and set with an IP to allow management and to a host,
so on the host, the gateway to use is the IP of the router's interface or the switch IP address?
Hi,
The gateway IP configured on host should be router IP.
Since switch may have multiple VLANs and configured with multi VLAN interfaces.. but to communicate between interVLAN we need gateway capabilites which is provided by router.
So host uses router IP as gateway address to get traffic out of its network or VLAN.
Hope this helps
Cheers
First, thank you for your blog. It is an invaluable resource! I don't have a problem writing out the ACL's themselves, but I always seem to screw up figuring out whether to apply them in or out to the interface with the access-group command. Can you explain it to where it's obvious which way it should be applied? Even Cisco's site is vague and ambiguous.
Thanks!
I passed with a 934 ! Thank you so much ! Any plans provide CCNP info ?
i took my CCNA exam today and passed with a 1000/1000 with the help of this site and p4s. I will be buying a pitcher to owner of this blog!
thanks for the help
passed on 22/05/2008 with 1000/1000
640/801 had vtp sim and access sim wiyh few question from each categorie
thank you for the vtp sim explanation just to add that if the switch is the root bridge there is a line saying " this is the root bridge" if not give you
the mac-adresse and interface connection as well see first fews lines rachid
Great website...thanks a lot for all the content. Passed with a 947 (my topology testlet crashed, so I could have got a lot higher). NAT sim and Topology sim were the sim's that I got. Keep up the good work!
i took my CCNA 64-801 exam today and passed with a 1000/1000 with the help of this site special ACL and VTP SIM . I will thank again a lot.
Quick question, what did you use to bring up a Web page on the Host to test when finished configuring on the Sim?
Thanks, very helpful site! I am taking the ICND2 next week.
John
Hi John,
The web brower is used to test the port 80 functionality on each host to reach finance server..
HTH
Cheers
Thanks everybody, information help me a lot and I pass today.
Really good explaination .Thanks for your help,and kiss you:)
I passed my ccna 640-801 with a score of 961. Thanks for everything a3tips. this is an amazing site. i recommend it to who evers doing this exam.
;)
passed today 923 - screw up at VTP sim - press next instead of scrool down.
This site was the most helpfull.
for 640-801 - ACL sim, VTP sim and some drag and drop, all the others can be found in pass4shure (640-801 v2.83 ) .
Thank you!
keep up the good work!
Dear All,
Thank you in advance. I am planning to give exam on 640-802 in next week. I am preparing from p4s 3.22 and from this site. Will I be able to go through this exam or do I have to prepare something extra. Please help me regarding this matter.
Hi iam going to take the CCNA 640-801 retired exam cause i did the Academy 3.1 all courses.
I would like to know if the Pass4sure v2.8 is the latest??
I will take the exam the exam 25 July 2009. I would really like to pass this exam.
A3tips do you know if with the Pass4sure v2.8 i will definitely pass the exam and your blog if i pass i will buy send a donation with paypal :) thanks for your tips
P.S any one that can send information in what else to study is welcome Thank send information here if you can: panamaaaron@hotmail.com
For the second line in the statement, are you sure we just don't type in this statement:
access-list 100 deny ip any host 172.22.242.23? If you read what the question says, it says deny all other traffic to this server, not just HTTP traffic. I trust that you are smarter than me and everything. I just want to do the right thing come exam day.
Hi,
Read the question properly : It's telling us "all other traffic is permited "
the second line is correct.(No other host should not have web access to finance server )
Then at 3rd line we are permitting all other traffic.
HTH
Cheers!!!
planning to take this june 2010, ask were to start with my review?
Hey Link..
Start with IP subnetting practise it as much as you can then move on to routing concepts, then switching part
Hi,
This ACL sim is coming up on the exam now!!!
Before everyone got the the nat, Ripv2 and frame relay ones.
Here's something that happened to me during the ACL sim. It locked up during the password prompt. It was so bad, that Pearson Vue tech support had to called. I was instructed to skip the question. Of course, that cost me a pass. PVue has since told me that this is how the sim is designed. If you do something wrong it is supposed to lock up. I don't buy it and I was hoping someone else had run into this same issue.
Thanks
Congratulations, your examples are very useful!
Wow this blogs have so many useful information. Would surely help with my CCNA exam :)
Post a Comment