- [Instructor] In this lab, we want to look at troubleshooting
and IP version 4 access control list.
We have a typology in which we're told
that a user on PC1, is not able to telnet
to a device on the other side
of our network at 192.168.0.50.
However, pings to this device are successful from PC1.
We can ping the 192.168.0.50 address,
which means we don't necessarily have a routing issue,
and maybe we need to look deeper.
So go ahead and pause the video,
import the attached YAML file into Cisco Modeling Labs
so that you can use our base topology
and see if you can resolve
the IP version 4 access control list issue.
Once you do that, you can resume the video
and we'll walk through the solution together.
(upbeat music)
First, let's verify our issue here from PC1,
by saying telnet 192.168.0.50,
you can see we get an error stating that the connection
could not open the destination is unreachable.
So let's try to ping that, same IP address 192.168.0.50
and we can indeed ping that, so that is successful.
We have a couple of options here that could be causing this.
The first thing I would check is to ensure that telnet
is actually enabled on our telnet device.
So let's jump over to that router
and make sure we have that in place.
Let's say, sh run | s line,
because telnet should be configured on our lines,
and here we see under our vty lines, 0 4,
we have a password of Cisco set,
we have the transport input method set to telnet.
So that looks good.
We do in fact, have the telnet service in place,
so we know telnet is enabled.
Let's go to our router, that's connecting into this
and just verify that we can indeed telnet.
We'll say, telnet 192.168.0.50.
We are prompted for our password I'll put in Cisco.
You'll notice the command line prompt did change
to the telnet router.
So, we are successfully able to telnet..
So, telnet's up and working on the device.
So, it seems like we have some sort of access issue.
That's a really good indicator of this.
Let's say on router one,
we'll go back here
and see if we have something that's stopping us
from accessing that from this specific host.
My suspicions first would be an access control list.
So let's say sh ip access-lists,
and you'll see we have a single extended IP access list
in place, number 100.
We see a permit statement at the top
with our telnet servers IP address, with our PCs IP address.
We also see a deny statement just below that, by the way,
this top permit statement is saying it's allowing
the telnet protocol, so that's good.
We see a deny statement that is denying every other host
on our 10.1.1.0 network from reaching that via telnet.
We see one just below that, that is the same thing,
only it's denying FTP access.
And of course we see our final permit statement,
so there's no problem with that either.
Remember there's an implicit deny all
at the end of every ACL,
so we need that permit statements to allow that.
So again, remember these are red from top to bottom.
So we want our more specific entries near the top,
which we do have.
We have our specific permit statement at the top
and at the bottom we have our lease specific,
which is our permit IP any any.
So what's going on here?
Well, if you have a closer look,
you'll notice that the permit statement
is actually incorrect.
These two IP addresses have in fact been transposed,
they're in the wrong spot.
When we create a permit or deny statement,
the first IP address should indicate the host,
the actual entity that we're trying to filter.
So, as this statement is read, currently as it's written,
it's actually doing this backwards.
We're permitting TCP host, 192.168.0.50,
which is our telnet router.
We're permitting that host to telnet to our PC,
at 10.1.1.50.
So, we have a very common error here.
This is an easy mistake to make when it comes to ACLs.
So let's correct the issue and let's do some testing.
Let's go under global configuration mode,
we'll say, ip access-list.
We can see this is extended ACL 100.
I need to say extended 100.
And now we are under access control list configuration mode.
So first let's remove our incorrect permit statement.
Let's say, no permit tcp host 192.168.0.50
to host 10.1.1.50 eq telnet.
So, we'll take that statement out of there.
Now, luckily we're using an extended ACL here.
Remember that we can reorder our statements
with an extended ACL, any way we want.
If this were a standard ACL,
and we added a new permit command,
that would be upended automatically at the bottom
of our ACL.
And that means our less specific permit statement,
that would permit telnet traffic specifically from our PC,
that would be at the bottom of our ACL.
And that would actually block us from telnet access.
And that's because once an ACL sees a matched statement
that would be processed and the first one it would process
would be of course this one,
because our permitted statement would be at the bottom.
So it would deny us telnet access to our telnet router.
So that's a very important consideration.
So, in order to readd our statement correctly,
if we look at contextual help,
you'll see we can set a sequence number here.
So that's going to let us place that exactly in our ACL,
where we want it.
You can see our original sequence number
for the permit statement was 10,
so I'm just going to use sequence number 10.
And then this time, I'm going to put in the correct command.
So I wannna say permit tcp host, this time we want,
10.1.1.50, which is our PC,
to host 192.168.0.50, which is our telnet device,
and we want to say, eq telnet.
And I misspelled it.
There we go.
So that looks good.
Let's break out of there,
and let's again say, sh ip access-lists.
Now we can see our updated permit statement in place
as we want.
We revise that and it's went to the top of our ACL
using sequence number 10, so that looks good.
Let's try this out.
Let's go back to PC1,
let's again try to telnet to 192.168.0.50.
And this time we are prompted for our password,
which is of course, Cisco,
the command line prompt changes to telnet,
letting us know that we did get
a successful telnet connection to this router.
So that's a look at troubleshooting and IP version 4 ACL.