UNIVERSIDAD TCNICA DEL NORTE

FICA CIERCOM NETWORKING II

ONOFRE DUSTIN

--------------------------

2013 01 - 03

INFORME SIMULACIN
(20 listas de control de acceso)
1. TEMA: Aplicacin de listas de control de acceso en la simulacin de una red.
2. OBJETIVOS:
2.1. Objetivo General:
Aplicar los conocimientos sobre listas de control de acceso (ACLs) para la
configuracin de la red en base a la topologa establecida y a los requerimientos
impuestos por cada estudiante.
2.2. Objetivos Especficos:

Realizar las configuraciones bsicas del router.

Configurar los servidores y PCs de acuerdo a la topologa de red.
Configurar las ACLs.
Verificar las ACL.

3. DESARROLLO:

Diagrama topolgico de la red

Equipo
R1

R2

R3
PC0
PC1
PC2
PC3
PC4
PC5
PC6
Central Voz
(con H323)
SMTP
WEB2
SNMP
POP3
WEB1 (https)
FTP
TFTP
SIP
DNS

Interface
S0/2/0
Fa0/0
Fa0/1
S0/2/0
S0/2/1
Fa0/0
S0/2/1
Fa0/0
NIC
NIC
NIC
NIC
NIC
NIC
NIC

Direccin IP
10.0.0.1
192.168.1.20
192.168.2.129
10.0.0.2
200.107.50.2
172.16.0.20
200.107.50.1
192.168.10.20
192.168.1.2
192.168.1.3
192.168.1.4
192.168.1.5
172.16.0.2
172.16.0.3
172.16.0.4

Mscara
255.255.255.252
255.255.255.0
255.255.255.0
255.255.255.252
255.255.255.252
255.255.255.0
255.255.255.252
255.255.255.0
255.255.255.0
255.255.255.0
255.255.255.0
255.255.255.0
255.255.255.0
255.255.255.0
255.255.255.0

Gateway
192.168.1.20
192.168.1.20
192.168.1.20
192.168.1.20
172.16.0.20
172.16.0.20
172.16.0.20

NIC

192.168.2.128

255.255.255.0

192.168.2.129

NIC
NIC
NIC
NIC
NIC
NIC
NIC
NIC
NIC

172.16.0.5
172.16.0.10
192.168.10.5
192.168.10.6
192.168.10.7
192.168.10.8
192.168.10.9
192.168.10.10
192.168.10.11

255.255.255.0
255.255.255.0
255.255.255.0
255.255.255.0
255.255.255.0
255.255.255.0
255.255.255.0
255.255.255.0
255.255.255.0

172.16.0.20
172.16.0.20
192.168.10.20
192.168.10.20
192.168.10.20
192.168.10.20
192.168.10.20
192.168.10.20
192.168.10.20

Tabla de direccionamiento IP de la red

TAREA 1: Configuraciones bsicas del router
R1:
Router>enable
Router#configure terminal
Router(config)#hostname R1
R1(config)#no ip domain-lookup
R1(config)#banner motd #Networking III, Dustin Onofre#
R1(config)#line console 0
R1(config-line)#password cisco
R1(config-line)#login

R1(config-line)#exit
R1(config)#line vty 0 4
R1(config-line)#password cisco
R1(config-line)#login
R1(config-line)#exit
R1(config)#enable password cisco
R1(config)#enable secret class
R1(config)#interface serial 0/2/0
R1(config-if)#ip address 10.0.0.1 255.255.255.252
R1(config-if)#clock rate 64000
R1(config-if)#no shutdown
R1(config-if)#exit
R1(config)#interface fastEthernet 0/0
R1(config-if)#ip address 192.168.1.20 255.255.255.0
R1(config-if)#no shutdown
R1(config-if)#exit
R1(config)#interface fastEthernet 0/1
R1(config-if)#ip address 192.168.2.129 255.255.255.0
R1(config-if)#no shutdown
R1(config-if)#exit
R1(config)#router ospf 1
R1(config-router)#network 192.168.1.0 0.0.0.255 area 0
R1(config-router)#network 10.0.0.0 0.0.0.3 area 0
R1(config-router)#exit
R1(config)#
R2:
Router>enable
Router#configure terminal
Router(config)#hostname R2
R2(config)#no ip domain-lookup
R2(config)#banner motd #Networking III, Dustin Onofre#
R2(config)#line console 0
R2(config-line)#password cisco
R2(config-line)#login
R2(config-line)#exit
R2(config)#line vty 0 4
R2(config-line)#password cisco
R2(config-line)#login
R2(config-line)#exit
R2(config)#enable password cisco
R2(config)#enable secret class
R2(config)#interface serial 0/2/0

R2(config-if)#ip address 10.0.0.2 255.255.255.252

R2(config-if)#no shutdown
R2(config-if)#exit
R2(config)#interface serial 0/2/1
R2(config-if)#ip address 200.107.50.2 255.255.255.252
R2(config-if)#clock rate 64000
R2(config-if)#no shutdown
R2(config-if)#exit
R2(config)#interface fastEthernet 0/0
R2(config-if)#ip address 172.16.0.20 255.255.255.0
R2(config-if)#no shutdown
R2(config-if)#exit
R2(config)#router ospf 1
R2(config-router)#network 172.16.0.0 0.0.0.255 area 0
R2(config-router)#network 10.0.0.0 0.0.0.3 area 0
R2(config-router)#network 200.107.50.0 0.0.0.3 area 0
R2(config-router)#exit
R2(config)#
R3:
Router>enable
Router#configure terminal
Router(config)#hostname R3
R3(config)#no ip domain-lookup
R3(config)#banner motd #Networking III, Dustin Onofre#
R3(config)#line console 0
R3(config-line)#password cisco
R3(config-line)#login
R3(config-line)#exit
R3(config)#line vty 0 4
R3(config-line)#password cisco
R3(config-line)#login
R3(config-line)#exit
R3(config)#enable password cisco
R3(config)#enable secret class
R3(config)#interface serial 0/2/1
R3(config-if)#ip address 200.107.50.1 255.255.255.252
R3(config-if)#no shutdown
R3(config-if)#exit
R3(config)#interface fastEthernet 0/0
R3(config-if)#ip address 192.168.10.20 255.255.255.0
R3(config-if)#no shutdown
R3(config-if)#exit

R3(config)#router ospf 1
R3(config-router)#network 192.168.10.0 0.0.0.255 area 0
R3(config-router)#network 200.107.50.0 0.0.0.3 area 0
R3(config-router)#exit
R3(config)#
TAREA 2: Configuracin de PCs y Servidores
PC0:

PC1:

PC2:

PC3:

PC4:

PC5:

PC6:

SMTP:

WEB2:

SNMP:

POP3:

WEB1:

FTP:

TFTP:

SIP:

DNS:

Central de Voz:

TAREA 3: Configuracin de ACLs

1. De la red 172.16.0.0/24 solo los host 2 y 3 tengan acceso a los servidores FTP
y DNS.
R2(config)#ip access-list extended uno
R2(config-ext-nacl)#permit tcp host 172.16.0.2 host 192.168.10.8 eq 21
R2(config-ext-nacl)#permit tcp host 172.16.0.3 host 192.168.10.8 eq 21
R2(config-ext-nacl)#permit tcp host 172.16.0.2 host 192.168.10.11 eq 53
R2(config-ext-nacl)#permit tcp host 172.16.0.3 host 192.168.10.11 eq 53
R2(config-ext-nacl)#deny tcp 172.16.0.0 0.0.0.255 host 192.168.10.8 eq 21
R2(config-ext-nacl)#deny tcp 172.16.0.0 0.0.0.255 host 192.168.10.11 eq 53
R2(config-ext-nacl)#permit ip any any
R2(config-ext-nacl)#exit
R2(config)#interface serial 0/2/1
R2(config-if)#ip access-group uno out
R2(config-if)#exit
R2(config)#
2. Que los host 2 y 4 de la red 192.168.1.0/24 no accedan al servidor SMTP Y
SNMP.
R1(config)#ip access-list extended dos
R1(config-ext-nacl)#deny tcp host 192.168.1.2 host 172.16.0.5 eq 25
R1(config-ext-nacl)#deny tcp host 192.168.1.4 host 172.16.0.5 eq 25
R1(config-ext-nacl)#deny udp host 192.168.1.2 host 192.168.10.5 eq 161
R1(config-ext-nacl)#deny udp host 192.168.1.4 host 192.168.10.5 eq 161
R1(config-ext-nacl)#permit ip any any
R1(config-ext-nacl)#exit
R1(config)#interface serial 0/2/0
R1(config-if)#ip access-group dos out
R1(config-if)#exit
R1(config)#
3. De la red 192.168.1.0 /24 solo los host .4 y .5 puedan acceder a los servicios
del servidor WEB1 y DNS.
R1(config)#ip access-list extended tres

R1(config-ext-nacl)#permit tcp host 192.168.1.4 host 192.168.10.7 eq 80

R1(config-ext-nacl)#permit tcp host 192.168.1.5 host 192.168.10.7 eq 80
R1(config-ext-nacl)#permit tcp host 192.168.1.4 host 192.168.10.11 eq 53
R1(config-ext-nacl)#permit tcp host 192.168.1.5 host 192.168.10.11 eq 53
R1(config-ext-nacl)#deny tcp 192.168.1.0 0.0.0.255 host 192.168.10.7 eq 80
R1(config-ext-nacl)#deny tcp 192.168.1.0 0.0.0.255 host 192.168.10.11 eq 53
R1(config-ext-nacl)#permit ip any any
R1(config-ext-nacl)#exit
R1(config)#interface serial 0/2/0
R1(config-if)#ip access-group tres out
R1(config-if)#exit
R1(config)#
4. De la red 172.16.0.0/24 el host .2, no pueda hacer ping a los host .2 y .5 de la
red 192.168.1.0/24
R1(config)#ip access-list extended cuatro
R1(config-ext-nacl)#deny ip host 172.16.0.2 host 192.168.1.2
R1(config-ext-nacl)#deny ip host 172.16.0.2 host 192.168.1.5
R1(config-ext-nacl)#deny ip host 172.16.0.2 host 192.168.1.5
R1(config-ext-nacl)#permit ip any any
R1(config-ext-nacl)#exit
R1(config)#interface serial 0/2/0
R1(config-if)#ip access-group cuatro out
R1(config-if)#exit
R1(config)#
5. Denegar el servicio POP3 a las primeras 20 direcciones ip usables de la red
192.168.1.0/24 y permitir todas las dems.
R1(config)#ip access-list extended cinco
R1(config-ext-nacl)#deny tcp host 192.168.1.1 host 192.168.10.6 eq 110
R1(config-ext-nacl)#deny tcp host 192.168.1.2 host 192.168.10.6 eq 110
R1(config-ext-nacl)#deny tcp host 192.168.1.3 host 192.168.10.6 eq 110
R1(config-ext-nacl)#deny tcp host 192.168.1.4 host 192.168.10.6 eq 110
R1(config-ext-nacl)#deny tcp host 192.168.1.5 host 192.168.10.6 eq 110
R1(config-ext-nacl)#deny tcp host 192.168.1.6 host 192.168.10.6 eq 110
R1(config-ext-nacl)#deny tcp host 192.168.1.7 host 192.168.10.6 eq 110
R1(config-ext-nacl)#deny tcp host 192.168.1.8 host 192.168.10.6 eq 110
R1(config-ext-nacl)#deny tcp host 192.168.1.9 host 192.168.10.6 eq 110
R1(config-ext-nacl)#deny tcp host 192.168.1.10 host 192.168.10.6 eq 110
R1(config-ext-nacl)#deny tcp host 192.168.1.11 host 192.168.10.6 eq 110
R1(config-ext-nacl)#deny tcp host 192.168.1.12 host 192.168.10.6 eq 110
R1(config-ext-nacl)#deny tcp host 192.168.1.13 host 192.168.10.6 eq 110

R1(config-ext-nacl)#deny tcp host 192.168.1.14 host 192.168.10.6 eq 110

R1(config-ext-nacl)#deny tcp host 192.168.1.15 host 192.168.10.6 eq 110
R1(config-ext-nacl)#deny tcp host 192.168.1.16 host 192.168.10.6 eq 110
R1(config-ext-nacl)#deny tcp host 192.168.1.17 host 192.168.10.6 eq 110
R1(config-ext-nacl)#deny tcp host 192.168.1.18 host 192.168.10.6 eq 110
R1(config-ext-nacl)#deny tcp host 192.168.1.19 host 192.168.10.6 eq 110
R1(config-ext-nacl)#deny tcp host 192.168.1.20 host 192.168.10.6 eq 110
R1(config-ext-nacl)#permit ip any any
R1(config-ext-nacl)#exit
R1(config)#interface serial 0/2/0
R1(config-if)#ip access-group cinco out
R1(config-if)#exit
R1(config)#
6. Denegar el servicio SIP al computador 172.16.0.3 y al computador
192.168.1.5 y permitir todas las dems.
R2(config)#ip access-list extended seis
R2(config-ext-nacl)#deny udp host 172.16.0.3 host 192.168.10.10 eq 5060
R2(config-ext-nacl)#permit ip any any
R2(config-ext-nacl)#exit
R2(config)#interface serial 0/2/1
R2(config-if)#ip access-group sies out
R2(config-if)#exit
R2(config)#
R1(config)#ip access-list extended seis
R1(config-ext-nacl)#deny udp host 192.168.1.5 host 192.168.10.10 eq 5060
R1(config-ext-nacl)#permit ip any any
R1(config-ext-nacl)#exit
R1(config)#interface serial 0/2/0
R1(config-if)#ip access-group seis out
R1(config-if)#exit
R1(config)#
7. Permitir que solo los host de la red 192.168.1.0/24 puedan acceder a los
servicios de DNS y el resto pueda acceder a todos los servicios excepto DNS.
R1(config)#ip access-list extended siete
R1(config-ext-nacl)#deny tcp 192.168.1.128 0.0.0.127 host 192.168.10.11 eq 53
R1(config-ext-nacl)#permit ip any any
R1(config-ext-nacl)#exit
R1(config)#interface serial 0/2/0
R1(config-if)#ip access-group siete out

R1(config-if)#exit
R1(config)#
R2(config)#ip access-list extended siete
R2(config-ext-nacl)#deny tcp 172.16.0.0 0.0.0.255 host 192.168.10.11 eq 53
R2(config-ext-nacl)#permit ip any any
R2(config-ext-nacl)#exit
R2(config)#interface serial 0/2/1
R2(config-if)#ip access-group siete out
R2(config-if)#exit
R2(config)#
8. Permitir que los hosts 192.168.1.3 y 192.168.1.4 tengan acceso a todos los
servidores, excepto a: SMTP y TFTP; y que el resto de la red tenga libre
acceso a los mismos.
R1(config)#ip access-list extended ocho
R1(config-ext-nacl)#deny tcp host 192.168.1.3 host 172.16.0.5 eq 25
R1(config-ext-nacl)#deny tcp host 192.168.1.4 host 172.16.0.5 eq 25
R1(config-ext-nacl)#deny udp host 192.168.1.3 host 192.168.10.9 eq 61
R1(config-ext-nacl)#deny udp host 192.168.1.4 host 192.168.10.9 eq 61
R1(config-ext-nacl)#permit ip any any
R1(config-ext-nacl)#exit
R1(config)#interface serial 0/2/0
R1(config-if)#ip access-group ocho out
R1(config-if)#exit
R1(config)#
9. Denegar al host 172.16.0.2 el acceso a la central de voz y a todos los
servidores de la red 192.168.10.0/24 menos a DNS. El resto de la red tiene
todos los permisos de acceso.
R2(config)#ip access-list extended nueve
R2(config-ext-nacl)#deny ip host 172.16.0.2 host 192.168.2.128
R2(config-ext-nacl)#permit tcp host 172.16.0.2 host 192.168.10.11 eq 53
R2(config-ext-nacl)#deny ip host 172.16.0.2 192.168.10.0 0.0.0.255
R2(config-ext-nacl)#permit ip any any
R2(config-ext-nacl)#exit
R2(config)#interface serial 0/2/0
R2(config-if)#ip access-group nueve out
R2(config-if)#exit
R2(config)#interface serial 0/2/1
R2(config-if)#ip access-group nueve out
R2(config-if)#exit

10. Denegar al host 172.16.0.2/24 el acceso al servidor WEB1 y al servidor

TFTP.
R2(config)#ip access-list extended diez
R2(config-ext-nacl)#deny tcp host 172.16.0.2 host 192.168.10.7 eq 80
R2(config-ext-nacl)#deny udp host 172.16.0.2 host 192.168.10.9 eq 61
R2(config-ext-nacl)#permit ip any any
R2(config-ext-nacl)#exit
R2(config)#interface serial 0/2/1
R2(config-if)#ip access-group diez out
R2(config-if)#exit
R2(config)#
11. Permitir a un host de la red 192.168.1.0 nicamente el acceso a los servicios
de SIP y a los otros host de la misma red todos los servicios.
R1(config)#ip access-list extended once
R1(config-ext-nacl)#permit udp host 192.168.1.5 host 192.168.10.10 eq 5060
R1(config-ext-nacl)#deny ip host 192.168.1.5 any
R1(config-ext-nacl)#permit ip any any
R1(config-ext-nacl)#exit
R1(config)#interface serial 0/2/0
R1(config-if)#ip access-group once out
R1(config-if)#exit
R1(config)#
12. Denegar a la central de voz IP con direccin 192.168.1.128/25 el acceso a los
servicios de SNMP.
R1(config)#ip access-list extended doce
R1(config-ext-nacl)#deny udp host 192.168.2.128 host 192.168.10.5 eq 161
R1(config-ext-nacl)#permit ip any any
R1(config-ext-nacl)#exit
R1(config)#interface serial 0/2/0
R1(config-if)#ip access-group doce out
R1(config-if)#exit
R1(config)#

13. Permitir que los Host 3 y 4 que pertenecen a la Direccin IP 172.16.0.0/24

solo puedan acceder al servidor TFTP.
R2(config)#ip access-list extended trece
R2(config-ext-nacl)#permit udp host 172.16.0.3 host 192.168.10.9 eq 61
R2(config-ext-nacl)#permit udp host 172.16.0.4 host 192.168.10.9 eq 61
R2(config-ext-nacl)#deny ip host 172.16.0.3 any
R2(config-ext-nacl)#deny ip host 172.16.0.4 any
R2(config-ext-nacl)#permit ip any any
R2(config-ext-nacl)#exit
R2(config)#interface serial 0/2/1
R2(config-if)#ip access-group trece out
R2(config-if)#exit
R2(config)#
14. Negar el acceso de los host 2 y 4 de la Direccin IP 192.168.1.0/24 al
servidor de la central Voz/IP.
R1(config)#ip access-list extended catorce
R1(config-ext-nacl)#deny ip host 192.168.1.2 host 192.168.2.128
R1(config-ext-nacl)#deny ip host 192.168.1.4 host 192.168.2.128
R1(config-ext-nacl)#permit ip any any
R1(config-ext-nacl)#exit
R1(config)#interface fastEthernet 0/0
R1(config-if)#ip access-group catorce in
R1(config-if)#exit
R1(config)#
15. Denegar el acceso al servidor DNS del host con direccin ip 172.16.0.3 y el
resto de la red si pueda acceder, que el host con direccin IP 172.16.0.2
acceda nicamente a los servidores de correo electrnico con direccin Ip
192.168.10.6 y se permita el acceso al resto de la red.
R2(config)#ip access-list extended quince
R2(config-ext-nacl)#deny tcp host 172.16.0.3 host 192.168.10.11 eq 53
R2(config-ext-nacl)#permit tcp host 172.16.0.2 host 192.168.10.6 eq 110
R2(config-ext-nacl)#deny ip host 172.16.0.2 any
R2(config-ext-nacl)#permit ip any any
R2(config-ext-nacl)#exit
R2(config)#interface serial 0/2/1
R2(config-if)#ip access-group quince out
R2(config-if)#exit
R2(config)#

16. No permitir que los host con ip 192.168.1.5 192.168.1.2 hagan ping hacia los
host 172.16.0.2 y 172.16.0.3, y permitir al resto de la red 192.168.1.0 hacer
ping hacia la red 172.16.0.0, adems permitir que el host con ip 192.168.1.4
acceda al servidor TFTP, y que el resto de la red no pueda acceder a dicho
servidor.
R1(config)#ip access-list extended decimosexta
R1(config-ext-nacl)#deny ip host 192.168.1.5 host 172.16.0.2
R1(config-ext-nacl)#deny ip host 192.168.1.5 host 172.16.0.3
R1(config-ext-nacl)#deny ip host 192.168.1.2 host 172.16.0.2
R1(config-ext-nacl)#deny ip host 192.168.1.2 host 172.16.0.3
R1(config-ext-nacl)#permit udp host 192.168.1.4 host 192.168.10.9 eq 61
R1(config-ext-nacl)#deny udp 192.168.1.0 0.0.0.255 host 192.168.10.9 eq 61
R1(config-ext-nacl)#permit ip any any
R1(config-ext-nacl)#exit
R1(config)#interface serial 0/2/0
R1(config-if)#ip access-group decimosexta out
R1(config-if)#exit
R1(config)#
17. Permitir el acceso sola a los host 172.16.0.2 y el host 172.16.0.3 de la red
172.16.0.0 /24 a la central de VoIP.
R2(config)#ip access-list extended decimoseptima
R2(config-ext-nacl)#permit ip host 172.16.0.2 host 192.168.2.128
R2(config-ext-nacl)#permit ip host 172.16.0.3 host 192.168.2.128
R2(config-ext-nacl)#deny ip 172.16.0.0 0.0.0.255 host 192.168.2.128
R2(config-ext-nacl)#permit ip any any
R2(config-ext-nacl)#exit
R2(config)#interface serial 0/2/0
R2(config-if)#ip access-group decimoseptima out
R2(config-if)#exit
R2(config)#
18. Negar el acceso al servidor FTP a los host 172.16.0.3 y el host 172.16.0.4 de
la red 172.16.0.0/24.
R2(config)#ip access-list extended decimooctava
R2(config-ext-nacl)#deny tcp host 172.16.0.3 host 192.168.10.8 eq 21
R2(config-ext-nacl)#deny tcp host 172.16.0.4 host 192.168.10.8 eq 21
R2(config-ext-nacl)#permit ip any any
R2(config-ext-nacl)#exit
R2(config)#interface serial 0/2/1
R2(config-if)#ip access-group decimooctava out

R2(config-if)#exit
R2(config)#
19. Configure las ACL estndar en las lneas vty de R3 de modo que los hosts
directamente conectados a sus subredes Fast Ethernet tengan acceso a
Telnet. Deniegue todos los dems intentos de conexin.
R3(config)#ip access-list standard VTY-decimonovena
R3(config-std-nacl)#permit 192.168.10.0 0.0.0.255
R3(config-std-nacl)#deny any
R3(config-std-nacl)#exit
R3(config)#line vty 0 4
R3(config-line)#access-class VTY-decimonovena in
R3(config-line)#exit
R3(config)#
20. Bloquee todas las direcciones IP en la red 192.168.1.0/24 del acceso TFTP al
host en 192.168.10.9
R1(config)#ip access-list extended veinte
R1(config-ext-nacl)#deny udp 192.168.1.0 0.0.0.255 host 192.168.10.9 eq 61
R1(config-ext-nacl)#permit ip any any
R1(config-ext-nacl)#exit
R1(config)#interface serial 0/2/0
R1(config-if)#ip access-group veinte out
R1(config-if)#exit
R1(config)#

4. RESULTADOS:
Resumen de la configuracin de los routers:
R1
Current configuration : 4204 bytes
!
version 12.4
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname R1
!
enable secret 5 $1$mERr$9cTjUIEqNGurQiFU.ZeCi1
enable password cisco
!

no ip domain-lookup
!
!
spanning-tree mode pvst
!
interface FastEthernet0/0
ip address 192.168.1.20 255.255.255.0
ip access-group catorce in
duplex auto
speed auto
!
interface FastEthernet0/1
ip address 192.168.2.129 255.255.255.0
duplex auto
speed auto
!
interface Serial0/2/0
ip address 10.0.0.1 255.255.255.252
ip access-group veinte out
clock rate 64000
!
interface Vlan1
no ip address
shutdown
!
router ospf 1
log-adjacency-changes
network 10.0.0.0 0.0.0.3 area 0
network 192.168.1.128 0.0.0.127 area 0
!
ip classless
!
!
ip access-list extended dos
deny tcp host 192.168.1.2 host 172.16.0.5 eq smtp
deny tcp host 192.168.1.4 host 172.16.0.5 eq smtp
deny udp host 192.168.1.2 host 192.168.10.5 eq snmp
deny udp host 192.168.1.4 host 192.168.10.5 eq snmp
permit ip any any
ip access-list extended tres
permit tcp host 192.168.1.4 host 192.168.10.7 eq www
permit tcp host 192.168.1.5 host 192.168.10.7 eq www
permit tcp host 192.168.1.4 host 192.168.10.11 eq domain
permit tcp host 192.168.1.5 host 192.168.10.11 eq domain
deny tcp 192.168.1.0 0.0.0.255 host 192.168.10.7 eq www
deny tcp 192.168.1.0 0.0.0.255 host 192.168.10.11 eq domain
permit ip any any
ip access-list extended cuatro
deny ip host 172.16.0.2 host 192.168.1.2
deny ip host 172.16.0.2 host 192.168.1.5

permit ip any any

ip access-list extended cinco
deny tcp host 192.168.1.1 host 192.168.10.6 eq pop3
deny tcp host 192.168.1.2 host 192.168.10.6 eq pop3
deny tcp host 192.168.1.3 host 192.168.10.6 eq pop3
deny tcp host 192.168.1.4 host 192.168.10.6 eq pop3
deny tcp host 192.168.1.5 host 192.168.10.6 eq pop3
deny tcp host 192.168.1.6 host 192.168.10.6 eq pop3
deny tcp host 192.168.1.7 host 192.168.10.6 eq pop3
deny tcp host 192.168.1.8 host 192.168.10.6 eq pop3
deny tcp host 192.168.1.9 host 192.168.10.6 eq pop3
deny tcp host 192.168.1.10 host 192.168.10.6 eq pop3
deny tcp host 192.168.1.11 host 192.168.10.6 eq pop3
deny tcp host 192.168.1.12 host 192.168.10.6 eq pop3
deny tcp host 192.168.1.13 host 192.168.10.6 eq pop3
deny tcp host 192.168.1.14 host 192.168.10.6 eq pop3
deny tcp host 192.168.1.15 host 192.168.10.6 eq pop3
deny tcp host 192.168.1.16 host 192.168.10.6 eq pop3
deny tcp host 192.168.1.17 host 192.168.10.6 eq pop3
deny tcp host 192.168.1.18 host 192.168.10.6 eq pop3
deny tcp host 192.168.1.19 host 192.168.10.6 eq pop3
deny tcp host 192.168.1.20 host 192.168.10.6 eq pop3
permit ip any any
ip access-list extended seis
deny udp host 192.168.1.5 host 192.168.10.10 eq 5060
permit ip any any
ip access-list extended siete
deny tcp 192.168.1.128 0.0.0.127 host 192.168.10.11 eq domain
permit ip any any
ip access-list extended ocho
deny tcp host 192.168.1.3 host 172.16.0.5 eq smtp
deny tcp host 192.168.1.4 host 172.16.0.5 eq smtp
deny udp host 192.168.1.3 host 192.168.10.9 eq 61
deny udp host 192.168.1.4 host 192.168.10.9 eq 61
permit ip any any
ip access-list extended once
permit udp host 192.168.1.5 host 192.168.10.10 eq 5060
deny ip host 192.168.1.5 any
permit ip any any
ip access-list extended doce
deny udp host 192.168.1.128 host 192.168.10.5 eq snmp
permit ip any any
ip access-list extended catorce
deny ip host 192.168.1.2 host 192.168.2.128
deny ip host 192.168.1.4 host 192.168.2.128
permit ip any any
ip access-list extended decimosexta
deny ip host 192.168.1.5 host 172.16.0.2
deny ip host 192.168.1.5 host 172.16.0.3
deny ip host 192.168.1.2 host 172.16.0.2

deny ip host 192.168.1.2 host 172.16.0.3

permit udp host 192.168.1.4 host 192.168.10.9 eq 61
deny udp 192.168.1.0 0.0.0.255 host 192.168.10.9 eq 61
permit ip any any
ip access-list extended veinte
deny udp 192.168.1.0 0.0.0.255 host 192.168.10.9 eq 61
permit ip any any
!
banner motd ^CNetworking III, Dustin Onofre^C
!
line con 0
password cisco
login
line vty 0 4
password cisco
login
!
end
R2
Current configuration : 2711 bytes
!
version 12.4
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname R2
!
enable secret 5 $1$mERr$9cTjUIEqNGurQiFU.ZeCi1
enable password cisco
!
no ip domain-lookup
!
spanning-tree mode pvst
!
interface FastEthernet0/0
ip address 172.16.0.20 255.255.255.0
duplex auto
speed auto
!
interface Serial0/2/0
ip address 10.0.0.2 255.255.255.252
ip access-group decimoseptima out
!
interface Serial0/2/1
ip address 200.107.50.2 255.255.255.252
ip access-group decimooctava out
clock rate 64000
!

interface Vlan1
no ip address
shutdown
!
router ospf 1
log-adjacency-changes
network 172.16.0.0 0.0.0.255 area 0
network 10.0.0.0 0.0.0.3 area 0
network 200.107.50.0 0.0.0.3 area 0
!
ip classless
!
ip access-list extended uno
permit tcp host 172.16.0.2 host 192.168.10.8 eq ftp
permit tcp host 172.16.0.3 host 192.168.10.8 eq ftp
permit tcp host 172.16.0.2 host 192.168.10.11 eq domain
permit tcp host 172.16.0.3 host 192.168.10.11 eq domain
deny tcp 172.16.0.0 0.0.0.255 host 192.168.10.8 eq ftp
deny tcp 172.16.0.0 0.0.0.255 host 192.168.10.11 eq domain
permit ip any any
ip access-list extended seis
deny udp host 172.16.0.3 host 192.168.10.10 eq 5060
permit ip any any
ip access-list extended siete
deny tcp 172.16.0.0 0.0.0.255 host 192.168.10.11 eq domain
permit ip any any
ip access-list extended nueve
deny ip host 172.16.0.2 host 192.168.2.128
permit tcp host 172.16.0.2 host 192.168.10.11 eq domain
deny ip host 172.16.0.2 192.168.10.0 0.0.0.255
permit ip any any
ip access-list extended diez
deny tcp host 172.16.0.2 host 192.168.10.7 eq www
deny udp host 172.16.0.2 host 192.168.10.9 eq 61
permit ip any any
ip access-list extended trece
permit udp host 172.16.0.3 host 192.168.10.9 eq 61
permit udp host 172.16.0.4 host 192.168.10.9 eq 61
deny ip host 172.16.0.3 any
deny ip host 172.16.0.4 any
permit ip any any
ip access-list extended quince
deny tcp host 172.16.0.3 host 192.168.10.11 eq domain
permit tcp host 172.16.0.2 host 192.168.10.6 eq pop3
deny ip host 172.16.0.2 any
permit ip any any
ip access-list extended decimoseptima
permit ip host 172.16.0.2 host 192.168.2.128
permit ip host 172.16.0.3 host 192.168.2.128
deny ip 172.16.0.0 0.0.0.255 host 192.168.2.128

permit ip any any

ip access-list extended decimooctava
deny tcp host 172.16.0.3 host 192.168.10.8 eq ftp
deny tcp host 172.16.0.4 host 192.168.10.8 eq ftp
permit ip any any
!
banner motd ^CNetworking III, Dustin Onofre^C
!
line con 0
password cisco
login
line vty 0 4
password cisco
login
!
end
R3
Current configuration : 1024 bytes
!
version 12.4
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname R3
!
enable secret 5 $1$mERr$9cTjUIEqNGurQiFU.ZeCi1
enable password cisco
!
no ip domain-lookup
!
spanning-tree mode pvst
!
interface FastEthernet0/0
ip address 192.168.10.20 255.255.255.0
duplex auto
speed auto
!
interface Serial0/2/1
ip address 200.107.50.1 255.255.255.252
!
interface Vlan1
no ip address
shutdown
!
router ospf 1
log-adjacency-changes
network 192.168.10.0 0.0.0.255 area 0
network 200.107.50.0 0.0.0.3 area 0

!
ip classless
!
ip access-list standard VTY-decimonovena
permit 192.168.10.0 0.0.0.255
deny any
!
banner motd ^CNetworking III, Dustin Onofre^C
!
line con 0
password cisco
login
line vty 0 4
access-class VTY-decimonovena in
password cisco
login
!
end

6. CONCLUSIONES:
La verificacin mediante ping o telnet se la debi realizar despus de la
configuracin de cada ACL, puesto que los enunciados no tienen concordancia y
por ende, la red presenta varias inconsistencias.
Se debe considerar que hay un "deny any" implcito, al final de cada ACL.
Usar ACL nombradas en vez de usar un rango de nmeros tiene ventajas. El
darles un nombre facilita entender la configuracin y eso implica un ahorro de
tiempo en el proceso.

7. RECOMENDACIONES:
Leer detenidamente los enunciados para entender
requerimientos y evitar configuraciones errneas en la red.

correctamente

los

Cualquier lnea agregada a una ACL se agrega al final. Para cualquier otro tipo
de modificacin, se tiene que borrar toda la lista y escribirla de nuevo. Se
recomienda copiar en un bloc de notas y editar all.

8. BIBLIOGRAFA y HERRAMIENTAS:
http://www.forosdelweb.com/f20/puede-conectar-servidor-router-408889/
http://www.slideshare.net/josegregoriob/servidor-web-8451426
http://es.wikipedia.org/wiki/Protocolos_de_VoIP

 Unidad 13 Networking II, OSPF.

Unidad 4 Networking III, Listas de Control de Acceso.
Cisco PACKET TRACER versin 5.3.3