Scribd Logo
Upload

Welcome to Scribd!

  • 186 views

    9.5.2.6 Packet Tracer - Configuring IPv6 ACLs Instructions IG

    Uploaded by

    Juan David Santana
    The document describes how to configure IPv6 access control lists (ACLs) to block specific traffic on a network. It provides steps to create ACLs that deny HTTP/HTTPS and ICMP traffic targeted at a server to prevent denial of service attacks and ping floods.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd

    9.5.2.6 Packet Tracer - Configuring IPv6 ACLs Instructions IG

    Uploaded by

    Juan David Santana
    186 views7 pages
    The document describes how to configure IPv6 access control lists (ACLs) to block specific traffic on a network. It provides steps to create ACLs that deny HTTP/HTTPS and ICMP traffic targeted at a server to prevent denial of service attacks and ping floods.

    Original Description:

    CISCO

    Copyright

    © © All Rights Reserved

    Available Formats

    DOCX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document describes how to configure IPv6 access control lists (ACLs) to block specific traffic on a network. It provides steps to create ACLs that deny HTTP/HTTPS and ICMP traffic targeted at a server to prevent denial of service attacks and ping floods.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    186 views7 pages

    9.5.2.6 Packet Tracer - Configuring IPv6 ACLs Instructions IG

    Uploaded by

    Juan David Santana
    The document describes how to configure IPv6 access control lists (ACLs) to block specific traffic on a network. It provides steps to create ACLs that deny HTTP/HTTPS and ICMP traffic targeted at a server to prevent denial of service attacks and ping floods.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    of 7

    Packet Tracer - Configuring IPv6 ACLs

    Topology

    Addressing Table
    Device
    Server3

    Interface
    NIC

    IPv6 Address/Prefix
    2001:DB8:1:30::30/64

    Default Gateway
    FE80::30

    Objectives
    Part 1: Configure, Apply, and Verify an IPv6 ACL
    Part 2: Configure, Apply, and Verify a Second IPv6 ACL

    Part 1: Configure, Apply, and Verify an IPv6 ACL


    Logs indicate that a computer on the 2001:DB8:1:11::0/64 network is repeatedly refreshing their web page
    causing a Denial-of-Service (DoS) attack against Server3. Until the client can be identified and cleaned,
    you must block HTTP and HTTPS access to that network with an access list.

    Step 1: Configure an ACL that will block HTTP and HTTPS access.
    Configure an ACL named BLOCK_HTTP on R1 with the following statements.
    a. Block HTTP and HTTPS traffic from reaching Server3.
    R1(config)# deny tcp any host 2001:DB8:1:30::30 eq www
    R1(config)# deny tcp any host 2001:DB8:1:30::30 eq 443
    b. Allow all other IPv6 traffic to pass.
    R1(config)# permit ipv6 any any

    2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public.

    Page 1 of 2

    Packet Tracer - Configuring IPv6 ACLs

    Step 2: Apply the ACL to the correct interface.


    Apply the ACL on the interface closest the source of the traffic to be blocked.
    R1(config)# interface GigabitEthernet0/1
    R1(config-if)# ipv6 traffic-filter BLOCK_HTTP in

    Step 3: Verify the ACL implementation.


    Verify the ACL is operating as intended by conducting the following tests:

    Open the web browser of PC1 to http://2001:DB8:1:30::30 or https://2001:DB8:1:30::30. The website


    should appear.

    Open the web browser of PC2 to http://2001:DB8:1:30::30 or https://2001:DB8:1:30::30. The website


    should be blocked

    Ping from PC2 to 2001:DB8:1:30::30. The ping should be successful.

    Part 2: Configure, Apply, and Verify a Second IPv6 ACL


    The logs now indicate that your server is receiving pings from many different IPv6 addresses in a Distributed
    Denial of Service (DDoS) attack. You must filter ICMP ping requests to your server.

    Step 1: Create an access list to block ICMP.


    Configure an ACL named BLOCK_ICMP on R3 with the following statements:
    a. Block all ICMP traffic from any hosts to any destination.
    R3(config)# deny icmp any any
    b. Allow all other IPv6 traffic to pass.
    R3(config)# permit ipv6 any any

    Step 2: Apply the ACL to the correct interface.


    In this case, ICMP traffic can come from any source. To ensure that ICMP traffic is blocked regardless of its
    source or changes that occur to the network topology, apply the ACL closest to the destination.
    R3(config)# interface GigabitEthernet0/0
    R3(config-if)# ipv6 traffic-filter BLOCK_ICMP out

    Step 3: Verify that the proper access list functions.


    a. Ping from PC2 to 2001:DB8:1:30::30. The ping should fail.

    b. Ping from PC1 to 2001:DB8:1:30::30. The ping should fail.

    Open the web browser of PC1 to http://2001:DB8:1:30::30 or https://2001:DB8:1:30::30. The website


    should display.

    You might also like