CCNA Module 2 - Chapter 9 - 11 by Lau Chung Meng

Support me!!!!

ET0727 — 2015-11-27 02:57:07 UTC

Post your Chap 9, 10 and 11 questions here :)

ACL on NAT router

ET0727 — 2015-12-03 14:49:07 UTC

Refer to the diagram below:

R2 is the NAT router which does static NAT for Company Server

You are required to design ACL to protect the Company server from the Internet.

Questions:

Q1. If you are going to apply the ACL on s0/1/0 inbound, should you use the private or public IP of Company Server in the ACL?

Q2. If you are going to apply the ACL on fa0/0 outbound, should you use the private or public IP of Company Server in the ACL?

Q3. If you are going to apply the ACL on S0/1/0 outbound, should you use the private or public IP of Company Server in the ACL?

Q4. If you are going to apply the ACL on fa0/0 outbound, should you use the private or public IP of Company Server in the ACL?

Post your answer on this Padlet!

2015-12-03 15:10:16 UTC

[Answer?]

S0/1/0 inbound: Public Fa0/0 inbound: Private S0/1/0 outbound: Public Fa0/0 outbound: Private

Is this correct??

Hmmmm...

ET0727 — 2015-12-04 08:05:05 UTC

Why do you think this is the answer?

Briefly explain?

Others: what do you think? Agree with the answers?

Bug

2015-12-06 15:19:31 UTC

Is there something wrong with the check result ?

ANS (i think...)

2015-12-06 15:37:34 UTC

Q1. Public

Reason: At the S0/1/0, internet does not know the private address of server

Q2. Private

Reason : At fa0/0 interface, private address is known .

Q3. Public

Reason : Private address is already translated

Q4. Duplicate as Q2.

If asking fa0/0 inbound,

Should be private address as address is not yet translated.

Almost right!

ET0727 — 2015-12-07 07:39:33 UTC

Yup, the answer is correct "clap clap clap"!

The explanation is almost correct

ET0727 — 2015-12-07 07:48:30 UTC

NAT is a process that happen:
- AFTER the packet enters into the inbound interface

and

- BEFORE the packet exits the outbound interface

ET0727 — 2015-12-07 07:51:19 UTC

For packet coming from the Internet to The Server:

- at the inbound interface (s0/1/0), the destination IP address of the packet is "209.165.200.227". So the ACL should use the public IP address

- at the outbound interface (fa0/0), the destination IP had been translated to "192.168.40.254". So the ACL should use the public IP address

Same goes for packet from The Server to the Intenet

Answer to Bug

ET0727 — 2015-12-07 07:57:06 UTC

Ya... seems so.

I tried and also cannot get it correct for this item.

Anyone else got this problem?

Yea gt the prob too.

2015-12-08 09:07:49 UTC