The senior network engineer assigns you a task that requires ACL configuration. He provides the following diagram and the requirements below:

1. Enable the ACL inbound on R2’s G0/1 interface.
2. Permit packets coming from the host with IP 20.2.2.1
3. Deny packets coming from the rest subnet 20.2.2.0/24
4. Permit packets coming from a network with subnet 155.165.0.0/16

Now you are responsible to configure the R2 using the ACL standard number 1. Which of the following commands will you type to complete the task?

(A)
R2# configure terminal
R2(config)# access-list 1 permit 20.2.2.1
R2(config)# access-list 1 deny 20.2.2.0 0.0.0.255
R2(config)# access-list 1 permit 155.165.0.0 0.0.255.255
R2(config)# interface G0/2
R2(config-if)# ip access-group 1 in
(B)
R2# configure terminal
R2(config)# access-list 1 permit 20.2.2.1
R2(config)# access-list 1 deny 20.2.2.0 0.0.0.255
R2(config)# access-list 1 permit 155.165.0.0 0.0.255.255
R2(config)# interface G0/1
R2(config-if)# ip access-group 1 in
(C)
R2# configure terminal
R2(config)# access-list 1 permit 20.2.2.1
R2(config)# access-list 1 deny 20.2.2.0 0.0.0.255
R2(config)# access-list 1 permit 155.165.0.0 0.0.255.255
R2(config)# interface G0/1
(D)
R2# configure terminal
R2(config)# access-list 1 deny 20.2.2.1
R2(config)# access-list 1 deny 20.2.2.0 0.0.0.255
R2(config)# access-list 1 permit 155.165.0.0 0.0.255.255
R2(config)# interface G0/1
R2(config-if)# ip access-group 1 in

B is the correct answer. The syntax of the ACL command is:

access-list access-list-number {deny | permit} source [sourcewildcard]

The first command access-list 1 permit 20.2.2.1 permits only the host with IP 20.2.2.1 to send packets through R2. The second command access-list 1 deny 20.2.2.0 0.0.0.255 denies all the subnet 20.2.2.0/24 to send packets through R2. This command uses a wildcard mask 0.0.0.255 which means the first three octets have to be compared.

(Note, if the second command was before the first command then the host with IP 20.2.2.1 couldn’t send packets, because ACLs “execute” the rules from top to bottom)

The third command access-list 1 permit 155.165.0.0 0.0.255.255 permits all the packets coming from the 155.165.0.0/16. Again we use a wildcard mask 0.0.255.255 to tell the R2 to check if the packets coming from that particular network. So only packets from the range 155.165.0.0 – 155.165.255.255 are permitted.

If the wildcard mask was, 0.255.255.255, then the router would compare only the first octet which means, packets coming from 155.0.0.0 – 155.255.255.255 are permitted.

If the wildcard mask was, 0.0.0.255, then the router would compare the first three octets which means, packets coming from 155.165.0.0 – 155.165.0.255 are permitted.

The last commands interface G0/1 and ip access-group 1 in enable the ACL inbound on R2’s G0/1 interface.