From: Scott Morris (swm@emanon.com)
Date: Sun Nov 04 2007 - 23:50:48 ART
I see where you're coming from on this, although (IMHO) the original intent
was for destination stuff there, but it makes sense to me how you
interpreted it.
What I would recommend in the real lab is asking the clarifying question of
the proctor. If nothing else, they should know what kind of answer they
gave you (which would lead to you making a decision) and make note of that
for the grading portion in case the person who wrote the script thought
differently.
I'll make note of that and try to make the wording more specific though.
Cheers,
Scott Morris, CCIE4 (R&S/ISP-Dial/Security/Service Provider) #4713, JNCIE-M
#153, JNCIS-ER, CISSP, et al.
CCSI/JNCI-M/JNCI-ER
VP - Technical Training - IPexpert, Inc.
IPexpert Sr. Technical Instructor
A Cisco Learning Partner - We Accept Learning Credits!
smorris@ipexpert.com
Telephone: +1.810.326.1444
Fax: +1.810.454.0130
http://www.ipexpert.com
-----Original Message-----
From: nobody@groupstudy.com [mailto:nobody@groupstudy.com] On Behalf Of
James MacDonald
Sent: Sunday, November 04, 2007 9:23 PM
To: ccielab@groupstudy.com
Subject: IPExperts - V9 - Section 9 - task 4
Hi, I have a question about IPExperts Version 9.0 workbook - Section 9, task
4. Below is the question and the solution they provided ... and my solution.
I know for part of the discrepancy i have used specific hosts in the acl
where they used ANY ... but I know that that should work either way and
still full fill the requirements. The issue I have is in interpretation of
the last past. It clearly asked "deny all inbound traffic from hosts
150.50.7.32-150.50.7.63 with a TCP port greater than 1023" ... which I read
as a source port greater than 1023 ... but the solution they provided has
the destination port greater than 1023.
Anyone else have issues here? Or am i not reading this correctly?
Thanks,
===========================
Question:
===========================
On R7, configure an access-list that allows R7 to only form an OSPF
adjacency with R5 on the 150.50.7.0/25 network. The access-list should also
deny PIM either destined for R7 or beyond, from R6. In addition, the
access-list should deny all inbound traffic from hosts
150.50.7.32-150.50.7.63 with a TCP port greater than 1023. All other IP
traffic should be permitted.
===========================
Lab Solution:
===========================
ip access-list extended MyFilter
permit ospf host 150.50.7.5 any
deny ospf any any
deny pim host 10.50.7.6 any
deny tcp 150.50.7.32 0.0.0.31 any gt 1023
permit ip any any
===========================
My Solution
===========================
R7#sh ip access-lists
Extended IP access list lab9-4
permit ospf host 150.50.7.5 host 150.50.7.7
deny ospf any host 150.50.7.7
deny pim host 150.50.7.6 any
deny tcp 150.50.7.32 0.0.0.31 gt 1023 any
permit ip any any (2 matches)
------------------------------
Jim MacDonald
j4m3sm63@yahoo.ca
------------------------------
Be smarter than spam. See how smart SpamGuard is at giving junk email
the boot with the All-new Yahoo! Mail. Click on Options in Mail and switch
to New Mail today or register for free at http://mail.yahoo.ca
This archive was generated by hypermail 2.1.4 : Sat Dec 01 2007 - 06:37:28 ART