AI Network Labs 07 — Lab: DHCP Pools and Extended ACLs
Router-based DHCP with exclusions for two VLANs, then an extended ACL that allows ping but blocks everything else between departments.
Two services every real LAN needs: DHCP so nobody types addresses by hand, and an access list so not every host can reach everything. Start from the router-on-a-stick lab.
1 · DHCP on the router
Exclude the gateway and a small range for printers first, then define one pool per VLAN:
ip dhcp excluded-address 10.0.10.1 10.0.10.20
ip dhcp excluded-address 10.0.20.1 10.0.20.20
!
ip dhcp pool SALES
network 10.0.10.0 255.255.255.0
default-router 10.0.10.1
dns-server 8.8.8.8
!
ip dhcp pool ENG
network 10.0.20.0 255.255.255.0
default-router 10.0.20.1
dns-server 8.8.8.8Then switch the PCs over — this is the job of configurePcIp in DHCP mode.
On R1 create DHCP pools SALES (10.0.10.0/24) and ENG (10.0.20.0/24),
excluding .1–.20 in each, gateway .1, DNS 8.8.8.8. Show commands first.
Then set all four PCs to DHCP with configurePcIp and tell me the address each one received.Each PC should receive .21 or above. If a PC gets a 169.254.x.x address, it never reached the DHCP server — check the trunk and the subinterface first.
2 · An ACL with a purpose
Policy: ENG may reach SALES, but only for ping; everything else from ENG to SALES is denied. All other traffic is allowed.
ip access-list extended ENG-TO-SALES
permit icmp 10.0.20.0 0.0.0.255 10.0.10.0 0.0.0.255 echo
deny ip 10.0.20.0 0.0.0.255 10.0.10.0 0.0.0.255
permit ip any any
!
interface GigabitEthernet0/0.20
ip access-group ENG-TO-SALES inEvery ACL ends with an invisible deny ip any any. Forget the final permit ip any any and you've just cut ENG off from everything — including the internet.
3 · Verify
show ip dhcp binding
show access-listsPing ENG → SALES (should succeed) and watch the permit icmp counter rise in show access-lists.
Exercise
Why is the ACL applied inbound on Gi0/0.20 and not outbound on Gi0/0.10? Think about which traffic each placement would filter, and where the packet is dropped.
ExerciseKnowledge check
Why does the ACL end with 'permit ip any any'?
Finished this one?
Progress is saved in this browser.
