Block an attacker with a router ACL

Measure server reachability before and after an inbound router ACL blocks one attacker while preserving legitimate traffic.

Packet Pete, your practice guide

Packet Pete
Predict the reading, then compare it with the measurement.

Cisco Packet Tracer

Desktop lab

Measure server reachability before and after an inbound router ACL blocks one attacker while preserving legitimate traffic.

Tier 3 · Install required · Cisco account required

Version tested: Cisco Packet Tracer 9.0.1 on Ubuntu 22.04 (Apptainer/Xvfb); project saved and execution captured 2026-09-10. Date: 2026-09-10.

Install the tool; build from the steps. No file yet.

Download the Packet Tracer file

Need the app? Get Packet Tracer free from Cisco Networking Academy (free NetAcad login required).

Steps

Screens captured against Cisco Packet Tracer Cisco Packet Tracer 9.0.1 on Ubuntu 22.04 (Apptainer/Xvfb); project saved and execution captured 2026-09-10 on 2026-09-10; the tool may have moved on — the text steps are the contract.

  1. Step 1

    Do
    Open lab.pkt and identify Legit-IoT-Client, Attacker-PC, IoT-Thermostat, Security-R1, and Telemetry-Server.
    You will see
    PT displays clients on 10.1.0.0/24 and the server on 10.2.0.0/24 through Security-R1.
    Why it matters
    The source and destination boundaries define where the control should be enforced.

  2. Step 2

    Do
    Before changing the ACL, ping 10.2.0.10 from Attacker-PC.
    You will see
    PT prints “Sent = 4, Received = 4, Lost = 0 (0% loss)”.
    Why it matters
    The before result proves the unwanted path exists.

  3. Step 3

    Do
    Before applying the ACL, ping the server twice from Attacker-PC to settle ARP.
    You will see
    The first visible run receives 3/4 while ARP settles; the retry prints “Sent = 4, Received = 4, Lost = 0”.
    Why it matters
    Keeping the warm-up failure distinguishes address-resolution timing from policy denial.

  4. Step 4

    Do
    Inspect ACL 101 on Security-R1 GigabitEthernet0/0 inbound.
    You will see
    The router CLI shows extended ACL 101 with “deny icmp host 10.1.0.66 host 10.2.0.10 echo” followed by “permit ip any any”.
    Why it matters
    The narrow deny precedes the general permit and targets only the stated attacker flow.

  5. Step 5

    Do
    Repeat the attacker ping after applying ACL 101.
    You will see
    PT prints “Sent = 4, Received = 0, Lost = 4 (100% loss)”.
    Why it matters
    The changed result demonstrates enforcement for the denied source.

  6. Step 6

    Do
    Repeat the legitimate ping without changing any other setting.
    You will see
    PT prints “Sent = 4, Received = 4, Lost = 0 (0% loss)”.
    Why it matters
    A security control must preserve explicitly allowed traffic, not merely break connectivity.

  7. Step 7

    Do
    Return to Security-R1, verify the ACL hit count, and save.
    You will see
    The saved CLI verification shows ACL 101, the specific deny, “(1 match(es))”, and the general permit.
    Why it matters
    A paired test supports the bounded ACL claim and leaves broader security questions open.

Chapter checks

These questions refer to the chapter’s examples. Use the return links to review their answers.

  1. What is the most useful way to frame a common IoT security mistake during review?

    Return to the chapter’s knowledge check

  2. A network review concludes an IoT device is well protected, but the shipped hardware still has an enabled serial console (UART) and an open chip debug interface (JTAG). Why does this weaken the conclusion?

    Return to the chapter’s knowledge check

Return to Common IoT Security Mistakes · Browse Labs