CCIE Security Practice Labs

Section 8.0: Advanced Security

8.1. Perimeter Security

1. Deny all inbound traceroute on R5 on Frame Relay link (173.5.1.128/25).

2. One of the two ICMP messages that traceroute receives is the message port unreachable. The second one is the message time exceeded (TTL is 0).

3. Configure the egress ACL to deny ICMP port-unreachable and time-exceeded, as demonstrated in the following example:

   ! <Snip from R5 config>
   interface Serial1/0
    ip address 173.5.1.129 255.255.255.128
    ip access-group 103 out
   !
   access-list 103 deny   icmp any any port-unreachable
   access-list 103 deny   icmp any any time-exceeded
   access-list 103 permit ip any any
   !
   

4. Traceroute through R5 toward Frame Relay network to R6, R7, and VLAN4, and R8 will work OK with the solution in the configuration ...