Step 1: Configure all applicable router interfaces.
R1(config)#interface FastEthernet0/0
R1(config-if)#ip address 1.1.1.1 255.255.255.252
!
R1(config)#interface FastEthernet0/1
R1(config-if)#ip address 10.1.0.1 255.255.255.0
!
R1(config)#interface FastEthernet1/0
R1(config-if)#ip address 10.2.0.1 255.255.255.0
!
R1(config)#interface FastEthernet1/1
R1(config-if)#ip address 10.3.0.1 255.255.255.0
Step 2: Configure an access-list defining which host are permitted to communicate with SERVER and how. In this example we will allow PC1 to communicate with SERVER using only ping whereas PC2 and PC3 will need to communicate with SERVER with telnet. End the access-list with an explicit deny to block all traffic undefined.
R1(config)#access-list 101 permit tcp host 10.2.0.2 host 1.1.1.2 eq telnet
R1(config)#access-list 101 permit tcp host 10.3.0.2 host 1.1.1.2 eq telnet
R1(config)#access-list 101 permit icmp host 10.1.0.2 host 1.1.1.2 echo
R1(config)#access-list 101 deny ip any any
Step 3: Assign the access-list to interface FastEthernet0/0 out. This will allow only approved hosts and protocols out of FastEthernet0/0 onto the same network as SERVER. This is an example of an outbound access-list as we are inspecting traffic once it enters the router.
R1(config)#interface FastEthernet0/0
R1(config-if)#ip access-group 101 out
Step 4: Configure an access-list permitting PC2 to communicate with only PC1 and SERVER. No filtering of protocols will be performed. End the access-list with an explicit deny to block all traffic undefined.
R1(config)#access-list 102 permit ip host 10.2.0.2 host 1.1.1.2
R1(config)#access-list 102 permit ip host 10.2.0.2 host 10.1.0.2
R1(config)#access-list 102 deny ip any any
Step 5: Assign the access-list to interface FastEthernet1/0 in. This will allow only approved hosts to communicate in and through FastEthernet1/0 to approved hosts. This is an example of an inbound access-list as we are inspecting traffic before it enters the router.
R1(config)#interface FastEthernet1/0
R1(config-if)#ip access-group 102 in
Step 6: Configure an access-list permitting PC3 to communicate with only PC1 and SERVER. No filtering of protocols will be performed. End the access-list with an explicit deny to block all traffic undefined.
R1(config)#access-list 103 permit ip host 10.3.0.2 host 10.1.0.2
R1(config)#access-list 103 permit ip host 10.3.0.2 host 1.1.1.2
R1(config)#access-list 103 deny ip any any
Step 7: Assign the access-list to interface FastEthernet1/1 in. This will allow only approved hosts to communicate in and through FastEthernet1/1 to approved hosts. Again this is an example of an inbound access-list.
R1(config)#interface FastEthernet1/1
R1(config-if)#ip access-group 103 in
