1. Attack Scenario & Enterprise Topology
802.1Q Segmented Network
2. OSI Layer Inspection & Header Breakdown
DROPPED BY ACL
Packet Dropped at Router Core-R1 (Fa0/0.10)
CISCO_ACL_DENY
Extended ACL 102 Rule 10 matched: "deny tcp 192.168.10.0 0.0.0.255 192.168.20.0 0.0.0.255 eq 445". Lateral traversal attempt blocked.
Layer 2 — 802.3 Ethernet & 802.1Q
Source MAC:00:1A:2B:3C:4D:5E
Dest MAC:00:00:0C:07:AC:01 (Default GW)
802.1Q VLAN Tag:VLAN ID: 10 (0x8100)
Port Security:Configured (Max 1 MAC)
Layer 3 / 4 — IPv4 & Transport
Source IPv4:192.168.10.45
Destination IPv4:192.168.20.12
Protocol / Ports:TCP :49152 → :445 (SMB)
TTL / Routing:TTL: 64 | Next-Hop: 192.168.20.1
3. Cisco IOS Defensive Control Center
Live Router & Switch ACLs
Toggle defensive CCNA configurations in real time to observe the direct impact on packet traversal and incident triage:
! Core-R1 running-config: Extended Access-List 102
10
access-list 102 deny tcp 192.168.10.0 0.0.0.255 192.168.20.0 0.0.0.255 eq 445
20
access-list 102 permit udp 192.168.10.0 0.0.0.255 host 172.16.30.53 eq 53
30
access-list 102 permit ip 192.168.10.0 0.0.0.255 any
99
access-list 102 deny ip any any (Implicit Deny)
SYSTEM
CCNA Wildcard Mask Refresher:
Subnet /24 = Mask
255.255.255.0 → Inverted Wildcard: 0.0.0.255.
Bits with 0 must match exactly; 255 permits any host in that octet.
4. Cisco IOS Hardening CLI Snippet
! Hardening script generated for current threat:
Core-R1# configure terminal
Core-R1(config)# ip access-list extended 102
Core-R1(config-ext-nacl)# 10 remark "Block Lateral SMB Movement from Eng to Finance"
Core-R1(config-ext-nacl)# 10 deny tcp 192.168.10.0 0.0.0.255 192.168.20.0 0.0.0.255 eq 445
Core-R1(config-ext-nacl)# exit
Core-R1(config)# interface FastEthernet0/0.10
Core-R1(config-subif)# ip access-group 102 in
Core-R1(config-subif)# end
Core-R1# write memory