Project · Computer Networking (CCNA level)
Project: secure a bank branch network
The brief
A co-operative bank branch in Kolhapur has a staff LAN, a guest Wi-Fi for customers and one internet link. Write an ACL engine in Python that decides permit or deny the way a router does, then secure the branch in Packet Tracer: SSH version 2 only, port security on staff desks, an extended ACL that keeps guests away from staff systems, and PAT for the internet. Finish by reading the router's interfaces from a RESTCONF JSON reply.
Why it matters
Banks, hospitals and shops must keep customer Wi-Fi away from staff systems, and RBI and PCI DSS audits check exactly these controls: no Telnet, locked desk ports, guest isolation and NAT at the edge. Network security engineers write and test ACLs every week, and more and more of them check devices through APIs such as RESTCONF instead of logging in to each one.
Skills you practise
- wildcard masks
- ACL first-match logic and the implicit deny
- SSH version 2 and login local
- port security with sticky MACs
- extended named ACLs
- PAT (NAT overload)
- RESTCONF JSON with json.loads
You need
- Cisco Packet Tracer (free with a Cisco Networking Academy account)
- BR-R1 (2911 router), SW1 (2960 switch) with a staff PC, a guest PC on G0/1, and an ISP router (2911) with a web server at 198.51.100.10
- BR-R1 addresses: G0/0 192.168.50.1/24 (STAFF), G0/1 192.168.60.1/24 (GUEST), G0/2 203.0.113.2/30 (ISP side 203.0.113.1), and a default route to 203.0.113.1
What you will have at the end
branch.pkt with SSH v2, port security, the GUEST-IN ACL and PAT all working; branch.py (an ACL engine and a RESTCONF reader); and security-notes.txt explaining each control and what is still open.
How it is marked (rubric, 100 points)
| Controls workSSH v2 only, port security Secure-up with sticky, GUEST-IN blocking guests from staff with matching counters, and PAT translations. | 40 |
|---|---|
| ACL enginewildcard_match() and acl_decision() follow first-match and the implicit deny, including non-contiguous wildcards. | 20 |
| Automationinterface_report() reads the RESTCONF reply correctly, including an interface with no address. | 15 |
| Security notessecurity-notes.txt says what each control stops, where the ACL is applied and why, and what risks remain. | 15 |
| Tested like an auditorYou tried to break each control (Telnet, a second PC, a guest ping to staff) and recorded the result. | 10 |
0/7 steps done
Step 1 of 7
Match an address against a wildcard
wildcard_match(ip, base, wildcard) is True when ip agrees with base on every bit where the wildcard has a 0.
ACLs use wildcard masks: a 0 bit means "must match", a 1 bit means "ignore". So 192.168.60.0 0.0.0.255 matches 192.168.60.0 to .255, "host 10.1.1.5" is the wildcard 0.0.0.0, and "any" is 255.255.255.255. Turn the wildcard round with ~ to get the bits you care about, then compare ip and base on only those bits. to_int() is given.
Run shows what your code prints. Check runs the step's tests. Ctrl+Enter checks too.