Examkin

Question

Difficulty: MediumAccess Control Lists (Standard and Extended IPv4 ACLs)

A network engineer configures a Cisco IOS router with an extended IPv4 Access Control List (ACL) named `SECURE_TRAFFIC` to restrict traffic between internal segments:

text
ip access-list extended SECURE_TRAFFIC
10 permit tcp 172.16.10.0 0.0.0.255 host 172.16.20.10 eq 443
20 deny tcp 172.16.10.0 0.0.0.255 host 172.16.20.10 eq 80

After applying this ACL inbound on interface GigabitEthernet0/0, users in the 172.16.10.0/24172.16.10.0/24 subnet can access the HTTPS service at 172.16.20.10172.16.20.10, but all ICMP pings and traffic to other destinations are dropped. Which configuration change will allow non-HTTP traffic while preserving the configured rules?

  1. Add the statement `permit ip 172.16.10.0 0.0.0.255 any` at the end of the ACL.Answer
  2. B
    Remove sequence line 20, as unpermitted TCP traffic is allowed by default.
  3. C
    Replace the wildcard mask `0.0.0.255` with `255.255.255.0` in the existing ACL entries.
  4. D
    Reconfigure `SECURE_TRAFFIC` as a standard ACL using statement sequence numbers 10 and 20.

Answer

Add an explicit `permit ip` statement to the end of the ACL to permit non-matching traffic.
Cisco IPv4 Access Control Lists evaluate rules sequentially from top to bottom. If a packet does not match any explicit permit or deny statement, it hits the invisible implicit deny statement (`deny ip any any`) at the end of the list. In this scenario, HTTPS traffic matches line 10 and is allowed, while HTTP traffic matches line 20 and is blocked. However, ICMP and other non-web traffic fall through to the implicit deny clause. Appending an explicit `permit ip 172.16.10.0 0.0.0.255 any` statement ensures that traffic not specifically matched by lines 10 or 20 is permitted through the interface.

Step-by-Step Solution

1
Analyze the existing ACL statements and implicit behaviors.
Line 10 permits HTTPS (TCP 443), and line 20 denies HTTP (TCP 80). At the end of every Cisco IPv4 ACL, an invisible implicit `deny ip any any` statement exists.
Traffic not explicitly permitted by preceding statements matches the implicit deny statement and is discarded.
2
Determine why ICMP and other protocols are failing.
ICMP and other non-TCP/non-web traffic fail to match lines 10 and 20, falling through to the implicit deny clause.
Without an explicit permit rule at the end, all unlisted protocols and destination IPs are blocked.
3
Identify the proper modification to allow legitimate remaining traffic.
Appending `permit ip 172.16.10.0 0.0.0.255 any` (or `permit ip any any`) allows remaining traffic to pass.
This explicitly permits all other IP traffic originating from the subnet after evaluating the specific HTTPS permit and HTTP deny rules.

Key Concept

Every IPv4 ACL ends with an invisible implicit deny any clause that drops all unmatched traffic unless explicitly permitted.
Rate this question

Topics

Access Control Lists (Standard and Extended IPv4 ACLs)

More questions from this topic