Examkin

Question

Difficulty: Very hardAccess Control Lists (Standard and Extended IPv4 ACLs)

A network administrator configures an IPv4 extended named Access Control List (ACL) on router R1 to control access to a server farm located on subnet 10.120.16.0/20, which connects locally to interface GigabitEthernet0/0. The policy requirements state that:
1. Management traffic (SSH and HTTPS) from 192.168.100.0/24 to the server farm must be allowed.
2. ICMP echo requests from host 192.168.200.5 to the server farm must be allowed.
3. All traffic originating inside the server farm (10.120.16.0/20) bound for its default gateway (10.120.16.1) must be allowed.
4. All other IPv4 traffic entering the server farm interface must be denied and logged.

The engineer applies the following configuration:

text
ip access-list extended SEC_SERVER_MGMT
permit tcp 192.168.100.0 0.0.0.255 10.120.16.0 0.0.15.255 eq 22
permit tcp 192.168.100.0 0.0.0.255 10.120.16.0 0.0.15.255 eq 443
permit icmp host 192.168.200.5 10.120.16.0 0.0.15.255 echo
permit ip 10.120.16.0 0.0.15.255 host 10.120.16.1
!
interface GigabitEthernet0/0
ip access-group SEC_SERVER_MGMT in

Which two statements correctly identify flaws or operational outcomes of this ACL deployment?

  1. Unlisted denied traffic will be dropped silently without generating log messages because no explicit deny statement with the log keyword was configured.Answer
  2. Traffic sent from the remote admin network (192.168.100.0/24) to the server farm will not match the ACL entries on GigabitEthernet0/0 because it enters R1 through a different interface.Answer
  3. C
    Unlisted IPv4 traffic will automatically trigger Syslog logging upon being dropped by the default implicit ACL processing engine.
  4. D
    The wildcard mask 0.0.15.255 incorrectly matches hosts across the range 10.120.0.0 through 10.120.255.255 instead of the 10.120.16.0/20 subnet.

Answer

The configuration fails because unlisted denied packets are dropped silently by the default implicit deny clause rather than logged, and applying the ACL inbound on GigabitEthernet0/0 filters outbound server traffic rather than inbound traffic from remote subnets.
The deployment exhibits two distinct operational flaws. First, applying the ACL inbound on the server-facing interface filters traffic sent by the servers into the router rather than traffic destined to the servers from remote management networks. Second, Cisco IOS ACLs end with an unwritten implicit deny clause that drops unmatched traffic silently. To fulfill the requirement of logging denied traffic, an explicit 'deny ip any any log' entry must be added.

Step-by-Step Solution

1
Analyze the direction of traffic flow and ACL placement.
GigabitEthernet0/0 connects locally to the 10.120.16.0/20 subnet. Traffic coming from remote networks (such as 192.168.100.0/24) toward the server farm travels out of GigabitEthernet0/0. Applying an inbound ACL ('ip access-group SEC_SERVER_MGMT in') on GigabitEthernet0/0 filters traffic originating from the server farm entering the router, not traffic heading to the server farm.
Extended ACLs must be placed as close to the source as possible or configured in the proper direction (outbound on GigabitEthernet0/0) to filter incoming traffic destined to servers.
2
Evaluate the implicit deny clause and logging requirements.
Every Cisco IOS IPv4 ACL ends with an invisible implicit 'deny ip any any' rule. Because this implicit statement drops packets silently, requirement 4 (deny and log all other IPv4 traffic) is not met unless an explicit line 'deny ip any any log' is configured at the end of the ACL.
Logging requires explicit configuration of the 'log' parameter on a matching statement; the implicit deny statement never produces log events.
3
Verify wildcard mask calculations.
For a /20 prefix (255.255.240.0), the wildcard mask is 255.255.255.255 - 255.255.240.0 = 0.0.15.255. Adding 15.255 to 10.120.16.0 yields 10.120.31.255, matching subnet 10.120.16.0/20 accurately.
Validating wildcard calculations ensures that the destination address scope in the permit lines is correct.

Key Concept

ACL Interface Direction and Implicit Deny Mechanics
Rate this question

Topics

Access Control Lists (Standard and Extended IPv4 ACLs)

More questions from this topic