Examkin

Question

Difficulty: HardAccess Control Lists (Standard and Extended IPv4 ACLs)

A network engineer must configure an IPv4 extended access control list (ACL 105) on a Cisco IOS router to enforce security policies for traffic originating from the internal subnet (10.1.1.0/2410.1.1.0/24) destined for an application server at 10.2.2.1010.2.2.10:

1. Allow host 10.1.1.5010.1.1.50 administrative SSH access (TCP port 22) to server 10.2.2.1010.2.2.10.
2. Prevent all other hosts in the 10.1.1.0/2410.1.1.0/24 subnet from accessing server 10.2.2.1010.2.2.10 via SSH.
3. Allow all hosts in the 10.1.1.0/2410.1.1.0/24 subnet web access (TCP port 80) to server 10.2.2.1010.2.2.10.
4. Explicitly block all remaining IP traffic from 10.1.1.0/2410.1.1.0/24 to server 10.2.2.1010.2.2.10.

In what order should the network engineer place the ACL statements from top to bottom to ensure the policy is correctly enforced?

  1. 1access-list 105 permit tcp host 10.1.1.50 host 10.2.2.10 eq 22
  2. 2access-list 105 deny tcp 10.1.1.0 0.0.0.255 host 10.2.2.10 eq 22
  3. 3access-list 105 permit tcp 10.1.1.0 0.0.0.255 host 10.2.2.10 eq 80
  4. 4access-list 105 deny ip 10.1.1.0 0.0.0.255 host 10.2.2.10

Answer

The ACL statements must be placed from top to bottom in the sequence: 1) access-list 105 permit tcp host 10.1.1.50 host 10.2.2.10 eq 22, 2) access-list 105 deny tcp 10.1.1.0 0.0.0.255 host 10.2.2.10 eq 22, 3) access-list 105 permit tcp 10.1.1.0 0.0.0.255 host 10.2.2.10 eq 80, and 4) access-list 105 deny ip 10.1.1.0 0.0.0.255 host 10.2.2.10.
Cisco IOS Access Control Lists enforce policies based on top-down, first-match evaluation logic. Once a packet matches an ACL line's source, destination, protocol, and port criteria, the router executes the action (permit or deny) and ignores all subsequent entries. To properly allow host 10.1.1.50 to access SSH while denying SSH to the rest of the 10.1.1.0/24 subnet, the host permit rule must appear first. Next, the subnet SSH deny rule blocks all other SSH attempts. Following that, the HTTP permit rule allows web traffic for the subnet. Finally, the broad IP deny statement catches any remaining traffic types from the subnet.

Step-by-Step Solution

1
Analyze top-down evaluation mechanics in Cisco IOS IPv4 ACLs.
Cisco IOS ACL entries are processed sequentially in top-down order until the first matching line is hit, at which point packet evaluation stops.
More specific exception rules must precede general or broader range rules to prevent premature match execution.
2
Place the specific host SSH permit statement first.
'access-list 105 permit tcp host 10.1.1.50 host 10.2.2.10 eq 22' is placed at position 1.
Host 10.1.1.50 is an IP within subnet 10.1.1.0/24. If the subnet SSH deny rule came first, 10.1.1.50 would match the subnet rule and be denied.
3
Place the subnet SSH deny statement second.
'access-list 105 deny tcp 10.1.1.0 0.0.0.255 host 10.2.2.10 eq 22' is placed at position 2.
This guarantees that all other SSH packets originating from 10.1.1.0/24 (excluding 10.1.1.50) are dropped before subsequent permit lines are evaluated.
4
Place the subnet HTTP permit statement third.
'access-list 105 permit tcp 10.1.1.0 0.0.0.255 host 10.2.2.10 eq 80' is placed at position 3.
This permits HTTP port 80 traffic for all hosts in the subnet after non-authorized SSH traffic has already been blocked.
5
Place the subnet broad IP deny statement fourth.
'access-list 105 deny ip 10.1.1.0 0.0.0.255 host 10.2.2.10' is placed at position 4.
This catches and drops any remaining IP protocols from subnet 10.1.1.0/24 to server 10.2.2.10.

Key Concept

Cisco IOS ACL Top-Down Sequential First-Match Processing
Rate this question

Topics

Access Control Lists (Standard and Extended IPv4 ACLs)

More questions from this topic