Examkin

Question

Difficulty: Very hardAccess Control Lists (Standard and Extended IPv4 ACLs)

A network engineer must construct an IPv4 extended Access Control List (ACL) on a Cisco IOS router to enforce the following security policy requirements for traffic originating from subnet 10.20.1.0/2410.20.1.0/24 destined for the server subnet 172.16.10.0/24172.16.10.0/24:

1. Host 10.20.1.510.20.1.5 must be permitted to access SSH (TCP port 22) on the server subnet.
2. Host 10.20.1.510.20.1.5 must be denied all other TCP traffic to the server subnet.
3. All other hosts on subnet 10.20.1.0/2410.20.1.0/24 must be permitted HTTP (TCP port 80) access to the server subnet.
4. All remaining IPv4 traffic from subnet 10.20.1.0/2410.20.1.0/24 to the server subnet must be dropped.

Arrange the ACL statements in the correct top-down sequence (from top/sequence 10 to bottom/sequence 40) to properly enforce this security policy.

  1. 1permit tcp host 10.20.1.5 172.16.10.0 0.0.0.255 eq 22
  2. 2deny tcp host 10.20.1.5 172.16.10.0 0.0.0.255
  3. 3permit tcp 10.20.1.0 0.0.0.255 172.16.10.0 0.0.0.255 eq 80
  4. 4deny ip 10.20.1.0 0.0.0.255 172.16.10.0 0.0.0.255

Answer

The correct order of ACL statements from top to bottom is: permit tcp host 10.20.1.5 172.16.10.0 0.0.0.255 eq 22, followed by deny tcp host 10.20.1.5 172.16.10.0 0.0.0.255, followed by permit tcp 10.20.1.0 0.0.0.255 172.16.10.0 0.0.0.255 eq 80, and finally deny ip 10.20.1.0 0.0.0.255 172.16.10.0 0.0.0.255.
Cisco IPv4 Access Control Lists evaluate statements sequentially from top to bottom until a first match occurs. To enforce host-specific exceptions within a larger subnet, more specific rules (host 10.20.1.5 permits and denies) must precede general rules (subnet 10.20.1.0/24 permits and denies). Placing the SSH permit for host 10.20.1.5 first guarantees SSH functionality. Placing the TCP deny for host 10.20.1.5 second prevents host 10.20.1.5 from matching the subnet HTTP permit rule placed third. Finally, the subnet-wide IP deny statement catches all other traffic from the subnet.

Step-by-Step Solution

1
Identify the most specific exception rule for host 10.20.1.5.
The permit statement for SSH (TCP port 22) for host 10.20.1.5 must be evaluated first.
Cisco ACLs process statements top-down until a match occurs. Placing host 10.20.1.5's SSH permit rule at the top ensures SSH traffic is not dropped by subsequent deny rules.
2
Block all remaining TCP traffic for host 10.20.1.5.
Place 'deny tcp host 10.20.1.5 172.16.10.0 0.0.0.255' second.
Host 10.20.1.5 belongs to the 10.20.1.0/2410.20.1.0/24 subnet. If the general HTTP permit rule for the subnet were placed above this statement, host 10.20.1.5 would accidentally be permitted HTTP access.
3
Permit HTTP traffic for the rest of the 10.20.1.0/2410.20.1.0/24 subnet.
Place 'permit tcp 10.20.1.0 0.0.0.255 172.16.10.0 0.0.0.255 eq 80' third.
Since host 10.20.1.5 has already matched earlier statements for its allowed/denied TCP traffic, remaining hosts in 10.20.1.0/2410.20.1.0/24 reach this step and are permitted HTTP access.
4
Catch all remaining IPv4 traffic from the source subnet.
Place 'deny ip 10.20.1.0 0.0.0.255 172.16.10.0 0.0.0.255' last.
This explicitly drops any non-HTTP traffic from 10.20.1.0/2410.20.1.0/24 to 172.16.10.0/24172.16.10.0/24 before reaching the implicit deny any clause.

Key Concept

Top-Down Sequential Processing and Specific-to-General Ordering in IPv4 Extended ACLs
Rate this question

Topics

Access Control Lists (Standard and Extended IPv4 ACLs)

More questions from this topic