A network engineer is configuring a named extended IPv4 Access Control List (ACL) on a Cis… — Cisco CCNA

A network engineer is configuring a named extended IPv4 Access Control List (ACL) on a Cisco IOS router to implement a multi-tier security policy. The ACL must process rules top-down to meet the following requirements:
1. Permit SSH access ( $TCP$ port 22) from the specific management host $192.168.100.50$ to the core server interface $10.1.1.1$ .
2. Deny all other IP traffic originating from the Management subnet ( $192.168.100.0/24$ ) destined for the Server Farm subnet ( $10.1.0.0/16$ ).
3. Permit ICMP echo traffic from the Operations subnet ( $172.16.20.0/24$ ) to any destination.
4. Permit all remaining IPv4 traffic across all subnets.

In what order should the access-list statements be configured from top (first statement executed) to bottom (last statement executed) to ensure proper sequential traffic processing without unintended dropping of packets?

1permit tcp host 192.168.100.50 host 10.1.1.1 eq 22
2deny ip 192.168.100.0 0.0.0.255 10.1.0.0 0.0.255.255
3permit icmp 172.16.20.0 0.0.0.255 any echo
4permit ip any any

Answer

The correct order of ACL statements from top to bottom is: 1) permit tcp host 192.168.100.50 host 10.1.1.1 eq 22, 2) deny ip 192.168.100.0 0.0.0.255 10.1.0.0 0.0.255.255, 3) permit icmp 172.16.20.0 0.0.0.255 any echo, 4) permit ip any any.

Cisco Access Control Lists evaluate matching statements in a strict top-down sequential order. Once a packet matches an Access Control Entry (ACE), processing stops for that packet. Therefore, more specific rules (such as permitting TCP port 22 from host

192.168.100.50

to host

10.1.1.1

) must appear before broader rules (such as denying

192.168.100.0/24

10.1.0.0/16

). Finally, 'permit ip any any' must be placed at the end to prevent unmentioned traffic from being dropped by the implicit deny rule.

Step-by-Step Solution

Identify specific host permit exception

Recognize that 'permit tcp host 192.168.100.50 host 10.1.1.1 eq 22' is a specific exception to a broader subnet blocking rule.

Cisco ACLs process rules sequentially from top to bottom and stop at the first match. Specific host rules must always precede general subnet rules that overlap with them.

Place broader subnet deny rule

Position 'deny ip 192.168.100.0 0.0.0.255 10.1.0.0 0.0.255.255' immediately after the specific permit rule.

This blocks all other hosts in

192.168.100.0/24

from accessing any hosts in

10.1.0.0/16

Add specific subnet feature permits

Add 'permit icmp 172.16.20.0 0.0.0.255 any echo' to allow Operations ICMP traffic.

Matches the requirement for ICMP echo traffic from

172.16.20.0/24

Add explicit catch-all permit rule

Append 'permit ip any any' at the very bottom.

Without this rule, Cisco IOS ACLs end with an implicit 'deny ip any any' clause, which would drop all other traffic across the network.

Key Concept

Cisco IPv4 Extended ACL sequential top-down evaluation and implicit deny override.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic