Examkin

Question

Difficulty: MediumAccess Control Lists (Standard and Extended IPv4 ACLs)

An administrator configures the following IPv4 extended named access control list on a Cisco IOS router:

text
ip access-list extended BLOCK_WEB_SERVICES
deny tcp 10.20.30.0 0.0.0.255 host 192.168.100.10 eq 80
deny tcp 10.20.30.0 0.0.0.255 host 192.168.100.10 eq 443

This ACL is applied inbound on interface GigabitEthernet0/0. A host with IP address 10.20.30.15 attempts to send ICMP echo request packets to 192.168.100.10. What occurs when this ICMP traffic reaches the router interface?

  1. The ICMP traffic is dropped because it encounters the implicit deny all statement at the end of the ACL.Answer
  2. B
    The ICMP traffic is permitted and forwarded because it does not match the TCP destination port conditions in the deny statements.
  3. C
    The ICMP traffic is permitted because extended ACLs automatically bypass filtering for Layer 3 control protocols like ICMP.
  4. D
    The ICMP traffic is dropped because extended ACLs restrict all traffic types whenever specific TCP port filters are defined.

Answer

The ICMP traffic is dropped because it encounters the implicit deny all statement at the end of the ACL.
Cisco IPv4 Access Control Lists evaluate entries sequentially from top to bottom. If a packet does not match any explicit permit or deny entry in the list, it hits the unwritten implicit deny clause ('deny ip any any') at the end of the ACL. Since the ACL only contains explicit deny entries for TCP ports 80 and 443, ICMP packets fail to match those specific lines and are dropped by the implicit deny.

Step-by-Step Solution

1
Evaluate the first entry (seq 10 / line 1) against the packet.
Packet is ICMP from 10.20.30.15 to 192.168.100.10. Line 1 checks for TCP port 80 traffic. No match occurs.
Protocol mismatch (ICMP vs TCP).
2
Evaluate the second entry (seq 20 / line 2) against the packet.
Line 2 checks for TCP port 443 traffic. No match occurs.
Protocol mismatch (ICMP vs TCP).
3
Evaluate the implicit default behavior at the bottom of the ACL.
Every Cisco IOS IPv4 ACL ends with an unwritten 'deny ip any any' rule. The ICMP packet matches this implicit rule.
Traffic not explicitly permitted is denied by default.

Key Concept

Every IPv4 ACL in Cisco IOS concludes with an invisible implicit deny statement ('deny ip any any'). To permit non-denied traffic, an explicit permit statement (such as 'permit ip any any') must be added.
Rate this question

Topics

Access Control Lists (Standard and Extended IPv4 ACLs)

More questions from this topic