Examkin

Question

Difficulty: HardAccess Control Lists (Standard and Extended IPv4 ACLs)

A network technician configures the following named IPv4 extended Access Control List (ACL) on a Cisco IOS router to restrict access from the Sales subnet (192.168.20.0/24192.168.20.0/24) to an internal web server (10.2.2.8010.2.2.80):

`ip access-list extended RESTRICT_SALES`
` deny tcp 192.168.20.0 0.0.0.255 host 10.2.2.80 eq 80`
` permit tcp 192.168.20.0 0.0.0.255 any eq 80`
` permit tcp 192.168.20.0 0.0.0.255 any eq 443`

The ACL is applied outbound on interface GigabitEthernet0/1 facing the internal network server segment. Following application, host 192.168.20.45192.168.20.45 can no longer resolve domain names using the internal DNS server at 10.2.2.5310.2.2.53 (UDP port 53) or receive DHCP lease updates. Which statement correctly explains why this non-HTTP traffic is blocked?

  1. The unlisted UDP and ICMP traffic matches the implicit deny all IPv4 traffic rule appended to the end of the ACL processing sequence.Answer
  2. B
    Extended ACLs automatically drop all UDP packets when applied outbound unless an explicit standard ACL permits the protocol inbound on the ingress interface.
  3. C
    The deny tcp statement implicitly converts the entire access list into a protocol-specific filter that suppresses all UDP socket connections.
  4. D
    The router routes UDP traffic to the null interface because the wildcard mask 0.0.0.255 covers host addresses rather than transport layer protocols.

Answer

The unlisted UDP and ICMP traffic matches the implicit deny all IPv4 traffic rule appended to the end of the ACL processing sequence.
In Cisco IOS ACL processing, statements are evaluated sequentially from top to bottom. If a packet does not match any explicit permit or deny entry in the access list, it falls through to the invisible implicit deny entry at the end of the ACL ('deny ip any any'). Because the list only explicitly permits TCP traffic on ports 80 and 443, non-TCP traffic such as UDP DNS requests fails all explicit entries and is dropped by the implicit deny.

Step-by-Step Solution

1
Analyze the sequential processing of the configured extended IPv4 ACL entries.
Line 1 denies TCP traffic to host 10.2.2.80 on port 80. Line 2 permits TCP traffic to any destination on port 80. Line 3 permits TCP traffic to any destination on port 443.
Cisco IOS ACL entries are evaluated in strict top-down order until a match occurs.
2
Evaluate how UDP traffic (such as DNS on UDP port 53) is evaluated against the rules.
UDP traffic fails to match Line 1 (TCP), Line 2 (TCP), and Line 3 (TCP).
Protocol matching in extended ACLs requires the packet protocol field to match the rule's specified protocol.
3
Determine the final action taken when no explicit rule matches.
The packet encounters the unwritten implicit 'deny ip any any' at the end of the ACL list and is dropped.
All Cisco ACLs conclude with an implicit deny all clause that drops any traffic not explicitly permitted by a preceding rule.

Key Concept

Implicit Deny Clause in IPv4 ACLs
Rate this question

Topics

Access Control Lists (Standard and Extended IPv4 ACLs)

More questions from this topic