Examkin

Question

Difficulty: HardAccess Control Lists (Standard and Extended IPv4 ACLs)

A network administrator configures a Cisco IOS router to restrict access to a financial database server (192.168.50.100/32192.168.50.100/32) from the HR subnet (192.168.10.0/24192.168.10.0/24). All other traffic between subnets must be permitted. The administrator applies the following access list in the inbound direction on interface GigabitEthernet0/0:

text
ip access-list extended FILTER_HR
deny ip 192.168.10.0 0.0.0.255 host 192.168.50.100

After applying this ACL, users report that all traffic targeting any server in the 192.168.50.0/24192.168.50.0/24 network is being dropped, including traffic from non-HR subnets. Which configuration change will resolve the issue and permit intended traffic?

  1. Append the statement `permit ip any any` to the end of the `FILTER_HR` access list.Answer
  2. B
    Modify the deny statement to use a wildcard mask of `0.0.255.255` instead of `0.0.0.255`.
  3. C
    Re-apply the ACL to interface GigabitEthernet0/0 in the outbound direction using `ip access-group FILTER_HR out`.
  4. D
    Change the protocol from `ip` to `tcp` and append `eq 80` to restrict only Web traffic.

Answer

Appending the statement `permit ip any any` to the end of the `FILTER_HR` access list resolves the issue by explicitly permitting all traffic that does not match the deny rule.
Every IPv4 ACL in Cisco IOS ends with an invisible, mandatory `deny ip any any` statement. When an ACL contains only `deny` statements, any packet that does not match those deny statements reaches the bottom of the list and is dropped. Appending `permit ip any any` allows all other IP traffic to pass through as intended.

Step-by-Step Solution

1
Analyze the existing ACL configuration and traffic processing logic.
The current ACL contains only a single statement: `deny ip 192.168.10.0 0.0.0.255 host 192.168.50.100`.
Cisco IOS Access Control Lists append an unwritten, implicit `deny ip any any` statement at the very end of every access list.
2
Trace packet evaluation for non-matching traffic.
Traffic from HR targeting other servers, or traffic from non-HR subnets, fails to match the `deny` line and falls through to the implicit deny at the end of the list, resulting in all traffic being dropped.
Top-down sequential processing drops any packet that reaches the end of an ACL without matching an explicit `permit` line.
3
Determine the necessary configuration addition.
Adding `permit ip any any` at the end ensures that traffic not matching the specific host deny rule is allowed through.
An explicit permit statement overrides the implicit deny clause for all remaining traffic.

Key Concept

Access Control List Sequential Processing and the Implicit Deny Any Clause
Rate this question

Topics

Access Control Lists (Standard and Extended IPv4 ACLs)

More questions from this topic