Examkin

Question

Difficulty: MediumAccess Control Lists (Standard and Extended IPv4 ACLs)

A network administrator is evaluating traffic filtering on a Cisco IOS router configured with the following extended IPv4 access control list:

access-list 110 permit tcp 10.2.0.0 0.0.255.255 host 192.168.50.25 eq 22
access-list 110 deny ip 10.2.0.0 0.0.255.255 host 192.168.50.25
access-list 110 permit ip any any

Which two operational outcomes will occur when this access control list is applied inbound on interface GigabitEthernet0/0? (Select TWO.)

  1. SSH traffic originating from host 10.2.15.5 and destined to host 192.168.50.25 is permitted by the router.Answer
  2. HTTP traffic (TCP port 80) originating from host 10.2.15.5 and destined to host 192.168.50.25 is denied by the router.Answer
  3. C
    All IP traffic originating from host 10.3.1.1 and destined to host 192.168.50.25 is dropped by the implicit deny clause.
  4. D
    ICMP echo requests originating from host 10.2.15.5 and destined to host 192.168.50.25 are permitted because ICMP is not a TCP protocol.

Answer

SSH traffic from host 10.2.15.5 to 192.168.50.25 is permitted, and HTTP traffic (TCP port 80) from host 10.2.15.5 to 192.168.50.25 is denied.
Access control lists evaluate packets sequentially from top to bottom until a match is found. For SSH traffic from host 10.2.15.5 to 192.168.50.25, line 1 matches because 10.2.15.5 falls within subnet 10.2.0.0/16 (wildcard 0.0.255.255) and SSH operates on TCP port 22; therefore, SSH traffic is permitted. For HTTP traffic (TCP port 80) from host 10.2.15.5 to 192.168.50.25, it bypasses line 1 because of the port mismatch, but matches line 2 because the 'ip' keyword encompasses all IPv4 payloads including TCP; therefore, HTTP traffic is denied.

Step-by-Step Solution

1
Evaluate the first ACL entry against incoming SSH traffic from 10.2.15.5 to 192.168.50.25.
Host 10.2.15.5 matches wildcard mask 0.0.255.255 (subnet 10.2.0.0/16), destination is host 192.168.50.25, and SSH uses TCP port 22. Line 1 permits this traffic.
ACLs are evaluated sequentially top-down; once a match occurs, no further entries are evaluated.
2
Evaluate HTTP traffic (TCP port 80) from 10.2.15.5 to 192.168.50.25 against the ACL statements.
Line 1 specifies port 22, so port 80 does not match line 1. Processing moves to line 2, which denies all IP traffic from 10.2.0.0/16 to 192.168.50.25. Line 2 denies HTTP traffic.
The 'ip' protocol keyword in extended ACLs includes all higher-layer protocols such as TCP, UDP, and ICMP.
3
Evaluate traffic from host 10.3.1.1 to 192.168.50.25.
Host 10.3.1.1 does not match 10.2.0.0/16 on line 1 or line 2. Processing reaches line 3 'permit ip any any', which explicitly permits the packet.
An explicit 'permit ip any any' statement overrides the default implicit deny for any traffic reaching line 3.

Key Concept

Extended IPv4 Access Control List sequential top-down evaluation, protocol matching, and implicit/explicit statement processing.
Rate this question

Topics

Access Control Lists (Standard and Extended IPv4 ACLs)

More questions from this topic