Examkin

Question

Difficulty: MediumAccess Control Lists (Standard and Extended IPv4 ACLs)

A network administrator needs to construct an IPv4 extended Access Control List (ACL) on a Cisco IOS router to enforce the following security policy for internal users in the 192.168.1.0/24192.168.1.0/24 network:

1. Host 192.168.1.50192.168.1.50 must be permitted SSH access to the administrative server at 10.0.0.1010.0.0.10.
2. All other TCP traffic from the 192.168.1.0/24192.168.1.0/24 subnet destined to server 10.0.0.1010.0.0.10 must be blocked.
3. All hosts in the 192.168.1.0/24192.168.1.0/24 subnet must be permitted web access (HTTP) to any destination server.
4. General ICMP traffic must be allowed from any source to any destination.

Arrange the ACL statements from top to bottom (first line to last line) in the correct sequential order to achieve this policy without unintentionally blocking desired traffic.

  1. 1access-list 101 permit tcp host 192.168.1.50 host 10.0.0.10 eq 22
  2. 2access-list 101 deny tcp 192.168.1.0 0.0.0.255 host 10.0.0.10
  3. 3access-list 101 permit tcp 192.168.1.0 0.0.0.255 any eq 80
  4. 4access-list 101 permit icmp any any

Answer

The statements must be ordered sequentially from most specific host entry to broader subnet rules: first permit SSH from host 192.168.1.50 to 10.0.0.10, second deny all TCP from 192.168.1.0/24 to 10.0.0.10, third permit HTTP (port 80) from 192.168.1.0/24 to any, and fourth permit ICMP from any to any.
Cisco IOS ACLs process entries sequentially from top to bottom. The correct order places the most specific host-level permit rule for SSH at line 1, followed by the specific TCP deny rule to server 10.0.0.10 at line 2. Line 3 permits HTTP to any destination (which correctly permits HTTP except to 10.0.0.10, which was already matched and denied at line 2). Line 4 permits ICMP traffic before the implicit deny ip any any statement drops all remaining traffic.

Step-by-Step Solution

1
Identify the most specific exception rule.
Host 192.168.1.50 requires SSH access (TCP port 22) to host 10.0.0.10. Cisco ACLs evaluate top-down and stop at the first match. Therefore, 'permit tcp host 192.168.1.50 host 10.0.0.10 eq 22' must be the first line.
If a broader subnet deny statement were placed above this statement, host 192.168.1.50 would be blocked from establishing SSH sessions.
2
Identify the target subnet restriction rule.
All other TCP traffic from subnet 192.168.1.0/24 to host 10.0.0.10 must be blocked. The entry 'deny tcp 192.168.1.0 0.0.0.255 host 10.0.0.10' is placed second.
Placing this rule second ensures host 192.168.1.50 is permitted SSH access while all other TCP attempts to server 10.0.0.10 are dropped.
3
Place broader service permit rules after destination-specific deny rules.
The requirement states that all other HTTP traffic from 192.168.1.0/24 to any destination must be permitted, except HTTP to 10.0.0.10 which is covered under step 2. Placing 'permit tcp 192.168.1.0 0.0.0.255 any eq 80' third ensures HTTP to 10.0.0.10 is blocked while HTTP to all other hosts is permitted.
If the general HTTP permit rule were placed before the TCP deny rule for 10.0.0.10, HTTP traffic to 10.0.0.10 would match the permit rule and bypass security policy #2.
4
Place general IP protocol permit rules.
Place 'permit icmp any any' fourth. Unmatched traffic will hit the implicit 'deny ip any any' at the bottom of the ACL.
ICMP traffic needs explicit permission before the implicit deny clause drops all unreferenced packets.

Key Concept

Cisco IOS ACL Top-Down Sequential Evaluation Logic and Specific-to-General Ordering
Estimated Time:1m 30s
Rate this question

Topics

Access Control Lists (Standard and Extended IPv4 ACLs)

More questions from this topic