Examkin

Question

Difficulty: MediumAccess Control Lists (Standard and Extended IPv4 ACLs)

A network administrator needs to configure an IPv4 extended named Access Control List (ACL) named SECURE_FLOW on a Cisco IOS router. The ACL must implement the following policy requirements in order:
1. Permit SSH access (TCP port 22) specifically from management host 10.20.1.15 to server 172.16.50.10.
2. Deny all other IP traffic originating from the 10.20.1.0/24 subnet targeted to server 172.16.50.10.
3. Permit all remaining IPv4 traffic originating from the 10.20.1.0/24 subnet to any destination.
4. Ensure all other IP traffic from any source not explicitly permitted is implicitly dropped.

Arrange the configuration command statements into the correct top-to-bottom sequential order to achieve this policy.

  1. 1ip access-list extended SECURE_FLOW
  2. 2permit tcp host 10.20.1.15 host 172.16.50.10 eq 22
  3. 3deny ip 10.20.1.0 0.0.0.255 host 172.16.50.10
  4. 4permit ip 10.20.1.0 0.0.0.255 any

Answer

The correct sequence starts by entering named extended ACL configuration mode ('ip access-list extended SECURE_FLOW'), followed by the specific SSH permit statement ('permit tcp host 10.20.1.15 host 172.16.50.10 eq 22'), then the broader subnet server deny statement ('deny ip 10.20.1.0 0.0.0.255 host 172.16.50.10'), and finally the general subnet permit statement ('permit ip 10.20.1.0 0.0.0.255 any').
Cisco ACLs process rules sequentially from top to bottom and stop evaluating as soon as a packet matches an entry. Therefore, specific host exceptions must precede broader subnet rules. Entering named ACL configuration mode ('ip access-list extended SECURE_FLOW') is required first. Next, permitting SSH from host 10.20.1.15 to server 172.16.50.10 must come before denying the entire 10.20.1.0/24 subnet to host 172.16.50.10; otherwise, 10.20.1.15 would match the subnet deny rule and be blocked. Permitting 10.20.1.0/24 to any destination must come after the specific server block so other outbound traffic is allowed before hitting the implicit deny any.

Step-by-Step Solution

1
Define the ACL header
Enter configuration mode for named extended ACL 'SECURE_FLOW'
Cisco IOS requires defining the ACL scope before adding sequential filtering statements.
2
Place the most specific exception statement at the top
Add 'permit tcp host 10.20.1.15 host 172.16.50.10 eq 22'
Cisco ACL processing evaluates entries sequentially top-to-bottom and stops at the first match. The specific host-to-host SSH permit must be evaluated before any broader block rule.
3
Place the restrictive subnet-to-server block rule next
Add 'deny ip 10.20.1.0 0.0.0.255 host 172.16.50.10'
This blocks all remaining hosts on 10.20.1.0/24 from reaching server 172.16.50.10 while allowing host 10.20.1.15's SSH traffic already permitted in step 2.
4
Place the general subnet permit rule last among explicit statements
Add 'permit ip 10.20.1.0 0.0.0.255 any'
This allows the 10.20.1.0/24 subnet to reach all other destinations while relying on the built-in implicit deny at the bottom to drop any unmentioned traffic.

Key Concept

Cisco IOS Access Control Lists evaluate matching statements in sequential top-down order, terminating evaluation immediately upon finding the first match.
Rate this question

Topics

Access Control Lists (Standard and Extended IPv4 ACLs)

More questions from this topic