Examkin

Question

Difficulty: MediumAccess Control Lists (Standard and Extended IPv4 ACLs)

A network engineer configures an extended IPv4 Access Control List (ACL) on a Cisco IOS router interface with the following commands:

text
access-list 105 permit tcp 192.168.10.0 0.0.0.255 172.16.1.0 0.0.0.255 eq 22
access-list 105 permit icmp 192.168.10.0 0.0.0.255 172.16.1.0 0.0.0.255 echo

This ACL is applied in the inbound direction on interface GigabitEthernet0/1 (192.168.10.1/24192.168.10.1/24). Which two statements correctly describe how traffic entering interface GigabitEthernet0/1 is processed by this ACL?

  1. An SSH session initiated from host 192.168.10.50192.168.10.50 to destination host 172.16.1.10172.16.1.10 will be permitted.Answer
  2. HTTP requests (TCP port 80) from host 192.168.10.50192.168.10.50 to host 172.16.1.10172.16.1.10 will be dropped because of the implicit deny clause.Answer
  3. C
    HTTP requests (TCP port 80) from host 192.168.10.50192.168.10.50 to host 172.16.1.10172.16.1.10 will be forwarded normally because port 80 is not explicitly denied.
  4. D
    ICMP echo reply packets returning from host 172.16.1.10172.16.1.10 back to host 192.168.10.50192.168.10.50 are permitted by the second entry of this ACL.

Answer

SSH sessions to 172.16.1.10 are permitted by the explicit TCP port 22 permit statement, and HTTP requests to 172.16.1.10 are dropped due to the implicit deny at the end of the ACL.
The extended access list explicitly permits TCP packets destined for port 22 (SSH) originating from 192.168.10.0/24192.168.10.0/24 toward 172.16.1.0/24172.16.1.0/24. Traffic on unlisted destination ports, such as HTTP port 80, does not match either permit rule and is filtered by the implicit deny any clause at the end of the ACL processing sequence.

Step-by-Step Solution

1
Analyze rule 1 of ACL 105
Matches TCP traffic from source 192.168.10.0/24 to destination 172.16.1.0/24 on destination port 22 (SSH).
Permits SSH traffic from the internal host subnet to the target destination subnet.
2
Analyze rule 2 of ACL 105
Matches ICMP echo requests from 192.168.10.0/24 to 172.16.1.0/24.
Permits outgoing ping requests from source subnet to destination subnet.
3
Evaluate unlisted traffic types (such as HTTP)
Unlisted traffic reaches the end of the access list without matching any permit statement.
All Cisco IOS ACLs end with an unwritten 'deny ip any any' statement that drops any non-matching packets.

Key Concept

Extended IPv4 Access Control List matching logic and the implicit deny clause
Estimated Time:1m 30s
Rate this question

Topics

Access Control Lists (Standard and Extended IPv4 ACLs)

More questions from this topic