A network administrator is creating an IPv4 extended Access Control List (ACL) on a Cisco … — Cisco CCNA

A network administrator is creating an IPv4 extended Access Control List (ACL) on a Cisco IOS router to regulate traffic flowing from internal hosts to the DMZ subnet ( $172.16.1.0/24$ ). The ACL must enforce the following policy requirements in order of precedence:

1. Allow HTTP traffic from any host in the internal subnet ( $192.168.10.0/24$ ) to the web server at $172.16.1.50$ .
2. Block all other IP traffic from host $192.168.10.15$ to the DMZ subnet ( $172.16.1.0/24$ ).
3. Allow all remaining IP traffic from the internal subnet ( $192.168.10.0/24$ ) to the DMZ subnet ( $172.16.1.0/24$ ).
4. Explicitly deny all other traffic.

Arrange the given ACL statements in the correct top-down execution order to achieve this security policy without unintended traffic drops.

1permit tcp 192.168.10.0 0.0.0.255 host 172.16.1.50 eq 80
2deny ip host 192.168.10.15 172.16.1.0 0.0.0.255
3permit ip 192.168.10.0 0.0.0.255 172.16.1.0 0.0.0.255
4deny ip any any

Answer

The correct sequential order for the access list statements from top to bottom is: permit tcp 192.168.10.0 0.0.0.255 host 172.16.1.50 eq 80, followed by deny ip host 192.168.10.15 172.16.1.0 0.0.0.255, followed by permit ip 192.168.10.0 0.0.0.255 172.16.1.0 0.0.0.255, and ending with deny ip any any.

Cisco IPv4 Access Control Lists evaluate rules sequentially from top to bottom. Specific exceptions must precede broader policy rules. The rule permitting HTTP traffic from 192.168.10.0/24 to 172.16.1.50 must be placed first so HTTP requests from host 192.168.10.15 are allowed. Next, the statement denying all IP traffic from host 192.168.10.15 to the DMZ network must be placed to filter out non-HTTP traffic from that specific host. Third, the broader subnet permit statement allows other hosts on 192.168.10.0/24 to access the DMZ network. Finally, the explicit deny statement is placed at the bottom.

Step-by-Step Solution

Identify specific host and protocol exemptions.

HTTP traffic (TCP port 80) from host 192.168.10.15 to host 172.16.1.50 must be permitted.

Cisco ACLs process packets sequentially from top to bottom and stop at the first matching statement. If the host deny statement came first, HTTP traffic from 192.168.10.15 would be matched and dropped immediately.

Place specific deny statements for targeted hosts after specific permits but before general permits.

Position 'deny ip host 192.168.10.15 172.16.1.0 0.0.0.255' second.

This blocks any non-HTTP traffic from host 192.168.10.15 before reaching the general subnet permit rule.

Place general subnet-to-subnet permit statements.

Position 'permit ip 192.168.10.0 0.0.0.255 172.16.1.0 0.0.0.255' third.

This allows all remaining valid hosts on the 192.168.10.0/24 network to communicate with the DMZ network.

Add the explicit deny catch-all statement.

Position 'deny ip any any' fourth.

Completes the ACL structure and enforces standard explicit filtering at the end of the access list.

Key Concept

Access Control List Top-Down Sequential Processing and Rule Specificity

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic