A network engineer configures an extended IPv4 access control list named `CORP_SEC` on a C… — Cisco CCNA

A network engineer configures an extended IPv4 access control list named `CORP_SEC` on a Cisco IOS router to regulate access from the branch network ( $10.40.0.0/16$ ) to an internal web server ( $192.168.50.10/32$ ). The security requirement specifies that host $10.40.4.15$ in the IT subnet ( $10.40.4.0/22$ ) must be allowed HTTPS access (TCP port 443) to the web server, while all other traffic from $10.40.0.0/16$ to the $192.168.50.0/24$ network must be denied. Additionally, non-matching traffic must reach external destinations freely.

The engineer enters the following configuration commands:

text
ip access-list extended CORP_SEC
10 deny ip 10.40.0.0 0.0.255.255 192.168.50.0 0.0.0.255
20 permit tcp host 10.40.4.15 host 192.168.50.10 eq 443
30 permit ip any any
!
interface GigabitEthernet0/0/1
ip access-group CORP_SEC in

During testing, HTTPS traffic from $10.40.4.15$ to $192.168.50.10$ is unexpectedly dropped. Which modification corrects the access control list logic to satisfy all requirements?

Reorder the ACL so sequence 20 is processed before sequence 10, while leaving sequence 30 in place.Answer
B
Change sequence 10 to `deny ip 10.40.0.0 0.0.3.255 192.168.50.0 0.0.0.255` to narrow the denied source subnet.
C
Remove sequence 30 so that the ACL relies on the default implicit deny clause for unmatched traffic.
D
Apply `ip access-group CORP_SEC out` on interface GigabitEthernet0/0/1 instead of inbound.

Answer

Reorder the access control list so sequence 20 is evaluated prior to sequence 10, retaining sequence 30 at the bottom.

Cisco IOS Access Control Lists process statements sequentially from top to bottom. The first statement that matches a packet determines the outcome, terminating further evaluation. In the original configuration, sequence 10 broad-denied all traffic from

10.40.0.0/16

192.168.50.0/24

. Because host

10.40.4.15

is part of

10.40.0.0/16

, its HTTPS packets matched sequence 10 first and were dropped before reaching sequence 20. Reordering sequence 20 above sequence 10 allows the specific HTTPS flow to be permitted first. Retaining sequence 30 (`permit ip any any`) ensures non-matching traffic to other networks is not blocked by the implicit deny any clause at the end of the list.

Step-by-Step Solution

Analyze top-down sequential processing logic of Cisco IPv4 ACLs.

Sequence 10 `deny ip 10.40.0.0 0.0.255.255 192.168.50.0 0.0.0.255` matches all IP packets originating from

10.40.0.0/16

heading to

192.168.50.0/24

Host

10.40.4.15

resides within

10.40.0.0/16

. Therefore, HTTPS packets match line 10 first and are immediately dropped before reaching line 20.

Determine placement of specific versus general rules.

The specific exception (`permit tcp host 10.40.4.15 host 192.168.50.10 eq 443`) must precede the broad deny rule (`deny ip 10.40.0.0 0.0.255.255 192.168.50.0 0.0.0.255`).

Top-down execution terminates search upon the first matching entry. Placing specific permit statements above broader deny statements ensures granular access controls work.

Verify requirement for non-matching traffic handling.

Sequence 30 `permit ip any any` must remain at the end of the ACL.

Without `permit ip any any`, all traffic going to external destinations outside

192.168.50.0/24

would hit the implicit `deny ip any any` at the bottom of the ACL and be dropped.

Key Concept

Top-Down Sequential Processing and Placement Strategy in Extended IPv4 ACLs

Estimated Time:2m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic