Examkin

Question

Difficulty: HardAccess Control Lists (Standard and Extended IPv4 ACLs)

A network administrator configures the following IPv4 extended named Access Control List (ACL) on a Cisco IOS router to control access to an internal application server at IP address 192.168.50.10:

text
ip access-list extended APP_FILTER
10 permit tcp 10.10.20.0 0.0.0.255 host 192.168.50.10 eq 80
20 permit tcp 10.10.20.0 0.0.0.255 host 192.168.50.10 eq 443
30 deny ip 10.10.20.0 0.0.0.255 host 192.168.50.10
40 permit ip host 10.10.20.5 host 192.168.50.10

The ACL is applied outbound on GigabitEthernet0/1. An administrator attempts an SSH connection (TCP port 22) from management host 10.10.20.5 to the application server (192.168.50.10), while a user on host 10.10.20.100 attempts a web connection (TCP port 80) to the same server.

Which statement accurately describes how the router processes these two traffic flows?

  1. The SSH flow from 10.10.20.5 is denied by sequence 30, while the HTTP flow from 10.10.20.100 is permitted by sequence 10.Answer
  2. B
    The SSH flow from 10.10.20.5 is permitted by sequence 40, while the HTTP flow from 10.10.20.100 is permitted by sequence 10.
  3. C
    The SSH flow from 10.10.20.5 is denied by the implicit deny clause, while the HTTP flow from 10.10.20.100 is denied by sequence 30.
  4. D
    Both the SSH flow from 10.10.20.5 and the HTTP flow from 10.10.20.100 are denied by sequence 30.

Answer

The SSH flow from 10.10.20.5 is denied by sequence 30, while the HTTP flow from 10.10.20.100 is permitted by sequence 10.
Cisco IOS Access Control Lists process statements sequentially in top-down numerical order. For HTTP traffic (port 80) originating from 10.10.20.100, sequence 10 matches the subnet source 10.10.20.0/24, destination host 192.168.50.10, and TCP port 80, allowing the flow immediately. For SSH traffic (port 22) originating from 10.10.20.5, sequences 10 and 20 fail to match due to destination port mismatches (80 and 443). Sequence 30 specifies protocol 'ip', which encompasses all Layer 4 protocols (including TCP/22), matching host 10.10.20.5 within the 10.10.20.0/24 subnet and dropping the packet. Sequence 40 is never reached for host 10.10.20.5 because sequence 30 matches first.

Step-by-Step Solution

1
Evaluate the HTTP flow (Source: 10.10.20.100, Destination: 192.168.50.10, Protocol: TCP, Destination Port: 80) against sequence 10.
Sequence 10 permits TCP traffic from 10.10.20.0/24 to host 192.168.50.10 on port 80. Match found; processing stops and traffic is permitted.
Top-down evaluation stops immediately at the first matching entry.
2
Evaluate the SSH flow (Source: 10.10.20.5, Destination: 192.168.50.10, Protocol: TCP, Destination Port: 22) against sequence 10 and 20.
Port 22 does not match port 80 (sequence 10) or port 443 (sequence 20). Evaluation moves to sequence 30.
Extended ACLs require all specified criteria (protocol, source, destination, port) to match.
3
Evaluate the SSH flow against sequence 30 (deny ip 10.10.20.0 0.0.0.255 host 192.168.50.10).
Host 10.10.20.5 is within 10.10.20.0/24, destination is 192.168.50.10, and 'ip' matches all IP protocols including TCP. Match found; traffic is denied.
Sequence 30 catches all remaining IP traffic from the subnet before sequence 40 can ever be reached.

Key Concept

Top-Down Sequential Processing in Cisco IPv4 Extended ACLs
Rate this question

Topics

Access Control Lists (Standard and Extended IPv4 ACLs)

More questions from this topic