Examkin

Question

Difficulty: Very hardAccess Control Lists (Standard and Extended IPv4 ACLs)

A network administrator configures an IPv4 extended numbered Access Control List (ACL 110) on a Cisco IOS router interface to prevent web traffic on TCP port 80 from reaching an internal web server at 192.168.10.50/32. The administrator enters the following single configuration command:

`R1(config)# access-list 110 deny tcp 10.1.1.0 0.0.0.255 host 192.168.10.50 eq 80`

ACL 110 is then applied inbound on the GigabitEthernet0/0 interface serving subnet 10.1.1.0/24. Immediately after applying the ACL, users on the 10.1.1.0/24 network report that all network communication is blocked, including ICMP pings, SSH access, and traffic destined for other subnets. Which configuration oversight is causing all traffic from subnet 10.1.1.0/24 to be dropped?

  1. The ACL lacks an explicit permit statement, causing all unlisted IPv4 traffic to be dropped by the default implicit deny any clause at the end of the list.Answer
  2. B
    The router processes forwarding decisions using longest prefix match prior to ACL evaluation, which overrides the single deny statement for non-matching destinations.
  3. C
    The extended access-list configuration omitted the overload keyword necessary to maintain stateful translations for multi-host subnets.
  4. D
    A floating static route configured on GigabitEthernet0/0 takes precedence over ACL rules due to its lower administrative distance.

Answer

The ACL lacks an explicit permit statement, causing all unlisted IPv4 traffic to be dropped by the default implicit deny any clause at the end of the list.
Every standard and extended Cisco IPv4 ACL concludes with an unwritten, invisible implicit deny clause ('deny ip any any'). When an ACL contains only a deny statement, any traffic that does not meet the specific deny criteria drops through to the implicit deny clause and is blocked. To fix this, a network administrator must configure a subsequent permit statement (such as 'access-list 110 permit ip any any') to allow all other traffic to pass through.

Step-by-Step Solution

1
Analyze the sequential evaluation of IPv4 Access Control Lists in Cisco IOS.
Cisco ACLs process statements sequentially from top to bottom until a match occurs.
If a packet matches a specific permit or deny statement, no further statements in the list are evaluated.
2
Examine the default behavior when a packet reaches the end of an ACL without matching any explicit statement.
An invisible 'deny ip any any' statement exists at the end of every IPv4 ACL.
Traffic that does not match an explicit permit rule is automatically dropped.
3
Evaluate the configured ACL 110 against non-HTTP traffic (e.g., ICMP, SSH, or web traffic to other hosts).
Non-HTTP traffic does not match the single 'deny tcp ... eq 80' rule and falls through to the implicit deny statement.
To allow remaining legitimate traffic, an explicit 'access-list 110 permit ip any any' rule must be appended after the deny statement.

Key Concept

Implicit Deny Any Clause in IPv4 ACLs
Rate this question

Topics

Access Control Lists (Standard and Extended IPv4 ACLs)

More questions from this topic