Examkin

Question

Difficulty: MediumAccess Control Lists (Standard and Extended IPv4 ACLs)

A network engineer applies the following extended IPv4 access control list inbound on router interface GigabitEthernet0/0/0 to allow web administration access from an operations subnet (172.16.50.0/24172.16.50.0/24) to a database server (10.0.1.50/3210.0.1.50/32):

text
ip access-list extended ADMIN_TO_DB
permit tcp 172.16.50.0 0.0.0.255 host 10.0.1.50 eq 443

Immediately after applying the ACL, administrators report that HTTPS connections to 10.0.1.5010.0.1.50 work as expected, but SSH connections and ICMP echo requests (ping) from the operations subnet to 10.0.1.5010.0.1.50 fail. What is the root cause of this behavior?

  1. The implicit deny statement at the end of the ACL drops all IPv4 traffic that does not match an explicit permit entry.Answer
  2. B
    Extended ACLs require an explicit 'deny icmp' statement to block ping requests, which triggers default interface dropping for SSH.
  3. C
    The wildcard mask 0.0.0.255 filters out non-TCP protocols by default when specified in an extended access list.
  4. D
    Extended ACLs permit ICMP and SSH traffic automatically unless port 22 and protocol ICMP are explicitly defined in a deny rule.

Answer

The implicit deny statement at the end of the access control list automatically drops all unlisted IPv4 traffic, including SSH and ICMP.
Every Cisco IOS IPv4 Access Control List ends with an unwritten, invisible entry commonly referred to as the implicit deny clause ('deny ip any any'). Because the ACL contains only a single permit entry for TCP port 443, any non-matching packets—such as SSH (TCP port 22) or ICMP—are caught by this final implicit deny rule and dropped.

Step-by-Step Solution

1
Analyze the configured ACL statement.
The statement 'permit tcp 172.16.50.0 0.0.0.255 host 10.0.1.50 eq 443' explicitly permits only TCP traffic sourced from 172.16.50.0/24 destined to 10.0.1.50 on destination port 443 (HTTPS).
Extended ACLs check source IP, destination IP, protocol, and port numbers.
2
Evaluate how unlisted traffic (SSH on port 22 and ICMP) is processed.
SSH and ICMP packets do not match the single permit rule configured in the list.
ACL entries are processed sequentially from top to bottom.
3
Apply default Cisco IOS ACL termination logic.
Traffic that fails to match any explicit ACE reaches the end of the ACL and hits the implicit 'deny ip any any' rule, resulting in packet drops.
All Cisco IPv4 ACLs append an invisible deny-all statement at the bottom of the access list.

Key Concept

ACL Sequential Processing and Implicit Deny Behavior
Estimated Time:1m 15s
Rate this question

Topics

Access Control Lists (Standard and Extended IPv4 ACLs)

More questions from this topic