Examkin

Question

Difficulty: HardAccess Control Lists (Standard and Extended IPv4 ACLs)

An enterprise router is configured with the following extended IPv4 access control list applied inbound on interface GigabitEthernet0/0/0:

text ip access-list extended SECURE_APP permit tcp 172.16.5.0 0.0.0.255 host 10.0.1.20 eq 80 permit ip host 172.16.5.10 host 10.0.1.20

Host A (IP address 172.16.5.15) attempts to establish an HTTPS connection (TCP port 443) to the application server at 10.0.1.20. Which statement accurately describes how the router processes this traffic?

  1. The router drops the packet because it fails to match the TCP destination port in the first line and does not match the source host in the second line, causing it to fall through to the implicit deny.Answer
  2. B
    The router permits the packet because the first access list entry matches any TCP traffic originating from the 172.16.5.0/24 source subnet regardless of destination port.
  3. C
    The router permits the packet because the second access list entry permits all IP protocols for any host within the 172.16.5.0/24 subnet.
  4. D
    The router forwards the packet because extended ACLs automatically permit return traffic for established TCP sessions matching the source subnet.

Answer

The router drops the traffic because it fails to match both explicit permit rules and consequently hits the unwritten implicit deny clause at the end of the access list.
The correct response identifies that extended access control lists process rules top-down, checking source address, destination address, and protocol port numbers. For host 172.16.5.15 using HTTPS (port 443), line 1 fails because the destination port is 443 instead of 80. Line 2 fails because the source host address 172.16.5.15 does not match host 172.16.5.10. Consequently, the packet reaches the default implicit deny clause at the end of the list and is dropped.

Step-by-Step Solution

1
Evaluate the packet against the first access-list entry (`permit tcp 172.16.5.0 0.0.0.255 host 10.0.1.20 eq 80`).
The packet source IP 172.16.5.15 matches `172.16.5.0 0.0.0.255` and destination IP `10.0.1.20` matches `host 10.0.1.20`. However, the destination port is 443 (HTTPS), which does not equal port 80 (HTTP). Line 1 does not match.
Extended ACLs process criteria sequentially and require all specified Layer 3 and Layer 4 fields to match.
2
Evaluate the packet against the second access-list entry (`permit ip host 172.16.5.10 host 10.0.1.20`).
The packet source IP is 172.16.5.15, which does not match `host 172.16.5.10`. Line 2 does not match.
The `host` keyword strictly matches only the specific IP address designated.
3
Evaluate the packet against the end of the ACL structure.
Having failed all preceding explicit permit statements, the packet encounters the default implicit `deny ip any any` statement.
Cisco IOS automatically appends an invisible implicit deny statement to the end of every IPv4 access control list.

Key Concept

Extended Access Control List Sequential Matching and Implicit Deny Behavior
Rate this question

Topics

Access Control Lists (Standard and Extended IPv4 ACLs)

More questions from this topic