Examkin

Question

Difficulty: MediumAccess Control Lists (Standard and Extended IPv4 ACLs)

A network administrator configures an inbound IPv4 extended Access Control List (ACL) on interface GigabitEthernet0/0 to control traffic originating from the engineering subnet 10.50.10.0/2410.50.10.0/24. The objective is to allow HTTP and HTTPS access to an internal web server at 172.16.1.100172.16.1.100, while continuing to allow normal network traffic to all other destinations.

The administrator applies the following configuration:

text
ip access-list extended FILTER_ENGINEERING
permit tcp 10.50.10.0 0.0.0.255 host 172.16.1.100 eq 80
permit tcp 10.50.10.0 0.0.0.255 host 172.16.1.100 eq 443

After applying this ACL to GigabitEthernet0/0 inbound, users in the 10.50.10.0/2410.50.10.0/24 subnet report that while they can access the web server, all access to internet services, DNS, and local file servers is completely blocked. What is the primary cause of this issue?

  1. The ACL does not include a statement to permit remaining traffic, causing all other traffic from the subnet to be dropped by the implicit deny clause at the end of the ACL.Answer
  2. B
    The wildcard mask 0.0.0.255 incorrectly matches only a single host address rather than the entire 10.50.10.0/24 subnet.
  3. C
    Extended ACLs must be placed outbound on the interface closest to the destination rather than inbound on the source interface.
  4. D
    The ACL statements incorrectly use the host keyword before the destination IP address instead of specifying a destination wildcard mask.

Answer

The ACL lacks an explicit permit statement for other traffic, causing all unlisted network traffic from the subnet to be dropped by the implicit deny clause at the end of the ACL.
Every IPv4 Access Control List in Cisco IOS contains an implicit 'deny ip any any' statement at the end of the rule list. When creating an ACL intended to selectively allow specific services while permitting general network access, an explicit permit statement (such as 'permit ip 10.50.10.0 0.0.0.255 any') must be placed at the end of the list. Without it, all traffic not explicitly permitted is blocked.

Step-by-Step Solution

1
Analyze top-down processing of the ACL statements
Matches TCP port 80 traffic to 172.16.1.100 and permits it; matches TCP port 443 traffic to 172.16.1.100 and permits it.
Cisco ACLs process packets sequentially from top to bottom until a match occurs.
2
Evaluate handling of non-web traffic or traffic destined to other IP addresses
Traffic to other services (such as DNS on UDP port 53 or ICMP) does not match the first two permit statements.
Traffic that fails to match any explicit statement falls through to the end of the ACL.
3
Identify the final default behavior of Cisco ACLs
The implicit 'deny ip any any' at the end of the ACL drops all remaining packets.
Every Cisco IOS ACL has an unwritten implicit deny clause at the end. To allow other traffic, an explicit 'permit ip 10.50.10.0 0.0.0.255 any' or similar statement must be appended.

Key Concept

Implicit Deny Clause in IPv4 ACLs
Estimated Time:1m 30s
Rate this question

Topics

Access Control Lists (Standard and Extended IPv4 ACLs)

More questions from this topic