Examkin

Question

Difficulty: EasyAccess Control Lists (Standard and Extended IPv4 ACLs)

A network administrator configures an IPv4 extended access control list (ACL) on a Cisco router interface to allow web traffic using the following command:

`access-list 100 permit tcp host 192.168.1.50 any eq 80`

No other ACL entries are configured on the router. What happens when host 192.168.1.50 sends an ICMP echo request (ping) packet through the interface where this ACL is applied?

  1. The ICMP packet is dropped because of the unwritten implicit deny statement at the end of the access control list.Answer
  2. B
    The ICMP packet is permitted because non-matching IPv4 traffic is allowed by default unless an explicit deny line is configured.
  3. C
    The ICMP packet is permitted because permitting TCP port 80 traffic automatically permits auxiliary network diagnostic protocols.
  4. D
    The ICMP packet is forwarded because the permit statement applies broadly to all layer 4 transport protocols originating from host 192.168.1.50.

Answer

The ICMP packet is dropped because of the unwritten implicit deny statement at the end of the access control list.
All IPv4 ACLs on Cisco IOS devices end with an implicit 'deny ip any any' clause. When an ICMP echo request is processed against the rule `access-list 100 permit tcp host 192.168.1.50 any eq 80`, it fails to match because ICMP is a separate protocol from TCP. Because there are no further explicit permit rules, the packet matches the implicit deny clause and is dropped.

Step-by-Step Solution

1
Evaluate the incoming packet against the configured explicit ACL statement.
The incoming packet is an ICMP echo request, whereas statement 100 permits only TCP traffic targeting port 80.
ACLs process rules sequentially from top to bottom.
2
Check for subsequent matching statements or default end-of-list processing behavior.
No additional permit statements exist, so the packet falls through to the invisible final rule: `deny ip any any`.
All Cisco IPv4 ACLs automatically append an implicit deny statement at the end.
3
Determine the final packet disposition.
The ICMP packet is dropped at the router interface.
Unmatched traffic is discarded by the implicit deny rule.

Key Concept

Access Control List (ACL) Implicit Deny Clause
Rate this question

Topics

Access Control Lists (Standard and Extended IPv4 ACLs)

More questions from this topic