Examkin

Question

Difficulty: MediumAccess Control Lists (Standard and Extended IPv4 ACLs)

A network engineer configures an extended IPv4 Access Control List (ACL) on a router to allow web access from an internal client subnet (172.16.20.0/24172.16.20.0/24) to a web server at 192.168.1.100192.168.1.100. The router has the following configuration lines applied:

text
access-list 105 permit tcp 172.16.20.0 0.0.0.255 host 192.168.1.100 eq 80
access-list 105 permit tcp 172.16.20.0 0.0.0.255 host 192.168.1.100 eq 443

When a host with IP address 172.16.20.15172.16.20.15 sends ICMP echo request (ping) packets to 192.168.1.100192.168.1.100, how does the router process this traffic?

  1. The router drops the ICMP packets because they do not match any explicit permit entry and are filtered by the implicit deny statement at the end of the ACL.Answer
  2. B
    The router permits the ICMP packets because network control protocols bypass transport-layer ACL filtering by default.
  3. C
    The router forwards the ICMP packets because the wildcard mask 0.0.0.255 permits all IP traffic originating from the 172.16.20.0/24 subnet.
  4. D
    The router drops the ICMP packets only if an explicit access-list 105 deny icmp any any statement is manually added to the end of the list.

Answer

The router drops the ICMP packets because they do not match any explicit permit statement and are dropped by the implicit deny clause.
Cisco IPv4 ACLs evaluate traffic line-by-line in sequential order. Extended ACLs require exact protocol matching. Because the configuration only contains permit statements for TCP (ports 80 and 443), ICMP packets fail to match any entry. Traffic that does not match any explicit rule is dropped by the mandatory implicit deny clause at the end of the ACL.

Step-by-Step Solution

1
Examine the incoming packet characteristics against the configured extended ACL rules.
The packet protocol is ICMP, the source address is 172.16.20.15172.16.20.15, and the destination address is 192.168.1.100192.168.1.100.
Extended ACLs check the Layer 3 protocol type, source address, destination address, and Layer 4 port numbers.
2
Evaluate the packet sequentially against line 1 and line 2 of access-list 105.
Line 1 permits TCP port 80; line 2 permits TCP port 443. Neither line matches ICMP traffic.
ICMP is an IP protocol distinct from TCP. Protocol matching is strict in Cisco IOS extended ACLs.
3
Evaluate the packet against the end of the access list.
The packet hits the invisible implicit deny statement (implicit deny ip any any) and is discarded by the router.
Cisco IOS automatically appends an implicit deny clause to the end of every IPv4 access control list.

Key Concept

ACL Sequential Evaluation and the Implicit Deny Clause
Rate this question

Topics

Access Control Lists (Standard and Extended IPv4 ACLs)

More questions from this topic