A network administrator configures a numbered standard IPv4 access control list on a Cisco IOS router to permit management access from the Network Operations Center (NOC) subnet while blocking all other hosts. The administrator enters the following commands:
text
Router(config)# access-list 15 permit 192.168.10.0 0.0.0.255
Router(config)# line vty 0 4
Router(config-line)# access-class 15 in
After applying this configuration, which traffic outcome occurs when an administrator at IP address attempts an SSH connection to the router's VTY interface, and why?
- The SSH session is permitted because the source IP address matches the permit entry in ACL 15.Answer
- BThe SSH session is denied because standard access control lists cannot filter traffic applied to VTY lines.
- CThe SSH session is denied because an explicit permit ip any statement is missing at the end of ACL 15.
- DThe SSH session is permitted only if an explicit deny entry is added to block other subnets.
Answer
The SSH connection attempt from IP address 192.168.10.45 is permitted because it matches the permit statement for network 192.168.10.0 with wildcard mask 0.0.0.255 in access-list 15.
The incoming SSH connection attempt originates from 192.168.10.45, which falls inside the 192.168.10.0/24 IP network range matched by wildcard mask 0.0.0.255. When the packet is checked against access-list 15 applied inbound on the VTY lines via the access-class command, it hits the first rule, matches, and is permitted.
Step-by-Step Solution
Key Concept
Standard IPv4 ACL Evaluation and VTY Line Application