A network administrator must configure a top-to-bottom sequence of rules in an extended IP… — CompTIA Network+

A network administrator must configure a top-to-bottom sequence of rules in an extended IPv4 Access Control List (ACL) applied inbound on a router interface serving the internal user VLAN ( $192.168.10.0/24$ ). The ACL must enforce the following security policies for traffic destined to the DMZ web server ( $10.0.0.50/32$ ):

1. Host $192.168.10.5$ must be explicitly allowed HTTPS access ( $TCP/443$ ).
2. Host $192.168.10.5$ must be explicitly denied HTTP access ( $TCP/80$ ).
3. All other hosts on the $192.168.10.0/24$ subnet must be allowed HTTP access ( $TCP/80$ ).
4. All other traffic targeting the DMZ subnet ( $10.0.0.0/24$ ) must be blocked.

Arrange the Access Control List (ACL) statements in the correct top-to-bottom evaluation sequence to ensure all rules execute as intended without rule shadowing.

1access-list 101 permit tcp host 192.168.10.5 host 10.0.0.50 eq 443
2access-list 101 deny tcp host 192.168.10.5 host 10.0.0.50 eq 80
3access-list 101 permit tcp 192.168.10.0 0.0.0.255 host 10.0.0.50 eq 80
4access-list 101 deny ip any 10.0.0.0 0.0.0.255

Answer

The correct sequence from top to bottom is: 1) access-list 101 permit tcp host 192.168.10.5 host 10.0.0.50 eq 443, 2) access-list 101 deny tcp host 192.168.10.5 host 10.0.0.50 eq 80, 3) access-list 101 permit tcp 192.168.10.0 0.0.0.255 host 10.0.0.50 eq 80, and 4) access-list 101 deny ip any 10.0.0.0 0.0.0.255.

ACLs execute in sequential order from top to bottom and stop processing as soon as a packet matches a rule. Therefore, specific host rules must be placed above general subnet rules. Placing the host HTTPS permit rule and host HTTP deny rule first ensures host 192.168.10.5 is handled correctly. Placing the subnet HTTP permit rule next allows the rest of the 192.168.10.0/24 network to access HTTP. Finally, placing the broad DMZ deny rule at the bottom prevents any other unintended IP traffic from reaching the 10.0.0.0/24 subnet.

Step-by-Step Solution

Identify specific host exceptions requiring permissions or blocks.

Host 192.168.10.5 has specific requirements: permit TCP 443 and deny TCP 80.

ACLs process sequentially from top to bottom on a first-match basis, so specific host entries must appear before broader subnet entries.

Place host-specific rules above subnet-level rules to avoid shadowing.

Place 'permit tcp host 192.168.10.5 host 10.0.0.50 eq 443' and 'deny tcp host 192.168.10.5 host 10.0.0.50 eq 80' above the subnet permit rule.

If the subnet rule 'permit tcp 192.168.10.0 0.0.0.255...' were placed above the host 192.168.10.5 deny rule, the router would match host 192.168.10.5 to the subnet rule first and permit HTTP traffic, shadowing the host deny rule.

Place general permit rules for the subnet below specific host rules.

Place 'permit tcp 192.168.10.0 0.0.0.255 host 10.0.0.50 eq 80' after host-specific rules.

This grants HTTP access to all hosts in 192.168.10.0/24 except host 192.168.10.5, which has already matched the earlier deny rule.

Place broad restrictive subnet rules at the end of the ACL sequence.

Place 'deny ip any 10.0.0.0 0.0.0.255' as the final entry in this rule sequence.

This rule blocks all other IP traffic to the DMZ network while permitting the desired specific web traffic processed by earlier rules.

Key Concept

ACL Sequential Evaluation and Shadowing Prevention

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic