Examkin

Question

Difficulty: HardFirewalls and Access Control Lists (ACLs)

A network security engineer configures an extended stateless IPv4 Access Control List (ACL) applied inbound on a perimeter router interface (`GigabitEthernet0/1`) to filter incoming Internet traffic. The ACL contains the following sequential rules:

- Rule 10: `permit tcp any eq 443 192.168.50.0 0.0.0.255 established`
- Rule 20: `permit tcp any host 192.168.50.10 eq 443`
- Rule 30: `permit udp 192.168.50.0 0.0.0.255 eq 53 any`

An external host with IP address 198.51.100.42198.51.100.42 sends an unsolicited TCP SYN packet (initial connection request) with source port 443443 to an internal host at 192.168.50.25192.168.50.25 on destination port 80808080.

Which action does the router take when processing this incoming TCP SYN packet?

  1. The router drops the packet because it fails to match Rule 10 due to missing ACK/RST flags, misses subsequent rules, and triggers the implicit deny statement.Answer
  2. B
    The router permits the packet under Rule 10 because the source port matches 443 and the destination IP address falls within the 192.168.50.0/24 subnet.
  3. C
    The router permits the packet under Rule 20 because traffic coming from source port 443 overrides destination port inspection.
  4. D
    The router forwards the packet to 192.168.50.10 after performing Port Address Translation (PAT) on port 8080.

Answer

The router drops the packet because it fails to match Rule 10 due to missing ACK/RST flags, misses subsequent rules, and triggers the implicit deny statement.
When evaluating stateless extended ACL rules, the router checks fields in exact top-to-bottom order. For Rule 10, the packet matches protocol (TCP), source address (`any`), source port (`eq 443`), and destination subnet (192.168.50.0/24192.168.50.0/24). However, Rule 10 includes the `established` keyword, which requires the TCP ACK or RST control bit to be set. Because an initial unsolicited connection attempt sends a TCP SYN packet (without ACK or RST), Rule 10 does not match. The packet subsequently fails Rule 20 (wrong host and destination port) and Rule 30 (wrong protocol), causing it to hit the default implicit deny rule at the end of the ACL and be dropped.

Step-by-Step Solution

1
Analyze incoming packet header details against Rule 10 criteria
The packet has source IP 198.51.100.42198.51.100.42, source port 443443, destination IP 192.168.50.25192.168.50.25, destination port 80808080, and TCP flags set to SYN only. Rule 10 specifies `established`, which requires ACK or RST flags to be present. Thus, Rule 10 does not match.
Stateless ACL rules using the `established` keyword inspect TCP control flags to allow return traffic while blocking incoming initial session setups.
2
Evaluate packet against Rule 20 and Rule 30
Rule 20 expects destination host 192.168.50.10192.168.50.10 and destination port 443443 (packet is for .25.25 on port 80808080). Rule 30 expects UDP protocol (packet is TCP). Neither rule matches.
Extended ACLs perform top-to-bottom sequential rule checking until an exact match is identified.
3
Apply final default ACL behavior
Having matched no explicit permit statements, the packet encounters the unwritten default rule: `deny ip any any`.
All standard and extended ACLs terminate with an implicit deny statement that drops all unapproved IP traffic.

Key Concept

Stateless ACL TCP Flag Filtering and Implicit Deny Logic
Estimated Time:2m 0s
Rate this question

Topics

Firewalls and Access Control Lists (ACLs)

More questions from this topic