A network administrator is configuring an extended IPv4 Access Control List (ACL) on a gateway router to secure a DMZ web server at IP address . The security policy requires allowing inbound web traffic (HTTPS) from any external source, and allowing remote administration (SSH) strictly from the internal network management subnet (). All other inbound traffic must be blocked. Which TWO of the following extended ACL statements must be included to satisfy these requirements? (Select TWO)
- permit tcp any host 10.80.1.20 eq 443Answer
- permit tcp 172.16.50.0 0.0.0.255 host 10.80.1.20 eq 22Answer
- Cpermit udp any host 10.80.1.20 eq 443
- Dpermit tcp 172.16.50.0 0.0.0.255 eq 22 host 10.80.1.20
Answer
The correct ACL entries are 'permit tcp any host 10.80.1.20 eq 443' and 'permit tcp 172.16.50.0 0.0.0.255 host 10.80.1.20 eq 22'.
The security policy requires allowing HTTPS (TCP port 443) from any source to the DMZ server IP (), which is fulfilled by 'permit tcp any host 10.80.1.20 eq 443'. Additionally, allowing SSH (TCP port 22) strictly from the management subnet () requires matching the source subnet with wildcard mask 0.0.0.255 directed to the server on destination port 22, fulfilled by 'permit tcp 172.16.50.0 0.0.0.255 host 10.80.1.20 eq 22'.
Step-by-Step Solution
Key Concept
Extended Access Control List (ACL) Syntax and Layer 4 Port Filtering