Question

Difficulty: MediumFirewalls and Access Control Lists (ACLs)

A network administrator is configuring an extended IPv4 Access Control List (ACL) on a gateway router to secure a DMZ web server at IP address 10.80.1.20/2410.80.1.20/24. The security policy requires allowing inbound web traffic (HTTPS) from any external source, and allowing remote administration (SSH) strictly from the internal network management subnet (172.16.50.0/24172.16.50.0/24). All other inbound traffic must be blocked. Which TWO of the following extended ACL statements must be included to satisfy these requirements? (Select TWO)

  1. permit tcp any host 10.80.1.20 eq 443Answer
  2. permit tcp 172.16.50.0 0.0.0.255 host 10.80.1.20 eq 22Answer
  3. C
    permit udp any host 10.80.1.20 eq 443
  4. D
    permit tcp 172.16.50.0 0.0.0.255 eq 22 host 10.80.1.20

Answer

The correct ACL entries are 'permit tcp any host 10.80.1.20 eq 443' and 'permit tcp 172.16.50.0 0.0.0.255 host 10.80.1.20 eq 22'.
The security policy requires allowing HTTPS (TCP port 443) from any source to the DMZ server IP (10.80.1.2010.80.1.20), which is fulfilled by 'permit tcp any host 10.80.1.20 eq 443'. Additionally, allowing SSH (TCP port 22) strictly from the management subnet (172.16.50.0/24172.16.50.0/24) requires matching the source subnet with wildcard mask 0.0.0.255 directed to the server on destination port 22, fulfilled by 'permit tcp 172.16.50.0 0.0.0.255 host 10.80.1.20 eq 22'.

Step-by-Step Solution

1
Identify transport protocols and destination ports for the required services.
HTTPS uses TCP port 443, and SSH uses TCP port 22.
Extended IPv4 ACLs inspect Layer 4 protocol headers to filter traffic by port number.
2
Construct the rule for public HTTPS traffic.
'permit tcp any host 10.80.1.20 eq 443'
The source is 'any', the destination host is 10.80.1.2010.80.1.20, and the destination port is 443.
3
Construct the rule for restricted SSH administration traffic.
'permit tcp 172.16.50.0 0.0.0.255 host 10.80.1.20 eq 22'
The source network 172.16.50.0/24172.16.50.0/24 requires wildcard mask 0.0.0.255, targeting destination host 10.80.1.2010.80.1.20 on port 22.

Key Concept

Extended Access Control List (ACL) Syntax and Layer 4 Port Filtering
Rate this question