An infrastructure engineer is analyzing network logs to determine why an application server located at cannot transmit syslog data to a remote log collector at . The collector receives log streams using UDP port . The engineer inspects the active router interface access control list (ACL):
text
Extended IP access list ENTERPRISE_OUT
10 permit tcp 10.50.20.0 0.0.0.63 host 172.18.4.50 eq 514
20 permit ip 10.50.20.0 0.0.0.63 10.50.0.0 0.0.255.255
30 deny ip any any
Which of the following identifies the root cause of this connectivity failure?
- The access control list specifies TCP port 514 instead of UDP, causing syslog traffic to miss Rule 10 and fall through to the deny rule.Answer
- BThe wildcard mask 0.0.0.63 restricts the host address range so that IP address 10.50.20.15 is excluded from matching Rule 10.
- CThe application server and log collector reside on different IP subnets, preventing packets from reaching the router's default gateway interface.
- DDestination port 514 is reserved for HTTPS traffic and is blocked by default on standard Layer 3 ACL configurations.
Answer
The access control list specifies TCP port 514 instead of UDP, causing syslog traffic to miss Rule 10 and fall through to the deny rule.
Standard syslog logging services utilize UDP port 514. In the configured access control list, Rule 10 explicitly permits TCP traffic on port 514. Because transport layer protocol matching is strict, UDP syslog packets miss Rule 10 as well as Rule 20 (which targets a different subnet block), falling through to Rule 30 where they are denied.
Step-by-Step Solution
Key Concept
ACL Transport Protocol Mismatch & Sequential Processing