Examkin

Question

Difficulty: MediumFirewalls and Access Control Lists (ACLs)

A network administrator is configuring an extended IPv4 Access Control List (ACL) on a core router to permit administrator workstations on subnet 172.20.10.0/24172.20.10.0/24 to manage remote servers on subnet 10.30.50.0/2410.30.50.0/24 using Remote Desktop Protocol (RDP). The administrator configures the following ACL entry inbound on the router interface connected to the administrator subnet:

`access-list 110 permit tcp 172.20.10.0 0.0.0.255 eq 3389 10.30.50.0 0.0.0.255`
`access-list 110 deny ip any any`

After applying the ACL, administrators report that RDP connection attempts to the servers time out. Which of the following identifies the configuration error in the ACL entry?

  1. The rule places the port filter parameter (`eq 3389`) after the source subnet instead of after the destination subnet.Answer
  2. B
    The explicit `deny ip any any` statement overrides the permit statement because implicit deny rules take precedence over custom permit entries.
  3. C
    The rule specifies the TCP protocol, whereas standard Remote Desktop Protocol (RDP) connection negotiation relies exclusively on UDP.
  4. D
    The extended ACL is applied on a Layer 3 interface, which limits filtering capabilities strictly to IP addresses rather than Layer 4 port numbers.

Answer

The configuration error is that the port filter parameter (`eq 3389`) is positioned immediately after the source IP address structure instead of after the destination IP address structure in the extended ACL statement.
The correct answer correctly identifies that `eq 3389` was placed after the source network parameters rather than the destination network parameters. In extended ACLs, client-initiated traffic uses dynamic source ports, so service port filters like RDP (TCP 3389) must be appended after the destination IP address.

Step-by-Step Solution

1
Analyze extended IPv4 ACL syntax structure
Standard extended ACL syntax follows: `access-list [number] permit/deny [protocol] [source IP] [source wildcard] [operator port] [destination IP] [destination wildcard] [operator port]`.
Correct positioning of protocol and port parameters is required for the router to match the proper fields in packet headers.
2
Evaluate source versus destination port roles for RDP traffic
Client workstations initiate RDP sessions using an OS-assigned ephemeral source port (e.g., 49152–65535) targeted at destination TCP port 3389 on the server.
Placing `eq 3389` immediately after the source address `172.20.10.0 0.0.0.255` causes the router to look for packets with a source port of 3389, which fails to match outbound client connection requests.
3
Determine the required ACL modification
Move the port specification to match destination port 3389: `access-list 110 permit tcp 172.20.10.0 0.0.0.255 10.30.50.0 0.0.0.255 eq 3389`.
This correctly permits TCP traffic originating from the administrator subnet targeted at port 3389 on the server subnet.

Key Concept

Extended Access Control List (ACL) Syntax and Port Placement
Rate this question

Topics

Firewalls and Access Control Lists (ACLs)

More questions from this topic