A network security engineer is creating an extended IPv4 Access Control List (ACL) on a pe… — CompTIA Network+

A network security engineer is creating an extended IPv4 Access Control List (ACL) on a perimeter router to regulate inbound traffic from an untrusted partner network ( $198.51.100.0/24$ ) destined for an internal server subnet ( $172.16.10.0/24$ ). The security policy specifies the following administrative priorities:
1. All SSH policy enforcement (specific host access and subnet-wide restrictions) must be evaluated first.
2. Application database traffic must be permitted for the designated database host only.
3. All other unapproved traffic from the partner network to the internal subnet must be explicitly dropped at the end of the ACL.

Arrange the following ACL statements in the correct top-to-bottom sequence (from Line 10 to Line 40) to enforce this policy without rule shadowing or logic errors.

1access-list 105 permit tcp 198.51.100.0 0.0.0.255 host 172.16.10.15 eq 22
2access-list 105 deny tcp 198.51.100.0 0.0.0.255 172.16.10.0 0.0.0.255 eq 22
3access-list 105 permit tcp 198.51.100.0 0.0.0.255 host 172.16.10.50 eq 3306
4access-list 105 deny ip 198.51.100.0 0.0.0.255 172.16.10.0 0.0.0.255

Answer

The correct top-to-bottom ACL processing order is: 1) Permit SSH to host 172.16.10.15, 2) Deny SSH to subnet 172.16.10.0/24, 3) Permit MySQL (TCP 3306) to host 172.16.10.50, 4) Deny all IP traffic from 198.51.100.0/24 to 172.16.10.0/24.

Router Access Control Lists process entries sequentially from top to bottom and stop evaluating upon the first match. To allow SSH to host 172.16.10.15 while blocking SSH to the rest of the 172.16.10.0/24 subnet, the host permit rule must appear first. Following SSH policy requirements, the MySQL permit rule for host 172.16.10.50 must precede the final explicit subnet IP deny rule to ensure legitimate database traffic is not blocked.

Step-by-Step Solution

Identify specific exception rules required prior to general block rules.

The host-specific SSH permit statement (`permit tcp ... host 172.16.10.15 eq 22`) must be placed before any subnet-wide SSH deny statement.

ACLs perform top-to-bottom sequential matching. Placing a broader deny rule above a specific permit rule creates 'rule shadowing,' rendering the permit rule unreachable.

Group and sequence the remaining protocol control rules according to policy priorities.

Place the subnet-wide SSH deny statement (`deny tcp ... 172.16.10.0 0.0.0.255 eq 22`) immediately following the specific host SSH permit rule.

This satisfies the requirement to evaluate all SSH access controls prior to evaluating database application rules.

Insert specific application service permits.

Place the MySQL permit rule (`permit tcp ... host 172.16.10.50 eq 3306`) after the SSH controls but before any general IP block rules.

Database traffic to the database server must be matched and allowed before hitting any blanket denial statement.

Position the broad subnet containment rule.

Place the explicit subnet-to-subnet IP deny statement (`deny ip 198.51.100.0 0.0.0.255 172.16.10.0 0.0.0.255`) at the end of the ACL entry sequence.

This ensures that any traffic not explicitly permitted by preceding lines is blocked before reaching implicit default behaviors.

Key Concept

ACL Sequential Evaluation and Shadowing Prevention

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic