Examkin

Question

Difficulty: MediumFirewalls and Access Control Lists (ACLs)

A network security administrator is configuring a top-to-bottom IPv4 extended Access Control List (ACL) on a gateway router interface. The ACL must enforce the following security policy objectives:
1. Allow administrative host 192.168.1.10192.168.1.10 SSH access (TCPTCP port 22) to management server 10.0.0.510.0.0.5.
2. Block all other traffic from internal subnet 192.168.1.0/24192.168.1.0/24 destined to management server 10.0.0.510.0.0.5.
3. Allow all hosts on subnet 192.168.1.0/24192.168.1.0/24 HTTP access (TCPTCP port 80) to any destination.
4. Explicitly block all remaining IP traffic.

Arrange the ACL rules in the correct top-to-bottom processing order to satisfy these security requirements without shadowing any rules.

  1. 1access-list 105 permit tcp host 192.168.1.10 host 10.0.0.5 eq 22
  2. 2access-list 105 deny ip 192.168.1.0 0.0.0.255 host 10.0.0.5
  3. 3access-list 105 permit tcp 192.168.1.0 0.0.0.255 any eq 80
  4. 4access-list 105 deny ip any any

Answer

The correct top-to-bottom sequence is: 1) access-list 105 permit tcp host 192.168.1.10 host 10.0.0.5 eq 22, 2) access-list 105 deny ip 192.168.1.0 0.0.0.255 host 10.0.0.5, 3) access-list 105 permit tcp 192.168.1.0 0.0.0.255 any eq 80, and 4) access-list 105 deny ip any any.
Router Access Control Lists execute rules sequentially from top to bottom and stop processing upon the first match. To meet security requirements without rule shadowing, specific rules must be placed above general rules. Host 192.168.1.10's SSH access must be permitted first. Next, all other traffic to host 10.0.0.5 must be denied. Third, general HTTP access for the subnet is allowed. Finally, the catch-all deny rule drops any remaining traffic.

Step-by-Step Solution

1
Identify the most specific exception permit rule.
Place host-specific SSH permit rule ('permit tcp host 192.168.1.10 host 10.0.0.5 eq 22') at position 1.
ACL engines process rules top-to-bottom using first-match logic. Specific host exceptions must precede broader subnet blocks to prevent rule shadowing.
2
Identify specific destination blocks.
Place subnet deny rule targeting management server 10.0.0.5 ('deny ip 192.168.1.0 0.0.0.255 host 10.0.0.5') at position 2.
This blocks all remaining traffic to management server 10.0.0.5 prior to checking broad subnet permit rules.
3
Identify general service permit rules.
Place general web permit rule ('permit tcp 192.168.1.0 0.0.0.255 any eq 80') at position 3.
Allows subnet hosts to initiate HTTP traffic to external destinations while keeping management server 10.0.0.5 protected by the previous deny rule.
4
Identify the default drop rule.
Place the explicit catch-all deny rule ('deny ip any any') at position 4.
Serves as the final rule in the ACL structure to ensure all unlisted traffic is dropped.

Key Concept

ACL Sequential First-Match Evaluation and Rule Shadowing Prevention
Estimated Time:1m 30s
Rate this question

Topics

Firewalls and Access Control Lists (ACLs)

More questions from this topic