Examkin

Question

Difficulty: MediumFirewalls and Access Control Lists (ACLs)

A network engineer configures a stateless router Access Control List (ACL) to allow client workstations on subnet 10.50.1.0/2410.50.1.0/24 to access an internal web server at 172.16.10.20172.16.10.20. The engineer applies the inbound rule `permit tcp 10.50.1.0 0.0.0.255 host 172.16.10.20 eq 80` on the interface facing the web server. Although initial packets reach the server, workstation browsers consistently time out when attempting to load web pages. Which configuration change will resolve this connection failure?

  1. Add an outbound ACL rule allowing TCP traffic from host 172.16.10.20 using the established keyword back to the 10.50.1.0/24 subnet.Answer
  2. B
    Change the destination port in the inbound ACL rule from port 80 to port 8080 to support web server handshake responses.
  3. C
    Replace the extended ACL with a standard ACL applied inbound that filters strictly based on the destination IP address 172.16.10.20.
  4. D
    Configure the inbound rule using UDP instead of TCP to eliminate the requirement for bidirectional packet delivery.

Answer

Add an outbound ACL rule allowing TCP traffic from host 172.16.10.20 using the established keyword back to the 10.50.1.0/24 subnet.
Stateless ACLs evaluate each packet in isolation and do not keep track of active connection states. While the inbound rule permits HTTP client requests to reach the web server, the server's TCP return traffic (SYN-ACK / ACK) is blocked by the router interface's implicit deny rule. Adding an outbound rule matching return traffic from the web server using the `established` keyword permits return packets belonging to established TCP connections.

Step-by-Step Solution

1
Analyze the stateless nature of the configured ACL.
Stateless ACLs evaluate packets individually and do not track connection states.
Because state is not tracked, permitting inbound traffic from client to server does not automatically permit return traffic from server to client.
2
Identify the cause of the connection timeout.
The web server receives HTTP requests but its TCP SYN-ACK return packets are blocked by the default implicit deny rule on the router interface.
Without an explicit return rule or stateful inspection, return packets are dropped.
3
Determine the necessary configuration fix.
Permit return traffic outbound from host 172.16.10.20172.16.10.20 to subnet 10.50.1.0/2410.50.1.0/24 with the `established` keyword (matching TCP packets with ACK or RST flags set).
This allows return communication for established TCP sessions while preventing external hosts from initiating unauthorized connections back to internal clients.

Key Concept

Stateless vs Stateful ACL Filtering and Return Traffic
Rate this question

Topics

Firewalls and Access Control Lists (ACLs)

More questions from this topic