Examkin

Question

Difficulty: MediumFirewalls and Access Control Lists (ACLs)

A network engineer is deploying a stateless Access Control List (ACL) on a router WAN interface to allow internal hosts on subnet 172.16.10.0/24172.16.10.0/24 to access an external HTTPS web service hosted at 198.51.100.25198.51.100.25. The engineer configures an outbound ACL rule permitting TCP traffic from source subnet 172.16.10.0/24172.16.10.0/24 to destination host 198.51.100.25198.51.100.25 on destination port 443443. However, users report that connection attempts to the external web service continuously time out. Which of the following best explains why the connection fails and identifies the necessary solution?

  1. The stateless ACL does not automatically permit return traffic; an inbound rule must be configured to permit returning TCP traffic from source port 443 to the internal subnet's ephemeral destination ports.Answer
  2. B
    HTTPS web services communicate using UDP port 443 rather than TCP; the outbound ACL entry must be modified to permit UDP transport protocol traffic.
  3. C
    The router's implicit deny rule evaluated and dropped the outbound packets because explicit permit rules must be placed at the very end of an ACL sequence.
  4. D
    Standard HTTPS services listen on port 80 instead of port 443; the destination port in the outbound ACL rule must be changed from 80 to 443.

Answer

The stateless ACL drops return traffic because it does not maintain session state; an inbound ACL entry allowing return TCP traffic from source port 443 to ephemeral destination ports must be added.
Stateless Access Control Lists perform packet-by-packet inspection without keeping track of TCP connection states. While the outbound ACL permits initiating packets from internal hosts to destination port 443, the response traffic from the server back to the client's ephemeral ports is blocked by the router's default implicit deny rule on the return path. To resolve this, a stateless ACL requires an explicit inbound rule permitting TCP traffic originating from port 443 back to internal IP addresses, or the deployment of a stateful firewall that dynamically permits return traffic for established sessions.

Step-by-Step Solution

1
Analyze the behavior of stateless packet filtering.
Stateless filters inspect each packet independently without maintaining connection state tables.
Outbound packets reach the destination server, but returning packets from the server back to the client arrive on dynamic ephemeral ports.
2
Identify the cause of connection timeouts.
The returning packets from the server encounter the ACL's implicit deny all rule on the inbound interface.
Because no explicit inbound rule exists to allow return traffic from port 443, return packets are dropped, preventing completion of the TCP three-way handshake.
3
Determine the required resolution.
Add an inbound ACL rule allowing source port 443 traffic to the internal host subnet, or implement stateful inspection.
Stateful firewalls track TCP handshakes automatically, permitting return packets matching established sessions without manual bi-directional rules.

Key Concept

Stateless vs. Stateful Firewall Filtering
Rate this question

Topics

Firewalls and Access Control Lists (ACLs)

More questions from this topic