A network administrator is troubleshooting an issue where internal workstations on subnet cannot access a web server at using HTTPS. Upon inspecting the inbound Access Control List (ACL) on the destination interface, the administrator views the following configuration:
text
access-list 105 permit tcp 10.10.10.0 0.0.0.255 host 10.10.50.25 eq 80
access-list 105 deny ip any host 10.10.50.25
access-list 105 permit tcp 10.10.10.0 0.0.0.255 host 10.10.50.25 eq 443
Which of the following describes the root cause of the connection failure?
- The rule permitting HTTPS traffic on port 443 is shadowed by a preceding explicit deny statement.Answer
- BThe traffic is dropped because ACLs automatically append an unwritten implicit deny rule at the end of the rule list.
- CThe web server and workstations cannot communicate because they reside on different VLAN broadcast domains without an IP helper configured.
- DThe connection attempt fails due to a port mismatch, as secure web communications require TCP port 80 rather than port 443.
Answer
The rule permitting HTTPS traffic on port 443 is shadowed by a preceding explicit deny statement.
Router access control lists evaluate rules in top-down order until the first matching rule is found. In this configuration, line 20 explicitly blocks all IP traffic from any source to host . Because line 20 is evaluated before line 30, any incoming HTTPS packet on port 443 matches line 20 and is dropped immediately, rendering line 30 ineffective (shadowed). To resolve this, the permit rule for port 443 must be placed before the broad deny rule.
Step-by-Step Solution
Key Concept
ACL Rule Shadowing and Sequential Processing