Examkin

Question

Difficulty: Very hardFirewalls and Access Control Lists (ACLs)

A network administrator configures an inbound extended Access Control List (ACL) on a router interface (GigabitEthernet0/0) to allow internal workstations on subnet 172.16.10.0/24 to browse secure external websites and perform domain name resolution. The applied ACL rules are evaluated top-down as follows:

LineActionProtocolSource IP / WildcardDestination IPDestination Port
10permittcp172.16.10.0 0.0.0.255anyeq 443
20permitudp172.16.10.0 0.0.0.255host 8.8.8.8eq 53

Although outbound TCP SYN packets sent to external Web servers successfully pass through the router interface, internal clients report that HTTPS web pages fail to load and connections instantly time out. Outbound interface NAT and default routing are verified to be fully operational.

Which technical requirement of stateless access control filtering explains why these HTTPS connections fail to establish?

  1. Stateless ACLs do not track TCP connection state, so return traffic from external servers targeting random ephemeral client ports is blocked by the implicit deny rule on the return path unless explicitly permitted.Answer
  2. B
    Stateless ACLs operate exclusively at Layer 7 of the OSI model, causing the router to drop TCP SYN-ACK handshake segments because SSL/TLS application parameters are missing from packet headers.
  3. C
    The ACL configuration is invalid because it omits an explicit permit rule for UDP traffic returning from port 53, causing the router to halt all TCP traffic evaluation at rule 20.
  4. D
    HTTPS web session initiation relies on UDP datagrams rather than TCP streams, creating a transport protocol mismatch against rule 10.

Answer

Stateless ACLs do not maintain connection state tables. Consequently, return traffic originating from external servers with source port 443 directed toward high-numbered client ephemeral ports is dropped by the default implicit deny unless return rules or stateful filtering (such as reflexive ACLs or stateful firewalls) are enabled.
Standard router Access Control Lists (ACLs) are stateless, meaning they evaluate each packet in isolation without keeping track of TCP session states. While rule 10 permits outbound TCP SYN packets destined for port 443, the returning TCP SYN-ACK packets sent from port 443 to the client's randomly generated ephemeral port do not match rule 10 (which checks destination port 443). Without a return ACL entry allowing established connections or a stateful firewall mechanism, the return traffic is dropped by the implicit deny all rule at the end of the ACL.

Step-by-Step Solution

1
Analyze the operational behavior of standard extended ACLs
Standard router ACLs are stateless filters that examine IP and transport layer headers of individual packets independently without tracking session states.
Understanding stateless evaluation is required to diagnose directionality issues in ACL traffic flows.
2
Trace the TCP three-way handshake flow for HTTPS (TCP 443)
An internal client (e.g., 172.16.10.15:49152) sends a SYN packet to an external server (e.g., 93.184.216.34:443). Rule 10 permits this packet outbound through GigabitEthernet0/0.
Outbound traffic matches source subnet 172.16.10.0/24 and destination port 443.
3
Evaluate the return SYN-ACK packet flow from the external server back to the client
The server sends a SYN-ACK packet with source IP 93.184.216.34 (port 443) and destination IP 172.16.10.15 (port 49152). When entering an interface or returning, this packet does not match rule 10 (which expects destination port 443, not source port 443).
Because stateless ACLs do not automatically allow return packets matching established sessions, the return SYN-ACK hits the implicit deny rule and is dropped.

Key Concept

Stateless vs. Stateful Filtering and Return Traffic Evaluation in ACLs
Estimated Time:2m 0s
Rate this question

Topics

Firewalls and Access Control Lists (ACLs)

More questions from this topic