Examkin

Question

Difficulty: MediumFirewalls and Access Control Lists (ACLs)

A network administrator configures a new extended IPv4 Access Control List (ACL) on a router interface serving an R&D subnet (172.16.30.0/24172.16.30.0/24). The administrator creates specific rules to permit hosts on this subnet to access an internal file server (10.5.5.1010.5.5.10) via FTP. Immediately after applying the ACL inbound on the interface, users on the 172.16.30.0/24172.16.30.0/24 subnet report that they have lost connectivity to the internet and all other company subnets. What is the primary cause of this widespread connectivity failure?

  1. The ACL ends with an invisible implicit deny statement that drops all traffic not explicitly permitted by preceding rules.Answer
  2. B
    Applying an inbound ACL forces the router to reset its Port Address Translation (PAT) overload table, dropping active non-FTP traffic sessions.
  3. C
    Extended ACLs filter network traffic exclusively at OSI Layer 2, causing Layer 3 IPv4 packets destined for other subnets to be rejected.
  4. D
    The router automatically converts unlisted TCP connection requests into UDP datagrams, which destination firewalls drop.

Answer

The connectivity failure occurs because Access Control Lists contain an unwritten implicit deny rule at the end of the rule set, which blocks all traffic that is not explicitly allowed by a preceding permit statement.
Network Access Control Lists operate using sequential evaluation and end with an unwritten implicit 'deny all' rule. When the administrator created permit statements solely for FTP traffic, any packet not matching those specific criteria fell through to the end of the ACL and was dropped by the implicit deny rule.

Step-by-Step Solution

1
Analyze the reported symptom following the ACL application.
Specific traffic (FTP to 10.5.5.1010.5.5.10) was permitted, but all other outbound traffic from subnet 172.16.30.0/24172.16.30.0/24 was blocked.
This indicates that unlisted traffic flows are being filtered out by the router interface.
2
Evaluate standard ACL execution mechanics.
ACLs process packets top-down until a match is found. If no explicit rule matches a packet, it reaches the end of the list where an implicit 'deny all' rule executes.
Because only FTP traffic was permitted, all internet and inter-subnet traffic hit the implicit deny rule and was dropped.
3
Determine the necessary configuration fix.
Add explicit permit rules or an 'permit ip any any' statement at the end of the list if general traffic should be allowed.
Explicit permit statements override the default implicit deny behavior for designated traffic.

Key Concept

ACL Implicit Deny Behavior
Rate this question

Topics

Firewalls and Access Control Lists (ACLs)

More questions from this topic