Examkin

Question

Difficulty: MediumFirewalls and Access Control Lists (ACLs)

A network technician configures an extended Access Control List (ACL) on a stateless router interface to allow workstations on subnet 10.40.10.0/2410.40.10.0/24 to access an external web application at 203.0.113.80203.0.113.80 over HTTPS (TCP port 443). The technician adds the following outbound rule on the internal interface:

`permit tcp 10.40.10.0 0.0.0.255 host 203.0.113.80 eq 443`

After applying this configuration, client computers cannot successfully connect to the web application. Network captures reveal that outbound TCP SYN packets leave the router, but return traffic is never delivered to the clients. Which of the following ACL modifications will resolve this connectivity issue?

  1. Add an inbound ACL rule on the interface permitting TCP traffic from source 203.0.113.80203.0.113.80 port 443 to destination 10.40.10.0/2410.40.10.0/24 with the established keywordAnswer
  2. B
    Change the protocol specified in the outbound rule from TCP to UDP port 443 to enable connectionless session establishment
  3. C
    Modify the outbound ACL rule to filter for destination TCP port 80 to allow secure SSL/TLS handshakes
  4. D
    Reconfigure the filter as a Layer 2 MAC address access control list to automatically track TCP connection states

Answer

Add an inbound ACL rule on the interface permitting TCP traffic from source host 203.0.113.80203.0.113.80 port 443 to destination subnet 10.40.10.0/2410.40.10.0/24 using the established keyword.
Stateless access control lists evaluate packets individually without tracking connection session states. While outbound requests from internal hosts on 10.40.10.0/2410.40.10.0/24 are allowed by the outbound ACL rule, returning packets from 203.0.113.80:443203.0.113.80:443 are blocked by the implicit deny rule on the inbound interface. Adding an explicit inbound rule that matches TCP source port 443 and includes the `established` keyword permits return traffic (packets with ACK/RST flags set) back to internal clients.

Step-by-Step Solution

1
Analyze the stateless behavior of standard and extended router ACLs.
Unlike stateful firewalls, stateless router ACLs evaluate each packet individually and do not maintain a state table of active TCP sessions.
Permitting outbound traffic on a stateless interface does not automatically permit the corresponding return traffic.
2
Identify why return traffic from the web server is dropped.
Inbound TCP SYN-ACK packets from 203.0.113.80203.0.113.80 destination-bound for internal clients (10.40.10.0/2410.40.10.0/24) reach the inbound interface, where they encounter the ACL's default implicit deny statement.
All ACLs end with an unwritten implicit deny rule that blocks any traffic not explicitly permitted.
3
Determine the correct ACL rule structure to permit return traffic safely.
An inbound rule matching TCP traffic originating from 203.0.113.80203.0.113.80 port 443 heading to 10.40.10.0/2410.40.10.0/24 with the `established` flag allows returning packets for connections initiated from inside the network.
The `established` keyword checks for set ACK or RST TCP flags, ensuring only reply packets belonging to existing client sessions are allowed inbound.

Key Concept

Stateless Filtering and Return Traffic ACL Configuration
Rate this question

Topics

Firewalls and Access Control Lists (ACLs)

More questions from this topic