Examkin

Question

Difficulty: MediumFirewalls and Access Control Lists (ACLs)

A network administrator applies the following IPv4 extended Access Control List (ACL) inbound on interface GigabitEthernet0/0 to control outbound internet access for internal clients on the 172.16.40.0/24172.16.40.0/24 network:

text
access-list 102 permit udp 172.16.40.0 0.0.0.255 any eq 53
access-list 102 permit tcp 172.16.40.0 0.0.0.255 eq 443 any

Users report that domain name resolution functions properly, but secure web browsing to external websites fails. Which of the following configuration errors in the ACL is causing the HTTPS traffic to be dropped?

  1. The ACL rule specifies port 443 as the source port criterion rather than the destination port criterion.Answer
  2. B
    The ACL lacks an explicit permit statement for return web traffic from the internet, causing responses to be dropped by the implicit deny.
  3. C
    HTTPS transport traffic uses UDP port 443 instead of TCP port 443.
  4. D
    Standard extended access control lists operating at Layer 3 cannot filter Layer 4 transport protocol port numbers.

Answer

The ACL rule specifies port 443 as the source port criterion rather than the destination port criterion.
The correct option correctly identifies that the `eq 443` keyword was placed after the source network specification (`172.16.40.0 0.0.0.255`) rather than after the destination specification (`any`). Client computers initiate connections using dynamic high-numbered ephemeral source ports and target destination port 443 on web servers. Because the ACL checks for source port 443, outgoing client HTTPS requests fail to match the rule and fall through to the implicit deny.

Step-by-Step Solution

1
Analyze the extended ACL syntax structure.
The syntax format for Cisco extended IPv4 ACLs is `access-list <number> permit/deny <protocol> <source-ip> <source-wildcard> [operator port] <dest-ip> <dest-wildcard> [operator port]`.
Understanding position-dependent arguments in extended ACL rules is critical for identifying parameter mismatches.
2
Evaluate the second rule: `access-list 102 permit tcp 172.16.40.0 0.0.0.255 eq 443 any`.
The `eq 443` modifier is placed immediately after the source wildcard mask `0.0.0.255` and before the destination keyword `any`.
This configuration attempts to match packets where the client's source port is 443.
3
Compare rule parameter placement with actual client traffic characteristics.
Client web browsers originate traffic using dynamically allocated ephemeral source ports (e.g., 49152–65535) destined to server port 443. Because the client's source port is not 443, the packet fails to match this permit rule and is dropped by the implicit deny at the end of the ACL.
To permit client connections to external web servers, `eq 443` must follow the destination specifier `any` (i.e., `permit tcp 172.16.40.0 0.0.0.255 any eq 443`).

Key Concept

Firewalls and Access Control Lists (ACLs)
Estimated Time:1m 30s
Rate this question

Topics

Firewalls and Access Control Lists (ACLs)

More questions from this topic