Examkin

Question

Difficulty: MediumFirewalls and Access Control Lists (ACLs)

A network administrator is troubleshooting connectivity between internal network monitoring tools on subnet 10.80.4.0/2410.80.4.0/24 and an application server at 10.80.12.5010.80.12.50. The administrator configured an inbound extended Access Control List (ACL) on the router interface facing the monitoring subnet with only the following active rules:

- `permit tcp 10.80.4.0 0.0.0.255 host 10.80.12.50 eq 80`
- `permit tcp 10.80.4.0 0.0.0.255 host 10.80.12.50 eq 443`

While HTTP and HTTPS traffic reach the server successfully, ICMP echo requests (ping) sent from the monitoring tools to 10.80.12.5010.80.12.50 fail. Which of the following best explains why the ICMP traffic is being dropped?

  1. The ACL ends with an implicit deny rule that automatically blocks all traffic not explicitly permitted by a prior rule.Answer
  2. B
    ICMP traffic operates on UDP port 80, which conflicts with the TCP protocol specified in the first permit rule.
  3. C
    ICMP operates at Layer 7 of the OSI model and requires an Application-Layer Gateway rule to pass through the router interface.
  4. D
    The router requires Port Address Translation (PAT) overload configuration to translate ICMP echo request identifiers across subnet boundaries.

Answer

The ACL ends with an implicit deny rule that automatically blocks all traffic not explicitly permitted by a prior rule.
Every network Access Control List (ACL) features an default, invisible 'implicit deny all' rule at the very end of the rule list. When ICMP traffic arrives at the router interface, it is evaluated against the explicit entries. Because the only configured entries permit TCP traffic destined for ports 80 and 443, ICMP traffic fails to match any permit rule and is discarded by the implicit deny statement.

Step-by-Step Solution

1
Analyze the configured ACL rules
The ACL contains explicit permit entries strictly for TCP destination ports 80 (HTTP) and 443 (HTTPS).
Understanding which protocols and ports are permitted helps identify unhandled packet types.
2
Identify the protocol used by the failing traffic type
Ping utility uses ICMP (Internet Control Message Protocol), which is an IP-level protocol (IP protocol 1) and does not use TCP ports.
Comparing ICMP packet headers against the ACL entries reveals no matching rule.
3
Apply standard ACL processing logic to unmatched traffic
All IP Access Control Lists evaluate matching entries sequentially and terminate with an invisible 'implicit deny ip any any' rule.
Since the ICMP packet does not match Rule 1 or Rule 2, it hits the implicit deny statement at the end of the ACL and is dropped.

Key Concept

ACL Implicit Deny Rule
Rate this question

Topics

Firewalls and Access Control Lists (ACLs)

More questions from this topic