A network technician is investigating why users on subnet 10.20.4.0/24 cannot access a sec… — CompTIA Network+

A network technician is investigating why users on subnet $10.20.4.0/24$ cannot access a secure internal web portal at $10.20.10.15$ over HTTPS. The technician runs a traceroute command from a client workstation ( $10.20.4.50$ ), which yields the following output:

Traceroute to 10.20.10.15 over a maximum of 30 hops:
1 <1 ms <1 ms <1 ms 10.20.4.1
2 2 ms 1 ms 2 ms 10.20.1.2
3 * * * Request timed out.

An inspection of the router at $10.20.1.2$ reveals the following inbound Access Control List (ACL) applied on interface GigabitEthernet0/1:

access-list 105 permit tcp 10.20.4.0 0.0.0.255 host 10.20.10.15 eq 80
access-list 105 permit icmp 10.20.4.0 0.0.0.255 host 10.20.10.15

Based on these diagnostic outputs, which of the following is the root cause of the connection failure?

The Access Control List permits HTTP traffic on TCP port 80 but lacks a permit entry for HTTPS traffic on TCP port 443, causing secure requests to be dropped by the implicit deny rule.Answer
B
The host workstation is configured with a default gateway address residing on a different IP subnet, preventing packets from reaching the intermediate router.
C
The destination web server resides on a separate VLAN broadcast domain that cannot be reached because inter-VLAN routing is completely disabled on the switch.
D
The ACL rule is dropping HTTPS traffic because secure web traffic defaults to TCP port 22, which is missing from the access list statements.

Answer

The Access Control List permits HTTP traffic on TCP port 80 but lacks a permit entry for HTTPS traffic on TCP port 443, causing secure requests to be dropped by the implicit deny rule.

The traceroute output confirms that traffic successfully traverses the local gateway (

10.20.4.1

) and reaches router

10.20.1.2

. However, the inbound ACL configured on router

10.20.1.2

only contains explicit permit statements for TCP port 80 (HTTP) and ICMP. Because HTTPS uses TCP port 443, HTTPS connections do not match any permit statements and are dropped by the implicit deny rule at the end of the access control list.

Step-by-Step Solution

Analyze the traceroute diagnostic output

Hop 1 (10.20.4.1) and Hop 2 (10.20.1.2) respond promptly, but Hop 3 times out.

This indicates that local subnet routing and default gateway settings are functional up to router 10.20.1.2, where traffic is subsequently blocked.

Evaluate the router ACL rules against the requested service protocol

The ACL permits 'tcp eq 80' (HTTP) and 'icmp' (ping/traceroute messages), but contains no statement for HTTPS.

HTTPS uses TCP port 443. Standard IP ACLs evaluate rules top-down and end with an unwritten 'implicit deny all' rule.

Determine the effect of the implicit deny on HTTPS traffic

HTTPS packets destined for 10.20.10.15:443 match none of the explicit permit statements and are dropped at router 10.20.1.2.

Adding 'access-list 105 permit tcp 10.20.4.0 0.0.0.255 host 10.20.10.15 eq 443' to the access list will resolve the issue.

Key Concept

Troubleshooting ACL Filtering and Implicit Deny Rules

Estimated Time:1m 30s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic