An organization operates a centralized logging infrastructure where internal servers on the subnet transmit log data to a Syslog server at . The network administrator configures an extended IPv4 Access Control List (ACL) with the rule `permit tcp 192.168.10.0 0.0.0.255 host 172.16.50.25 eq 514`. After applying this rule, no logs are received by the Syslog server. Which of the following modifications to the ACL will resolve the log transmission failure?
- Change the protocol in the ACL rule from TCP to UDP.Answer
- BUpdate the destination port number from 514 to 512 in the ACL entry.
- CAppend an explicit permit rule for return traffic to bypass the implicit deny.
- DReassign the ACL from the Layer 3 router interface to a Layer 2 switchport ACL.
Answer
Changing the protocol in the ACL rule from TCP to UDP resolves the transmission failure because standard Syslog messaging utilizes UDP port 514.
Standard Syslog traffic relies on UDP port 514. The configured ACL rule explicitly filtered for TCP packets, causing all UDP Syslog datagrams from the subnet to fall through to remaining rules and ultimately be dropped by the implicit deny.
Step-by-Step Solution
Key Concept
Extended Access Control List (ACL) Protocol Matching (TCP vs. UDP)