Question

Difficulty: MediumFirewalls and Access Control Lists (ACLs)

A network engineer is configuring stateless Access Control Lists (ACLs) on a Layer 3 switch to secure communication between an application tier subnet (172.16.10.0/24172.16.10.0/24) and a database tier subnet (10.20.30.0/2410.20.30.0/24). The application servers must establish connection requests to MySQL database instances listening on TCP port 33063306. Because the filtering device is a stateless ACL rather than a stateful firewall, bidirectional rules must be defined explicitly. Which TWO of the following ACL entries must be configured on the database interface to allow this traffic flow while maintaining state awareness manually?

  1. An inbound rule permitting TCP traffic from source subnet 172.16.10.0/24172.16.10.0/24 on ephemeral ports to destination subnet 10.20.30.0/2410.20.30.0/24 on destination port 33063306.Answer
  2. An outbound rule permitting TCP traffic from source subnet 10.20.30.0/2410.20.30.0/24 on source port 33063306 to destination subnet 172.16.10.0/24172.16.10.0/24 on ephemeral ports.Answer
  3. C
    An inbound rule permitting UDP traffic from source subnet 172.16.10.0/24172.16.10.0/24 to destination subnet 10.20.30.0/2410.20.30.0/24 on port 33063306.
  4. D
    A single inbound permit rule, relying on the ACL's default connection tracking table to automatically inspect and allow outbound response packets.

Answer

The correct requirements are the inbound rule permitting TCP traffic from the application subnet to destination port 3306, and the outbound rule permitting TCP return traffic from source port 3306 to the application subnet.
Stateless ACLs process each packet in isolation against the access list rules. Because they do not maintain a dynamic connection state table, a complete bidirectional traffic flow requires both an inbound permit rule for the initial request (from application servers to destination port 3306) and an explicit outbound permit rule for the response traffic (from database source port 3306 back to client ephemeral ports).

Step-by-Step Solution

1
Identify transport layer requirements for the database service.
MySQL uses TCP on destination port 3306 for reliable client-server communication.
Choosing the correct protocol (TCP vs. UDP) is necessary when writing extended ACL rules.
2
Analyze the operational difference between stateful firewalls and stateless ACLs.
Stateless ACLs analyze individual packets independently and do not maintain a state table to dynamic permit return traffic.
Return traffic generated by the database server will be blocked by the ACL implicit deny rule unless an explicit outbound rule is defined.
3
Construct the required inbound and outbound ACL rule pair.
Inbound entry permits TCP traffic from application hosts (172.16.10.0/24172.16.10.0/24) to database hosts (10.20.30.0/2410.20.30.0/24) on port 33063306. Outbound entry permits TCP return traffic from database hosts (source port 33063306) back to application hosts.
Both rules are mandatory to complete the full two-way TCP handshake and session payload exchange on a stateless device.

Key Concept

Stateless ACL Directionality and Protocol Requirements
Rate this question