A network engineer is configuring stateless Access Control Lists (ACLs) on a Layer 3 switch to secure communication between an application tier subnet () and a database tier subnet (). The application servers must establish connection requests to MySQL database instances listening on TCP port . Because the filtering device is a stateless ACL rather than a stateful firewall, bidirectional rules must be defined explicitly. Which TWO of the following ACL entries must be configured on the database interface to allow this traffic flow while maintaining state awareness manually?
- An inbound rule permitting TCP traffic from source subnet on ephemeral ports to destination subnet on destination port .Answer
- An outbound rule permitting TCP traffic from source subnet on source port to destination subnet on ephemeral ports.Answer
- CAn inbound rule permitting UDP traffic from source subnet to destination subnet on port .
- DA single inbound permit rule, relying on the ACL's default connection tracking table to automatically inspect and allow outbound response packets.
Answer
The correct requirements are the inbound rule permitting TCP traffic from the application subnet to destination port 3306, and the outbound rule permitting TCP return traffic from source port 3306 to the application subnet.
Stateless ACLs process each packet in isolation against the access list rules. Because they do not maintain a dynamic connection state table, a complete bidirectional traffic flow requires both an inbound permit rule for the initial request (from application servers to destination port 3306) and an explicit outbound permit rule for the response traffic (from database source port 3306 back to client ephemeral ports).
Step-by-Step Solution
Key Concept
Stateless ACL Directionality and Protocol Requirements