A network administrator needs to apply an inbound extended Access Control List (ACL) on a … — CompTIA Network+

A network administrator needs to apply an inbound extended Access Control List (ACL) on a router interface connected to the user subnet $192.168.1.0/24$ to secure access to a server located at $10.0.0.10$ . The policy must enforce the following requirements:

1. Allow administrator workstation $192.168.1.50$ SSH access (TCP port 22) to the server.
2. Block host $192.168.1.100$ from accessing HTTP services (TCP port 80) on the server.
3. Allow all other hosts on the $192.168.1.0/24$ subnet to access HTTP services (TCP port 80) on the server.
4. Block all other unauthorized IP traffic.

Arrange the given ACL statements in the correct top-to-bottom processing sequence to enforce this security policy without rule shadowing.

1permit tcp host 192.168.1.50 host 10.0.0.10 eq 22
2deny tcp host 192.168.1.100 host 10.0.0.10 eq 80
3permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.10 eq 80
4deny ip any any

Answer

The correct order from top to bottom is: 1) permit tcp host 192.168.1.50 host 10.0.0.10 eq 22, 2) deny tcp host 192.168.1.100 host 10.0.0.10 eq 80, 3) permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.10 eq 80, and 4) deny ip any any.

ACL entries are evaluated sequentially in top-down order. Specific entries must always precede broader entries to prevent rule shadowing. Placing the specific host SSH permit rule first ensures administrative access is evaluated immediately. Placing the specific host HTTP deny rule second ensures that host 192.168.1.100 is blocked before reaching the general subnet HTTP permit rule. The general subnet HTTP permit rule follows third to allow remaining subnet hosts, while the catch-all deny rule is placed at the end.

Step-by-Step Solution

Identify specific host exceptions that require dedicated access.

Place the specific host permit rule for SSH (`permit tcp host 192.168.1.50 host 10.0.0.10 eq 22`) near the top so administrative access is granted before any general filtering.

ACLs process rules sequentially from top to bottom, stopping at the first matching entry.

Place specific host deny rules above broader subnet permit rules.

Place `deny tcp host 192.168.1.100 host 10.0.0.10 eq 80` before the subnet-wide HTTP permit statement.

If the broader subnet permit rule were placed first, traffic from 192.168.1.100 would match the permit rule and be allowed, shadowing the specific deny rule.

Add the general subnet permit rule for remaining web traffic.

Position `permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.10 eq 80` directly after the specific host deny rule.

This allows all non-restricted hosts on the 192.168.1.0/24 subnet to reach HTTP port 80.

Append the explicit/implicit catch-all deny statement.

Place `deny ip any any` at the bottom of the list.

All traffic not explicitly allowed by earlier rules must be dropped.

Key Concept

Access Control List Top-to-Bottom Sequential Evaluation and Rule Shadowing

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic