Examkin

Soru

Zorluk: OrtaAccess Control Lists (Standard and Extended IPv4 ACLs)

A network administrator must configure a Cisco IOS extended IPv4 Access Control List (ACL) to enforce the following security policy requirements:

1. Permit HTTP traffic (TCP port 80) from any host on the 10.1.1.0/2410.1.1.0/24 network to the web server at 192.168.10.50192.168.10.50.
2. Deny all other IP traffic originating specifically from host 10.1.1.2510.1.1.25 to the web server at 192.168.10.50192.168.10.50.
3. Permit all other TCP traffic from the 10.1.1.0/2410.1.1.0/24 network to the 192.168.10.0/24192.168.10.0/24 subnet.
4. Explicitly block all remaining IP traffic from the 10.1.1.0/2410.1.1.0/24 network to the 192.168.10.0/24192.168.10.0/24 subnet.

Arrange the following ACL statements in the correct top-down processing order (from line 1 at the top to line 4 at the bottom) so that the security policy is properly enforced.

  1. 1access-list 101 permit tcp 10.1.1.0 0.0.0.255 host 192.168.10.50 eq 80
  2. 2access-list 101 deny ip host 10.1.1.25 host 192.168.10.50
  3. 3access-list 101 permit tcp 10.1.1.0 0.0.0.255 192.168.10.0 0.0.0.255
  4. 4access-list 101 deny ip 10.1.1.0 0.0.0.255 192.168.10.0 0.0.0.255

Cevap

The statements must be ordered sequentially from most specific exception to most general catch-all: 1) permit tcp 10.1.1.0 0.0.0.255 host 192.168.10.50 eq 80, 2) deny ip host 10.1.1.25 host 192.168.10.50, 3) permit tcp 10.1.1.0 0.0.0.255 192.168.10.0 0.0.0.255, and 4) deny ip 10.1.1.0 0.0.0.255 192.168.10.0 0.0.0.255.
Cisco IOS Access Control Lists evaluate entries sequentially from top to bottom. The correct order places the narrowest exception (HTTP permit to host 192.168.10.50) first so that host 10.1.1.25 can still send HTTP traffic. The host-specific deny rule follows immediately to block any non-HTTP traffic from host 10.1.1.25 to 192.168.10.50. Next, the broader subnet-level TCP permit rule allows legitimate TCP applications from the rest of 10.1.1.0/24. Finally, the explicit subnet IP deny statement blocks all other non-TCP IP traffic targeting 192.168.10.0/24.

Adım Adım Çözüm

1
Identify the most specific permitted exception in the requirements.
HTTP traffic from 10.1.1.0/2410.1.1.0/24 to host 192.168.10.50192.168.10.50 must be permitted, even if host 10.1.1.2510.1.1.25 sends it.
Cisco ACLs process rules top-down and stop at the first matching statement. Placing HTTP permit statement first guarantees that host 10.1.1.2510.1.1.25 can access HTTP services on 192.168.10.50192.168.10.50.
2
Place the specific host restriction next.
Statement 'deny ip host 10.1.1.25 host 192.168.10.50' is placed in line 2.
Any non-HTTP IP traffic from 10.1.1.2510.1.1.25 to 192.168.10.50192.168.10.50 must be blocked before the general TCP permit rule line evaluates it.
3
Add the broader subnet-wide TCP permit rule.
Statement 'permit tcp 10.1.1.0 0.0.0.255 192.168.10.0 0.0.0.255' is placed in line 3.
This allows all remaining TCP connections across the 10.1.1.0/2410.1.1.0/24 and 192.168.10.0/24192.168.10.0/24 subnets for hosts that passed the previous filter checks.
4
Place the subnet-wide IP restriction statement.
Statement 'deny ip 10.1.1.0 0.0.0.255 192.168.10.0 0.0.0.255' is placed in line 4.
This explicitly drops all non-TCP traffic (e.g., UDP or ICMP) targeting 192.168.10.0/24192.168.10.0/24 from 10.1.1.0/2410.1.1.0/24.

Anahtar Kavram

Top-down sequential evaluation in Cisco ACLs (specific rules before general rules)
Bu soruyu puanla

Konular

Access Control Lists (Standard and Extended IPv4 ACLs)

Bu konudan daha fazla soru