A network administrator configures an IPv4 standard access control list on a Cisco router and applies it inbound on interface GigabitEthernet0/1:
text
access-list 15 permit host 172.16.20.50
access-list 15 permit 172.16.30.0 0.0.0.255
A technician attempts to send traffic through interface GigabitEthernet0/1 from host 172.16.20.51 destined for a server on an internal network. The traffic is dropped by the router. Which statement accurately explains why traffic from host 172.16.20.51 is dropped?
- Traffic from host 172.16.20.51 does not match any explicit permit entry in ACL 15 and is dropped by the implicit deny statement at the end of the access list.Cevap
- BStandard ACLs process statements in bottom-up order, causing host 172.16.20.51 to be evaluated against subnet 172.16.30.0/24 first and dropped before host rules are read.
- CThe wildcard mask 0.0.0.255 in the second entry explicitly blocks all IP addresses in the 172.16.20.0/24 subnet except for 172.16.20.50.
- DStandard ACLs automatically permit all unlisted traffic unless an explicit deny line is added to the configuration.
Cevap
Traffic from host 172.16.20.51 does not match any explicit permit entry in ACL 15 and is dropped by the implicit deny statement at the end of the access list.
In Cisco IOS IPv4 Access Control Lists, statements are processed sequentially from top to bottom. If incoming packet headers do not match any explicit permit or deny statement in the list, the traffic reaches the end of the ACL where an unwritten implicit deny clause ('deny any') drops the packet.
Adım Adım Çözüm
Anahtar Kavram
Implicit Deny Clause in Cisco IPv4 ACLs