Examkin

Soru

Zorluk: ZorAccess Control Lists (Standard and Extended IPv4 ACLs)

A network administrator is configuring an extended IPv4 Access Control List (ACL) named `MGMT_FILTER` to implement sequential top-down filtering on a Cisco router interface. The policy requires four explicit criteria:
1. Permit SSH administrative access (TCP port 22) from source subnet `192.168.50.0/24` to target server `10.10.10.25`.
2. Permit SNMP monitoring queries (UDP port 161) from source subnet `192.168.50.0/24` to target server `10.10.10.25`.
3. Deny and log all other IP traffic from source subnet `192.168.50.0/24` destined to target server `10.10.10.25`.
4. Permit all remaining traffic originating from subnet `192.168.50.0/24` to any other destination, overriding the default implicit deny statement for this subnet.

In what top-down sequential order must these ACL statements be placed to satisfy all policy requirements without shadowing rules?

  1. 1permit tcp 192.168.50.0 0.0.0.255 host 10.10.10.25 eq 22
  2. 2permit udp 192.168.50.0 0.0.0.255 host 10.10.10.25 eq 161
  3. 3deny ip 192.168.50.0 0.0.0.255 host 10.10.10.25 log
  4. 4permit ip 192.168.50.0 0.0.0.255 any

Cevap

The correct top-down sequence is: 1) permit tcp 192.168.50.0 0.0.0.255 host 10.10.10.25 eq 22, 2) permit udp 192.168.50.0 0.0.0.255 host 10.10.10.25 eq 161, 3) deny ip 192.168.50.0 0.0.0.255 host 10.10.10.25 log, 4) permit ip 192.168.50.0 0.0.0.255 any.
Cisco IOS ACLs process traffic sequentially from top to bottom until the first match occurs. To permit specific services (SSH and SNMP) to host 10.10.10.25 while blocking all other traffic to that host, the explicit permit rules for TCP port 22 and UDP port 161 must appear first. The host-specific deny rule must follow these permits so that non-management traffic to host 10.10.10.25 is logged and dropped. Finally, the general permit statement allowing traffic from subnet 192.168.50.0/24 to any destination must be placed last among explicit rules; this ensures traffic destined for other IP addresses is allowed through while preventing the implicit deny clause from dropping all other traffic.

Adım Adım Çözüm

1
Place specific service permits first
SSH (TCP 22) and SNMP (UDP 161) rules from 192.168.50.0/24 to host 10.10.10.25 are processed at the top of the ACL.
Cisco IOS processes Access Control Lists sequentially from top to bottom. Specific permits must appear before more general deny statements to prevent permitted traffic from being matched and dropped early.
2
Place the host-specific deny rule next
deny ip 192.168.50.0 0.0.0.255 host 10.10.10.25 log is placed after the allowed services for host 10.10.10.25.
Any non-SSH and non-SNMP traffic targeted at 10.10.10.25 will fail to match the first two permits and will be caught by this statement, logged, and dropped.
3
Place the general subnet permit rule at the bottom
permit ip 192.168.50.0 0.0.0.255 any is placed fourth in the order.
If this rule were placed above the host deny rule, all traffic destined for 10.10.10.25 would be permitted, shadowing the deny statement. Placing it fourth ensures subnet traffic to other destinations is allowed while overriding the final implicit deny any clause.

Anahtar Kavram

Top-down sequential evaluation and rule shadowing in IPv4 Access Control Lists
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Access Control Lists (Standard and Extended IPv4 ACLs)

Bu konudan daha fazla soru