A network engineer must construct an IPv4 extended Access Control List (ACL) on a Cisco IOS router to enforce the following security policy requirements for traffic originating from subnet destined for the server subnet :
1. Host must be permitted to access SSH (TCP port 22) on the server subnet.
2. Host must be denied all other TCP traffic to the server subnet.
3. All other hosts on subnet must be permitted HTTP (TCP port 80) access to the server subnet.
4. All remaining IPv4 traffic from subnet to the server subnet must be dropped.
Arrange the ACL statements in the correct top-down sequence (from top/sequence 10 to bottom/sequence 40) to properly enforce this security policy.
- 1permit tcp host 10.20.1.5 172.16.10.0 0.0.0.255 eq 22
- 2deny tcp host 10.20.1.5 172.16.10.0 0.0.0.255
- 3permit tcp 10.20.1.0 0.0.0.255 172.16.10.0 0.0.0.255 eq 80
- 4deny ip 10.20.1.0 0.0.0.255 172.16.10.0 0.0.0.255
Cevap
The correct order of ACL statements from top to bottom is: permit tcp host 10.20.1.5 172.16.10.0 0.0.0.255 eq 22, followed by deny tcp host 10.20.1.5 172.16.10.0 0.0.0.255, followed by permit tcp 10.20.1.0 0.0.0.255 172.16.10.0 0.0.0.255 eq 80, and finally deny ip 10.20.1.0 0.0.0.255 172.16.10.0 0.0.0.255.
Cisco IPv4 Access Control Lists evaluate statements sequentially from top to bottom until a first match occurs. To enforce host-specific exceptions within a larger subnet, more specific rules (host 10.20.1.5 permits and denies) must precede general rules (subnet 10.20.1.0/24 permits and denies). Placing the SSH permit for host 10.20.1.5 first guarantees SSH functionality. Placing the TCP deny for host 10.20.1.5 second prevents host 10.20.1.5 from matching the subnet HTTP permit rule placed third. Finally, the subnet-wide IP deny statement catches all other traffic from the subnet.
Adım Adım Çözüm
Anahtar Kavram
Top-Down Sequential Processing and Specific-to-General Ordering in IPv4 Extended ACLs