A network administrator is creating an IPv4 extended Access Control List (ACL 101) on a Cisco IOS router to enforce security policies for traffic sent to Web Server 192.168.10.50. The policy requires:
1. Host 10.1.1.5 must be permitted HTTP access (TCP port 80) to Web Server 192.168.10.50.
2. Host 10.1.1.5 must be denied all other IP traffic to Web Server 192.168.10.50.
3. All other hosts in the 10.1.1.0/24 subnet must be permitted full IP access to Web Server 192.168.10.50.
4. All remaining traffic to Web Server 192.168.10.50 must be explicitly denied.
Arrange the ACL statements in the correct sequential top-down order (from line 1 at the top to line 4 at the bottom) to satisfy all security requirements.
- 1access-list 101 permit tcp host 10.1.1.5 host 192.168.10.50 eq 80
- 2access-list 101 deny ip host 10.1.1.5 host 192.168.10.50
- 3access-list 101 permit ip 10.1.1.0 0.0.0.255 host 192.168.10.50
- 4access-list 101 deny ip any host 192.168.10.50
Cevap
The correct order from top to bottom is: access-list 101 permit tcp host 10.1.1.5 host 192.168.10.50 eq 80, followed by access-list 101 deny ip host 10.1.1.5 host 192.168.10.50, followed by access-list 101 permit ip 10.1.1.0 0.0.0.255 host 192.168.10.50, and ending with access-list 101 deny ip any host 192.168.10.50.
Cisco IOS Access Control Lists evaluate rules sequentially from top to bottom until a match is found. Specific rules must always precede broader rules. The specific HTTP permit for host 10.1.1.5 must be line 1; otherwise, a broader deny statement would block it. Next, denying all other IP traffic from host 10.1.1.5 must be line 2, coming before the subnet permit line so that host 10.1.1.5 is restricted. Line 3 permits the rest of the 10.1.1.0/24 subnet. Finally, line 4 explicitly denies all other sources.
Adım Adım Çözüm
Anahtar Kavram
Top-down sequential evaluation in Cisco ACLs (specific host/port rules before broad subnet rules)