Soru

Zorluk: OrtaAccess Control Lists (Standard and Extended IPv4 ACLs)

A network administrator is creating an IPv4 extended Access Control List (ACL 101) on a Cisco IOS router to enforce security policies for traffic sent to Web Server 192.168.10.50. The policy requires:

1. Host 10.1.1.5 must be permitted HTTP access (TCP port 80) to Web Server 192.168.10.50.
2. Host 10.1.1.5 must be denied all other IP traffic to Web Server 192.168.10.50.
3. All other hosts in the 10.1.1.0/24 subnet must be permitted full IP access to Web Server 192.168.10.50.
4. All remaining traffic to Web Server 192.168.10.50 must be explicitly denied.

Arrange the ACL statements in the correct sequential top-down order (from line 1 at the top to line 4 at the bottom) to satisfy all security requirements.

  1. 1access-list 101 permit tcp host 10.1.1.5 host 192.168.10.50 eq 80
  2. 2access-list 101 deny ip host 10.1.1.5 host 192.168.10.50
  3. 3access-list 101 permit ip 10.1.1.0 0.0.0.255 host 192.168.10.50
  4. 4access-list 101 deny ip any host 192.168.10.50

Cevap

The correct order from top to bottom is: access-list 101 permit tcp host 10.1.1.5 host 192.168.10.50 eq 80, followed by access-list 101 deny ip host 10.1.1.5 host 192.168.10.50, followed by access-list 101 permit ip 10.1.1.0 0.0.0.255 host 192.168.10.50, and ending with access-list 101 deny ip any host 192.168.10.50.
Cisco IOS Access Control Lists evaluate rules sequentially from top to bottom until a match is found. Specific rules must always precede broader rules. The specific HTTP permit for host 10.1.1.5 must be line 1; otherwise, a broader deny statement would block it. Next, denying all other IP traffic from host 10.1.1.5 must be line 2, coming before the subnet permit line so that host 10.1.1.5 is restricted. Line 3 permits the rest of the 10.1.1.0/24 subnet. Finally, line 4 explicitly denies all other sources.

Adım Adım Çözüm

1
Identify top-down sequential processing logic for Cisco IOS ACLs.
Router processes rules sequentially from top to bottom and stops at the first match.
More specific rules must precede more general rules to avoid being overridden.
2
Place the most specific permit rule for host 10.1.1.5.
access-list 101 permit tcp host 10.1.1.5 host 192.168.10.50 eq 80 is line 1.
If the host deny statement were placed above this permit, HTTP traffic from host 10.1.1.5 would be matched and dropped.
3
Place the host-specific restriction for host 10.1.1.5.
access-list 101 deny ip host 10.1.1.5 host 192.168.10.50 is line 2.
If the general subnet permit rule were placed above this line, host 10.1.1.5 would match the subnet permit and gain full access.
4
Place the general subnet permit rule for 10.1.1.0/24.
access-list 101 permit ip 10.1.1.0 0.0.0.255 host 192.168.10.50 is line 3.
This allows all remaining hosts in 10.1.1.0/24 (excluding host 10.1.1.5's non-HTTP traffic, which was caught in line 2).
5
Place the explicit catch-all deny rule.
access-list 101 deny ip any host 192.168.10.50 is line 4.
Ensures any traffic not originating from 10.1.1.0/24 destined to the server is explicitly dropped.

Anahtar Kavram

Top-down sequential evaluation in Cisco ACLs (specific host/port rules before broad subnet rules)
Bu soruyu puanla