Examkin

Soru

Zorluk: ZorAccess Control Lists (Standard and Extended IPv4 ACLs)

A network engineer is configuring a named extended IPv4 Access Control List (ACL) on a Cisco IOS router to implement a multi-tier security policy. The ACL must process rules top-down to meet the following requirements:
1. Permit SSH access (TCPTCP port 22) from the specific management host 192.168.100.50192.168.100.50 to the core server interface 10.1.1.110.1.1.1.
2. Deny all other IP traffic originating from the Management subnet (192.168.100.0/24192.168.100.0/24) destined for the Server Farm subnet (10.1.0.0/1610.1.0.0/16).
3. Permit ICMP echo traffic from the Operations subnet (172.16.20.0/24172.16.20.0/24) to any destination.
4. Permit all remaining IPv4 traffic across all subnets.

In what order should the access-list statements be configured from top (first statement executed) to bottom (last statement executed) to ensure proper sequential traffic processing without unintended dropping of packets?

  1. 1permit tcp host 192.168.100.50 host 10.1.1.1 eq 22
  2. 2deny ip 192.168.100.0 0.0.0.255 10.1.0.0 0.0.255.255
  3. 3permit icmp 172.16.20.0 0.0.0.255 any echo
  4. 4permit ip any any

Cevap

The correct order of ACL statements from top to bottom is: 1) permit tcp host 192.168.100.50 host 10.1.1.1 eq 22, 2) deny ip 192.168.100.0 0.0.0.255 10.1.0.0 0.0.255.255, 3) permit icmp 172.16.20.0 0.0.0.255 any echo, 4) permit ip any any.
Cisco Access Control Lists evaluate matching statements in a strict top-down sequential order. Once a packet matches an Access Control Entry (ACE), processing stops for that packet. Therefore, more specific rules (such as permitting TCP port 22 from host 192.168.100.50192.168.100.50 to host 10.1.1.110.1.1.1) must appear before broader rules (such as denying 192.168.100.0/24192.168.100.0/24 to 10.1.0.0/1610.1.0.0/16). Finally, 'permit ip any any' must be placed at the end to prevent unmentioned traffic from being dropped by the implicit deny rule.

Adım Adım Çözüm

1
Identify specific host permit exception
Recognize that 'permit tcp host 192.168.100.50 host 10.1.1.1 eq 22' is a specific exception to a broader subnet blocking rule.
Cisco ACLs process rules sequentially from top to bottom and stop at the first match. Specific host rules must always precede general subnet rules that overlap with them.
2
Place broader subnet deny rule
Position 'deny ip 192.168.100.0 0.0.0.255 10.1.0.0 0.0.255.255' immediately after the specific permit rule.
This blocks all other hosts in 192.168.100.0/24192.168.100.0/24 from accessing any hosts in 10.1.0.0/1610.1.0.0/16.
3
Add specific subnet feature permits
Add 'permit icmp 172.16.20.0 0.0.0.255 any echo' to allow Operations ICMP traffic.
Matches the requirement for ICMP echo traffic from 172.16.20.0/24172.16.20.0/24.
4
Add explicit catch-all permit rule
Append 'permit ip any any' at the very bottom.
Without this rule, Cisco IOS ACLs end with an implicit 'deny ip any any' clause, which would drop all other traffic across the network.

Anahtar Kavram

Cisco IPv4 Extended ACL sequential top-down evaluation and implicit deny override.
Bu soruyu puanla

Konular

Access Control Lists (Standard and Extended IPv4 ACLs)

Bu konudan daha fazla soru