Examkin

Soru

Zorluk: Çok zorAccess Control Lists (Standard and Extended IPv4 ACLs)

A network administrator applies the following IPv4 extended named access control list (ACL) inbound on the GigabitEthernet0/1 interface of a Cisco IOS router to restrict access to a server network:

text
ip access-list extended SERVER_POLICY
10 permit tcp 172.16.5.0 0.0.0.255 host 172.20.10.25 eq 22
20 permit tcp 172.16.5.128 0.0.0.127 172.20.10.0 0.0.0.255 eq 443
30 deny tcp host 172.16.5.150 172.20.10.0 0.0.0.255
40 permit ip 172.16.5.0 0.0.0.255 172.20.10.0 0.0.0.255

The router receives two distinct packets on interface GigabitEthernet0/1:
- Packet 1: Source IP 172.16.5.150, Destination IP 172.20.10.25, Protocol UDP (DNS, destination port 53)
- Packet 2: Source IP 172.16.5.150, Destination IP 172.20.10.30, Protocol TCP (HTTP, destination port 80)

Which statement accurately describes how the router processes these two packets?

  1. Packet 1 is permitted by sequence line 40 because protocol IP encompasses UDP; Packet 2 is denied by sequence line 30 during sequential top-down evaluation.Cevap
  2. B
    Packet 1 is dropped by the implicit deny clause because no preceding entry explicitly specifies UDP; Packet 2 is permitted by sequence line 40.
  3. C
    Packet 1 is permitted by sequence line 40; Packet 2 bypasses sequence line 30 and is permitted by sequence line 40 because line 30 lacks a port operator.
  4. D
    Both Packet 1 and Packet 2 are dropped by the implicit deny clause because host 172.16.5.150 is restricted from reaching destination 172.20.10.0/24 across all protocols.

Cevap

Packet 1 is permitted by sequence line 40 because protocol IP encompasses UDP; Packet 2 is denied by sequence line 30 during sequential top-down evaluation.
Cisco IPv4 extended ACLs are processed sequentially from top to bottom until the first match occurs. Packet 1 is a UDP packet. Lines 10, 20, and 30 explicitly match protocol TCP only, so Packet 1 skips them and reaches line 40. Line 40 uses protocol 'ip', which covers all Layer 4 protocols including UDP, so Packet 1 is permitted. Packet 2 is a TCP packet from host 172.16.5.150 to 172.20.10.30. It skips lines 10 and 20 due to non-matching destination parameters, but matches line 30, which explicitly denies all TCP traffic from host 172.16.5.150 to any address in the 172.20.10.0/24 subnet regardless of port number.

Adım Adım Çözüm

1
Evaluate Packet 1 (UDP, source 172.16.5.150, destination 172.20.10.25) against ACL entries top-down.
Lines 10, 20, and 30 explicitly match protocol 'tcp'. Because Packet 1 uses 'udp', it skips lines 10, 20, and 30.
Protocol matching in extended ACLs requires an exact protocol match (or broad match under protocol 'ip').
2
Evaluate Packet 1 against line 40.
Line 40 matches source subnet 172.16.5.0/24 (wildcard 0.0.0.255) and destination subnet 172.20.10.0/24 (wildcard 0.0.0.255) under protocol 'ip'.
The 'ip' protocol keyword in Cisco IPv4 extended ACLs acts as a wildcard protocol matching TCP, UDP, ICMP, and all other IP payload protocols. Packet 1 is PERMITTED.
3
Evaluate Packet 2 (TCP, source 172.16.5.150, destination 172.20.10.30, port 80) against ACL entries top-down.
Line 10 requires destination IP 172.20.10.25 and port 22 (no match). Line 20 requires source IP in range 172.16.5.128-172.16.5.255 and port 443 (no match). Line 30 matches TCP traffic from host 172.16.5.150 to destination subnet 172.20.10.0/24.
Line 30 specifies 'deny tcp host 172.16.5.150 172.20.10.0 0.0.0.255' without port restriction, meaning ALL TCP ports are matched and denied. Packet 2 is DENIED.

Anahtar Kavram

Top-down sequential evaluation of IPv4 Extended Access Control Lists, protocol suite coverage of the 'ip' keyword, and exact match criteria.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Access Control Lists (Standard and Extended IPv4 ACLs)

Bu konudan daha fazla soru