Examkin

Soru

Zorluk: OrtaAccess Control Lists (Standard and Extended IPv4 ACLs)

A network engineer applies the following IPv4 extended named Access Control List (ACL) inbound on interface GigabitEthernet0/0 of a Cisco IOS router:

text
ip access-list extended SERVER_ACCESS
permit tcp 172.16.10.0 0.0.0.255 host 192.168.50.10 eq 443
permit tcp 172.16.10.0 0.0.0.255 host 192.168.50.10 eq 80

A workstation with IPv4 address 172.16.10.45 attempts to establish an SSH management session (TCP port 22) to the server at 192.168.50.10. Which result describes how the router processes this SSH traffic?

  1. The router drops the traffic because it fails to match any explicit permit entry and is caught by the implicit deny any clause at the end of the ACL.Cevap
  2. B
    The router permits the traffic because extended ACLs implicitly permit all unlisted IP traffic unless an explicit deny statement is added.
  3. C
    The router permits the traffic because line 10 permits all TCP protocol traffic originating from subnet 172.16.10.0/24 regardless of destination port.
  4. D
    The router drops the traffic because IPv4 extended named ACLs cannot filter traffic by specific L4 port numbers when applied inbound.

Cevap

The router drops the traffic because it fails to match any explicit permit entry and is caught by the implicit deny any clause at the end of the ACL.
Cisco IPv4 extended ACLs process rules sequentially from top to bottom. The ACL contains explicit permit entries for TCP port 443 (HTTPS) and TCP port 80 (HTTP). SSH traffic uses TCP port 22, which does not match either line. Because Cisco IOS automatically appends an unwritten implicit deny rule (deny ip any any) to the bottom of every ACL, any packet that reaches the end of the list without matching an explicit permit rule is dropped.

Adım Adım Çözüm

1
Evaluate the packet header attributes against the ACL entry conditions.
Source IP is 172.16.10.45, destination IP is 192.168.50.10, protocol is TCP, and destination port is 22 (SSH).
ACL rule matching requires checking source IP, destination IP, L4 protocol, and destination port.
2
Perform top-down sequential processing against line 10 and line 20.
Line 10 matches TCP port 443 only. Line 20 matches TCP port 80 only. Neither line matches destination TCP port 22.
Cisco IOS ACL rules are evaluated sequentially in top-down order until a match occurs.
3
Evaluate the unlisted packet against default ACL behavior.
The packet encounters the implicit 'deny ip any any' statement at the end of the ACL and is dropped.
All Cisco IOS IPv4 standard and extended access control lists conclude with an unwritten, implicit deny all traffic statement.

Anahtar Kavram

Sequential evaluation and implicit deny behavior in Cisco IPv4 Extended ACLs
Tahmini Süre:1m 15s
Bu soruyu puanla

Konular

Access Control Lists (Standard and Extended IPv4 ACLs)

Bu konudan daha fazla soru