A network administrator is creating an IPv4 extended Access Control List (ACL 105) to allow HTTPS access from host 192.168.10.5 to web server 10.0.0.5, block all other TCP traffic from the 192.168.10.0/24 subnet to the 10.0.0.0/8 network, and permit all remaining traffic. In what sequential order from top to bottom should these ACL statements be configured to enforce the intended policy correctly?
- 1access-list 105 permit tcp host 192.168.10.5 host 10.0.0.5 eq 443
- 2access-list 105 deny tcp 192.168.10.0 0.0.0.255 10.0.0.0 0.255.255.255
- 3access-list 105 permit ip any any
Cevap
The correct sequence places the specific host permit rule first, followed by the broader subnet TCP deny rule, and ends with the general permit ip any any rule.
Cisco IOS ACL entries are evaluated sequentially from top to bottom. Specific permit statements (such as host-to-host HTTPS traffic) must always precede broader deny statements (such as an entire /24 subnet destination block). Finally, an explicit permit ip any any statement must be placed at the end to prevent unrelated traffic from being dropped by the hidden implicit deny rule.
Adım Adım Çözüm
Anahtar Kavram
Access Control List sequential top-down processing and rule specificity