Examkin

Soru

Zorluk: OrtaAccess Control Lists (Standard and Extended IPv4 ACLs)

A network engineer configures an inbound IPv4 extended Access Control List (ACL) on GigabitEthernet0/1 to filter traffic entering a corporate network segment:

text
ip access-list extended FILTER_WEB
permit tcp 172.16.10.0 0.0.0.255 host 192.168.1.50 eq 80
permit tcp 172.16.10.0 0.0.0.255 host 192.168.1.50 eq 443

A workstation at 172.16.10.15172.16.10.15 attempts to send ICMP echo request packets (ping) to the server at 192.168.1.50192.168.1.50. What happens to these ICMP packets when processed by the router interface?

  1. The ICMP packets are dropped because they do not match any explicit permit statement, causing them to hit the implicit deny all clause.Cevap
  2. B
    The ICMP packets are permitted because matching the source IP network range in an active ACL automatically grants basic Layer 3 reachability.
  3. C
    The ICMP packets are permitted because permitting TCP port 80 and 443 implicitly allows accompanying ICMP diagnostics between the same host pair.
  4. D
    The ICMP packets bypass the ACL filtration process because IPv4 extended access control lists only inspect TCP and UDP transport layer headers.

Cevap

The ICMP packets are dropped because they do not match any explicit permit statement, causing them to hit the implicit deny all clause.
Extended IPv4 ACL rules are processed top-down until a match is found. The ACL in the scenario only permits TCP traffic destined for port 80 or port 443. Because ICMP echo requests use the ICMP protocol (not TCP), they do not match either explicit permit statement. Unmatched traffic falls through to the implicit `deny ip any any` entry present at the end of every Cisco ACL, resulting in the packet being dropped.

Adım Adım Çözüm

1
Evaluate the protocol and traffic parameters of the incoming packet.
The packet is an ICMP echo request originating from 172.16.10.15172.16.10.15 destined for 192.168.1.50192.168.1.50.
Extended ACLs filter based on source IP, destination IP, protocol type, and port numbers.
2
Compare the packet against the explicit ACL rules sequentially from top to bottom.
Line 1 specifies TCP port 80 (HTTP) and Line 2 specifies TCP port 443 (HTTPS). Neither rule matches ICMP traffic.
ICMP is a Layer 3 protocol (IP protocol number 1) and does not use TCP (IP protocol number 6) transport headers.
3
Determine the outcome when no explicit permit rule is matched.
The packet reaches the unwritten end of the access list, matching the default `deny ip any any` rule.
Every Cisco IOS IPv4 Access Control List ends with an invisible implicit deny statement that drops all unmatched traffic.

Anahtar Kavram

ACL Sequential Evaluation and the Implicit Deny Any Clause
Bu soruyu puanla

Konular

Access Control Lists (Standard and Extended IPv4 ACLs)

Bu konudan daha fazla soru