A network administrator is creating an IPv4 extended named Access Control List (ACL) called `MGMT_FILTER` to enforce security policies on a router interface. The policy mandates the following conditions:
- Permit HTTP () and SSH () traffic originating from subnet destined to a specific management server at .
- Deny all other IP traffic from subnet destined to subnet .
- Allow all remaining IPv4 traffic traversing the interface to reach other destinations.
Which TWO statements or configuration requirements are necessary to correctly fulfill this policy? (Select TWO.)
- Place `permit tcp 192.168.1.0 0.0.0.255 host 10.0.5.10 eq 80` and `permit tcp 192.168.1.0 0.0.0.255 host 10.0.5.10 eq 22` prior to the subnet deny entry.Cevap
- Add an explicit `permit ip any any` entry at the end of the access list sequence.Cevap
- COmit any statement at the end of the ACL because the default implicit clause automatically permits all unmatched IPv4 traffic.
- DUse the wildcard mask `0.0.0.0` for subnet and wildcard mask `0.0.0.255` for host .
Cevap
The policy requires placing specific TCP permit statements for HTTP and SSH to host 10.0.5.10 before the broader subnet deny rule, and appending an explicit 'permit ip any any' at the end of the ACL to override the default implicit deny.
The solution requires two essential steps: placing specific permit statements for HTTP and SSH to host 10.0.5.10 ahead of the broader subnet deny rule (so specific allowed traffic is processed first), and adding an explicit 'permit ip any any' statement at the bottom of the ACL to override the invisible implicit 'deny ip any any' clause that would otherwise block all other traffic.
Adım Adım Çözüm
Anahtar Kavram
Access Control List (ACL) Evaluation Order and Implicit Deny Behavior