A network administrator is creating an IPv4 extended Access Control List (ACL) on a Cisco IOS router to regulate traffic flowing from internal hosts to the DMZ subnet (). The ACL must enforce the following policy requirements in order of precedence:
1. Allow HTTP traffic from any host in the internal subnet () to the web server at .
2. Block all other IP traffic from host to the DMZ subnet ().
3. Allow all remaining IP traffic from the internal subnet () to the DMZ subnet ().
4. Explicitly deny all other traffic.
Arrange the given ACL statements in the correct top-down execution order to achieve this security policy without unintended traffic drops.
- 1permit tcp 192.168.10.0 0.0.0.255 host 172.16.1.50 eq 80
- 2deny ip host 192.168.10.15 172.16.1.0 0.0.0.255
- 3permit ip 192.168.10.0 0.0.0.255 172.16.1.0 0.0.0.255
- 4deny ip any any
Cevap
The correct sequential order for the access list statements from top to bottom is: permit tcp 192.168.10.0 0.0.0.255 host 172.16.1.50 eq 80, followed by deny ip host 192.168.10.15 172.16.1.0 0.0.0.255, followed by permit ip 192.168.10.0 0.0.0.255 172.16.1.0 0.0.0.255, and ending with deny ip any any.
Cisco IPv4 Access Control Lists evaluate rules sequentially from top to bottom. Specific exceptions must precede broader policy rules. The rule permitting HTTP traffic from 192.168.10.0/24 to 172.16.1.50 must be placed first so HTTP requests from host 192.168.10.15 are allowed. Next, the statement denying all IP traffic from host 192.168.10.15 to the DMZ network must be placed to filter out non-HTTP traffic from that specific host. Third, the broader subnet permit statement allows other hosts on 192.168.10.0/24 to access the DMZ network. Finally, the explicit deny statement is placed at the bottom.
Adım Adım Çözüm
Anahtar Kavram
Access Control List Top-Down Sequential Processing and Rule Specificity