A network administrator configures a Cisco IOS router with the following extended IPv4 access control list (ACL) applied in the outbound direction on interface GigabitEthernet0/1:
text
ip access-list extended OUTBOUND_FILTER
permit tcp 172.16.20.0 0.0.0.255 192.168.1.0 0.0.0.255 eq 22
deny ip host 172.16.20.5 192.168.1.0 0.0.0.255
permit ip 172.16.20.0 0.0.0.255 192.168.1.0 0.0.0.255
Which two statements correctly describe how traffic sent through GigabitEthernet0/1 will be evaluated by this access list?
- SSH traffic originating from host 172.16.20.5 and destined for 192.168.1.50 is permitted.Cevap
- Traffic originating from host 172.16.20.10 and destined for an external address of 8.8.8.8 is dropped.Cevap
- CICMP traffic originating from host 172.16.20.5 and destined for 192.168.1.50 is permitted.
- DTraffic originating from host 172.16.20.10 and destined for an external address of 8.8.8.8 is permitted.
Cevap
SSH traffic from host 172.16.20.5 to 192.168.1.50 is permitted because it matches the top rule first, and traffic from host 172.16.20.10 to 8.8.8.8 is dropped due to the implicit deny at the end of the ACL.
Cisco IPv4 ACLs evaluate statements sequentially in top-down order and stop processing as soon as a match is found. For SSH traffic from host 172.16.20.5, line 1 matches because SSH uses TCP port 22, so the packet is permitted immediately before line 2 can deny it. For traffic destined for 8.8.8.8, none of the explicit rules match the destination subnet, so the packet hits the implicit deny statement at the end of the list and is dropped.
Adım Adım Çözüm
Anahtar Kavram
Sequential Top-Down ACL Evaluation and Implicit Deny Behavior