Examkin

Soru

Zorluk: ZorAccess Control Lists (Standard and Extended IPv4 ACLs)

A network engineer configures the following named extended IPv4 Access Control List (ACL) on a Cisco IOS router to regulate inbound traffic from a branch office subnet (10.20.0.0/2210.20.0.0/22) destined for a data center network (172.16.100.0/24172.16.100.0/24):

`ip access-list extended BRANCH_POLICY`
` 10 permit tcp host 10.20.2.45 host 172.16.100.10 eq 22`
` 20 permit tcp host 10.20.2.45 host 172.16.100.10 eq 443`
` 30 deny tcp 10.20.0.0 0.0.3.255 172.16.100.0 0.0.0.255 eq 80`
` 40 deny tcp 10.20.0.0 0.0.3.255 172.16.100.0 0.0.0.255 eq 443`

The ACL is applied to the inbound direction of the interface facing the branch network. What happens when a user at host 10.20.1.1010.20.1.10 attempts to send ICMP echo request packets to server 172.16.100.1172.16.100.1?

  1. The ICMP packets are dropped because they fail to match any explicit permit statement and hit the implicit deny all clause.Cevap
  2. B
    The ICMP packets are permitted because lines 10 through 40 only filter TCP traffic and do not explicitly deny ICMP.
  3. C
    The ICMP packets are dropped because line 30 denies all protocols originating from the 10.20.0.0 0.0.3.255 range.
  4. D
    The ICMP packets are permitted because the wildcard mask 0.0.3.255 excludes host address 10.20.1.10 from being evaluated by the ACL.

Cevap

The ICMP packets are dropped because they fail to match any explicit permit statement and fall through to the implicit deny all clause at the end of the ACL processing list.
Cisco IOS access control lists evaluate traffic top-down. The list contains explicit rules only for TCP protocol packets (ports 22, 443, and 80). Because ICMP traffic does not match any of the TCP rules, it continues through the entire list without a match and is dropped by the mandatory implicit `deny ip any any` rule at the bottom of the ACL.

Adım Adım Çözüm

1
Evaluate incoming packet parameters against ACL criteria
The packet protocol is ICMP, source IP is 10.20.1.10, and destination IP is 172.16.100.1.
Sequential evaluation requires comparing the packet fields with each entry in order.
2
Compare packet attributes against ACL sequence numbers 10, 20, 30, and 40
Sequence entries 10, 20, 30, and 40 all specify protocol 'tcp'. The packet protocol is ICMP.
Since ICMP is a distinct Layer 3/4 protocol from TCP, none of these statements match the packet.
3
Determine the action after reaching the end of the explicit ACL statements
The packet reaches the unwritten end of the access list.
Every Cisco IPv4 access list has an invisible final rule: 'deny ip any any'. Without an explicit permit rule matching ICMP, the packet is dropped.

Anahtar Kavram

ACL Sequential Evaluation and the Implicit Deny Clause
Bu soruyu puanla

Konular

Access Control Lists (Standard and Extended IPv4 ACLs)

Bu konudan daha fazla soru