Examkin

Soru

Zorluk: OrtaAccess Control Lists (Standard and Extended IPv4 ACLs)

A network administrator is configuring an IPv4 extended Access Control List (ACL 105) on a Cisco router to regulate traffic sent from the internal LAN (192.168.1.0/24) to an application server (10.0.0.10).

The access policy requires:
1. Host 192.168.1.50 must be allowed full IP access to the application server (including HTTP).
2. All other hosts on the 192.168.1.0/24 subnet must be blocked from accessing HTTP (TCP port 80) on the application server.
3. All other IP traffic originating from the 192.168.1.0/24 subnet to the application server must be permitted.

Arrange the ACL statements in the correct top-down execution order to achieve this security policy.

  1. 1access-list 105 permit ip host 192.168.1.50 host 10.0.0.10
  2. 2access-list 105 deny tcp 192.168.1.0 0.0.0.255 host 10.0.0.10 eq 80
  3. 3access-list 105 permit ip 192.168.1.0 0.0.0.255 host 10.0.0.10
  4. 4implicit deny ip any any

Cevap

The correct sequence from top to bottom is: 1) permit ip host 192.168.1.50 host 10.0.0.10, 2) deny tcp 192.168.1.0 0.0.0.255 host 10.0.0.10 eq 80, 3) permit ip 192.168.1.0 0.0.0.255 host 10.0.0.10, and 4) implicit deny ip any any.
Cisco IOS Access Control Lists evaluate statements sequentially from top to bottom until a match occurs, stopping further evaluation. To satisfy all requirements: 1) The host-specific permit statement for 192.168.1.50 must be placed first so its HTTP traffic is allowed before subnet rules apply. 2) The HTTP deny rule for subnet 192.168.1.0/24 must be placed second so HTTP packets from all other hosts in the subnet are caught and dropped. 3) The broader subnet IP permit statement must be placed third to permit non-HTTP traffic. 4) The implicit deny statement operates at the bottom, dropping any other un-matched traffic.

Adım Adım Çözüm

1
Place specific host exception rules at the top of the ACL.
Host 192.168.1.50 is permitted full IP access before any subnet-level restrictions are evaluated.
Cisco IOS ACLs evaluate top-down and stop processing on the first match. Host 192.168.1.50 must be matched first so its HTTP traffic is not dropped by the subnet HTTP block.
2
Place specific service block rules for the subnet after host exceptions.
HTTP traffic (TCP port 80) from subnet 192.168.1.0/24 to 10.0.0.10 is denied.
This rule must appear before the general permit rule for the subnet, ensuring HTTP traffic is filtered out first.
3
Place general subnet permit rules after specific service deny rules.
All remaining IP traffic from subnet 192.168.1.0/24 to 10.0.0.10 is permitted.
Placing this rule after the HTTP deny rule ensures non-HTTP traffic from the subnet passes successfully.
4
Rely on the implicit deny at the end of the ACL.
All other traffic not matching the explicit rules is dropped.
Cisco ACLs automatically append an unwritten implicit deny statement at the end of every list.

Anahtar Kavram

Top-down sequential processing of IPv4 ACLs and ordering from most specific to least specific statements.
Bu soruyu puanla

Konular

Access Control Lists (Standard and Extended IPv4 ACLs)

Bu konudan daha fazla soru