A network administrator applies the following standard IPv4 access control list (ACL) to a VTY line on a Cisco IOS switch to secure remote management access:
text
ip access-list standard VTY_ACCESS
permit host 192.168.10.25
permit 192.168.20.0 0.0.0.255
A monitoring server with IPv4 address attempts to initiate an SSH session to the switch. Based on this configuration, what action does the switch take on this traffic, and why?
- AThe traffic is permitted because unlisted packets default to an implicit permit in standard IPv4 ACLs.
- BThe traffic is permitted because the host address 192.168.10.50 shares the /24 network prefix with host 192.168.10.25.
- The traffic is dropped because it does not match any explicit permit entry, triggering the implicit deny clause at the end of the ACL.Cevap
- DThe traffic is dropped because standard access control lists process rules from bottom to top and evaluate wildcard masks in reverse order.
Cevap
The traffic is dropped because it does not match any explicit permit entry, triggering the implicit deny clause at the end of the ACL.
Cisco IOS Access Control Lists process statements in sequential order from top to bottom. The source IP address 192.168.10.50 does not match the first entry (which strictly permits only host 192.168.10.25) nor the second entry (which permits the 192.168.20.0/24 subnet). As a result, the packet reaches the end of the ACL where the invisible implicit 'deny any' statement blocks the connection attempt.
Adım Adım Çözüm
Anahtar Kavram
Cisco IPv4 ACL sequential top-down evaluation and implicit deny behavior
Tahmini Süre:1m 15s