A network administrator needs to configure an extended IPv4 access control list (ACL) to implement a specific traffic policy on a Cisco router interface. Arrange the following ACL statements and actions in the correct top-down evaluation order to ensure that host 10.1.1.15 is allowed SSH access to server 172.16.0.5, all other SSH traffic from subnet 10.1.1.0/24 to server 172.16.0.5 is blocked, all other IP traffic from subnet 10.1.1.0/24 is permitted, and unmatched traffic is dropped by default.
- 1access-list 100 permit tcp host 10.1.1.15 host 172.16.0.5 eq 22
- 2access-list 100 deny tcp 10.1.1.0 0.0.0.255 host 172.16.0.5 eq 22
- 3access-list 100 permit ip 10.1.1.0 0.0.0.255 any
- 4Implicit deny ip any any statement executes at the end of the access list
Cevap
The correct sequence places specific permit statements first (permit tcp host 10.1.1.15 host 172.16.0.5 eq 22), followed by broader subnet restrictions (deny tcp 10.1.1.0 0.0.0.255 host 172.16.0.5 eq 22), then general subnet permits (permit ip 10.1.1.0 0.0.0.255 any), and concludes with the automatic implicit deny rule.
Cisco IOS IPv4 access control lists process entries in strict sequential top-down order, stopping processing as soon as a packet matches an Access Control Entry (ACE). Therefore, specific host exceptions must be placed above broader subnet rules. The permit statement for host 10.1.1.15 must be evaluated first so it is not dropped by the subnet-wide SSH deny rule. Placing general subnet permit traffic third allows other protocols from the subnet, and any packet not matching these three lines falls into the automatic implicit deny rule at the bottom.
Adım Adım Çözüm
Anahtar Kavram
Cisco IPv4 ACL sequential top-down evaluation logic and implicit deny enforcement