An engineer inspects a Cisco IOS router configured with the following extended IPv4 Access Control List (ACL) applied to an interface:
text
ip access-list extended DATA_SEC
10 permit tcp host 172.16.5.10 192.168.1.0 0.0.0.255 eq 22
20 deny ip 172.16.5.0 0.0.0.255 192.168.1.0 0.0.0.255
30 permit ip 172.16.0.0 0.0.255.255 192.168.1.0 0.0.0.255
A workstation with IPv4 address 172.16.5.20 attempts to establish an HTTP connection (TCP port 80) to a server at 192.168.1.50. What action does the router take when evaluating this packet?
- The router drops the packet because it matches sequence line 20.Cevap
- BThe router permits the packet because line 30 permits traffic from the broader 172.16.0.0/16 network.
- CThe router permits the packet because line 20 only restricts non-TCP traffic.
- DThe router drops the packet due to the implicit deny statement after skipping line 20.
Cevap
The router drops the packet because it matches sequence line 20.
The option stating that the router drops the packet because it matches sequence line 20 is correct. Extended ACLs process rules sequentially from top to bottom. Line 10 does not match because the source address is 172.16.5.20 (not 172.16.5.10) and the port is 80 (not 22). Line 20 matches because its wildcard mask encompasses 172.16.5.20, its destination mask encompasses 192.168.1.50, and the protocol specification 'ip' matches all IPv4 protocols, including TCP. Upon matching line 20, the router executes the deny action and halts further ACL evaluation.
Adım Adım Çözüm
Anahtar Kavram
Extended IPv4 ACL Top-Down Sequential Evaluation and Protocol Scope
Tahmini Süre:1m 15s