An administrator applies the following extended IPv4 access control list outbound on interface GigabitEthernet0/0/1 to permit HTTP traffic from the Sales VLAN () to an internal Web Server ():
text
access-list 110 permit tcp 10.1.10.0 0.0.0.255 host 192.168.1.100 eq 80
After applying `ip access-group 110 out` on the interface, users in the Sales VLAN report that while HTTP access works, they can no longer send ICMP echo requests to the Web Server or access the corporate DNS server () located on the same subnet. Which condition is causing this traffic interruption?
- The unwritten implicit deny clause at the end of the ACL drops all IP traffic that does not explicitly match the permit statement.Cevap
- BExtended access control lists cannot filter traffic by specific TCP destination port numbers such as port 80.
- CStandard network utility protocols like ICMP and DNS can only be filtered using numbered standard ACLs (1-99).
- DThe IP address range 192.168.1.0/24 is reserved as RFC 1918 private space, which disables ICMP and DNS forwarding across router interfaces.
Cevap
The implicit deny statement at the end of the ACL drops all IP traffic that does not explicitly match the single permit entry.
Every Cisco IPv4 Access Control List includes an invisible implicit deny statement at the end (`deny ip any any`). Because ACL 110 only explicitly permits TCP traffic to port 80 on host 192.168.1.100, all other IP traffic—including ICMP ping requests and UDP DNS traffic to 192.168.1.2—is dropped by the implicit deny clause.
Adım Adım Çözüm
Anahtar Kavram
ACL Implicit Deny Any behavior and extended IPv4 statement evaluation order