Examkin

Soru

Zorluk: OrtaAccess Control Lists (Standard and Extended IPv4 ACLs)

A network administrator needs to configure an extended IPv4 ACL (ACL 101) on a Cisco router to control access from the User Subnet (10.2.2.0/2410.2.2.0/24) to the Server Subnet (10.1.1.0/2410.1.1.0/24) according to the following security requirements:

1. Host 10.2.2.5010.2.2.50 must be permitted SSH access (TCP port 22) to Server 10.1.1.1010.1.1.10.
2. Host 10.2.2.5010.2.2.50 must be denied all other IP traffic to any destination on the Server Subnet (10.1.1.0/2410.1.1.0/24).
3. All other hosts on the User Subnet (10.2.2.0/2410.2.2.0/24) must be permitted HTTP access (TCP port 80) to Server 10.1.1.2010.1.1.20.
4. All other traffic from the User Subnet to the Server Subnet must be explicitly denied.

Arrange the given ACL statements in the correct top-down evaluation order (from first line processed to last line processed) to successfully enforce these security requirements.

  1. 1access-list 101 permit tcp host 10.2.2.50 host 10.1.1.10 eq 22
  2. 2access-list 101 deny ip host 10.2.2.50 10.1.1.0 0.0.0.255
  3. 3access-list 101 permit tcp 10.2.2.0 0.0.0.255 host 10.1.1.20 eq 80
  4. 4access-list 101 deny ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255

Cevap

The correct order from top to bottom is: 1) access-list 101 permit tcp host 10.2.2.50 host 10.1.1.10 eq 22, 2) access-list 101 deny ip host 10.2.2.50 10.1.1.0 0.0.0.255, 3) access-list 101 permit tcp 10.2.2.0 0.0.0.255 host 10.1.1.20 eq 80, 4) access-list 101 deny ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255.
Cisco IOS ACLs evaluate packets sequentially from top to bottom until a match is found. To properly isolate host 10.2.2.50 while permitting host-specific SSH and allowing general subnet HTTP access, host-specific rules must be placed above subnet-level rules. Placing the host SSH permit first guarantees SSH traffic passes. Placing the host subnet deny second ensures host 10.2.2.50 cannot reach any other server or port (including HTTP on 10.1.1.20). Placing the subnet HTTP permit third allows remaining hosts on 10.2.2.0/24 to reach the web server. Finally, placing the general subnet deny fourth explicitly blocks all other inter-subnet traffic.

Adım Adım Çözüm

1
Identify the most specific requirement for host 10.2.2.50 SSH access.
Place 'access-list 101 permit tcp host 10.2.2.50 host 10.1.1.10 eq 22' first so SSH traffic from host 10.2.2.50 is matched and allowed immediately.
Cisco IOS processes ACL entries sequentially from top to bottom; the first matching rule dictates the packet disposition.
2
Enforce the specific restriction on host 10.2.2.50 for the rest of the target subnet.
Place 'access-list 101 deny ip host 10.2.2.50 10.1.1.0 0.0.0.255' second.
If the general HTTP permit statement for 10.2.2.0/24 was placed above this line, host 10.2.2.50 would be allowed HTTP access to Server 10.1.1.20, breaking Requirement 2.
3
Permit HTTP traffic for all remaining hosts in the subnet.
Place 'access-list 101 permit tcp 10.2.2.0 0.0.0.255 host 10.1.1.20 eq 80' third.
Having blocked host 10.2.2.50 in step 2, this rule applies to all other 10.2.2.0/24 hosts trying to access web services on 10.1.1.20.
4
Catch all remaining traffic between the two subnets.
Place 'access-list 101 deny ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255' fourth.
This explicitly drops any other IP traffic from 10.2.2.0/24 to 10.1.1.0/24.

Anahtar Kavram

Sequential Top-Down ACL Processing and Rule Shadowing
Bu soruyu puanla

Konular

Access Control Lists (Standard and Extended IPv4 ACLs)

Bu konudan daha fazla soru