Examkin

Soru

Zorluk: Çok zorFirewalls and Access Control Lists (ACLs)

An administrator is configuring a stateless extended IPv4 Access Control List (ACL) on a WAN edge router interface (GigabitEthernet0/1) to secure traffic between an internal database cluster (192.168.10.0/24192.168.10.0/24) and a remote external cloud database server (203.0.113.50203.0.113.50). Internal hosts initiate outbound TCP connections to the external server on destination port 54325432.

To allow outbound traffic, the outbound ACL on GigabitEthernet0/1 contains the following rule:
`access-list 101 permit tcp 192.168.10.0 0.0.0.255 host 203.0.113.50 eq 5432`

Which entry must be added to the inbound ACL on GigabitEthernet0/1 to permit return traffic from the database server back to internal hosts while preventing unrequested inbound TCP connections from external sources?

  1. access-list 102 permit tcp host 203.0.113.50 eq 5432 192.168.10.0 0.0.0.255 establishedCevap
  2. B
    access-list 102 permit tcp host 203.0.113.50 192.168.10.0 0.0.0.255 eq 5432
  3. C
    access-list 102 permit udp host 203.0.113.50 eq 5432 192.168.10.0 0.0.0.255 established
  4. D
    Omit an inbound rule on GigabitEthernet0/1 because stateless routers dynamically permit incoming packets that match active outbound TCP sessions.

Cevap

The inbound ACL entry must specify 'access-list 102 permit tcp host 203.0.113.50 eq 5432 192.168.10.0 0.0.0.255 established'.
Stateless Access Control Lists evaluate packets individually without keeping track of connection state tables. When an internal client initiates a TCP session to port 5432 on an external server, the server's return packets will have a source IP of 203.0.113.50, a source TCP port of 5432, and a destination IP in the 192.168.10.0/24 network. Additionally, valid return traffic in a TCP handshake contains the ACK or RST flag. Using the entry containing 'host 203.0.113.50 eq 5432 192.168.10.0 0.0.0.255 established' correctly checks that source port 5432 is specified and that non-SYN return packets are permitted while blocking incoming new connection attempts.

Adım Adım Çözüm

1
Analyze source and destination parameters for return traffic
Return traffic originates from the external database host (203.0.113.50203.0.113.50) on source TCP port 54325432 and travels to internal hosts (192.168.10.0/24192.168.10.0/24) on dynamic high-numbered ephemeral destination ports.
When internal clients initiate a TCP connection, the database server responds from its service port (54325432) back to the client's dynamically allocated source port.
2
Evaluate statefulness and TCP flag filtering requirements
Stateless firewalls and standard router extended ACLs do not keep connection state tables. To permit return packets while blocking unsolicited inbound connection attempts (SYN packets), the ACL must inspect TCP flag bits.
The 'established' keyword forces the ACL to check for the presence of ACK (Acknowledgment) or RST (Reset) control bits, which are only present in ongoing, established TCP sessions.
3
Construct the exact syntax for the inbound ACL entry
`access-list 102 permit tcp host 203.0.113.50 eq 5432 192.168.10.0 0.0.0.255 established`
This entry matches TCP packets sourced from host 203.0.113.50203.0.113.50 port 54325432 destined for 192.168.10.0/24192.168.10.0/24 with the ACK or RST flags set.

Anahtar Kavram

Stateless extended ACL return traffic filtering using TCP flag matching (`established` keyword)
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Firewalls and Access Control Lists (ACLs)

Bu konudan daha fazla soru