Examkin

Soru

Zorluk: OrtaFirewalls and Access Control Lists (ACLs)

A system administrator notices that log events from the client subnet 10.100.20.0/2410.100.20.0/24 are not reaching the central Syslog server located at 192.168.10.50192.168.10.50. An extended IPv4 Access Control List (ACL) applied inbound on the router interface serving the client subnet contains the following entries:

access-list 105 permit tcp 10.100.20.0 0.0.0.255 host 192.168.10.50 eq 514
access-list 105 permit udp 10.100.20.0 0.0.0.255 host 192.168.10.50 eq 161
access-list 105 deny ip any any

Which configuration error is preventing the log messages from reaching the Syslog server?

  1. The ACL rule permits TCP traffic on port 514, but standard Syslog operates over UDP port 514, causing the log packets to be matched and dropped by the deny rule.Cevap
  2. B
    The ACL rule permits UDP traffic on port 161, but standard Syslog operates over UDP port 162, preventing traffic from matching the second rule.
  3. C
    Syslog messages are encapsulated directly inside Ethernet Layer 2 frames without IP headers, making them unmatchable by extended IPv4 ACL entries.
  4. D
    The router drops the Syslog packets because Port Address Translation (PAT) overload failed to map the inbound destination port to an active translation session.

Cevap

The ACL rule permits TCP traffic on port 514, but standard Syslog operates over UDP port 514, causing the log packets to be matched and dropped by the deny rule.
Standard Syslog generates event messaging over UDP port 514. The configured Access Control List explicitly specifies `tcp` for port 514 in the first rule. Because TCP and UDP are distinct transport-layer protocols, incoming UDP Syslog datagrams fail to match the first rule, fail to match the SNMP rule (UDP 161), and are ultimately discarded by the final deny statement.

Adım Adım Çözüm

1
Identify the transport protocol and port used by standard Syslog.
Standard Syslog operates over UDP using port 514.
Syslog default message transmission relies on connectionless UDP datagram delivery to port 514.
2
Evaluate the configured ACL rules against incoming Syslog packets.
The first entry permits `tcp ... eq 514` which fails to match UDP packets. The second entry permits `udp ... eq 161` (SNMP).
Because protocol type matching requires exact protocol match (TCP vs UDP), UDP 514 packets bypass rules 1 and 2.
3
Determine packet disposition after passing unmatched rules.
The packet hits `deny ip any any` and is dropped.
ACLs process rules sequentially until a match occurs; unmatched packets reach explicit or implicit deny statements.

Anahtar Kavram

Syslog Protocol & Transport ACL Matching
Bu soruyu puanla

Konular

Firewalls and Access Control Lists (ACLs)

Bu konudan daha fazla soru