A network engineer is troubleshooting an issue where workstations on a branch office subne… — CompTIA Network+

A network engineer is troubleshooting an issue where workstations on a branch office subnet ( $192.168.30.0/24$ ) cannot access an internal corporate web server ( $10.50.4.100$ ) over HTTPS or reach external websites. Local inter-VLAN traffic works normally.

The engineer inspects the workstation configuration and branch router logs:

Workstation Network Settings:
- IP Address: $192.168.30.45$
- Subnet Mask: $255.255.255.0$
- Default Gateway: $192.168.30.1$

Branch Router Routing Table (`show ip route` excerpt):
- $C\quad 192.168.30.0/24$ is directly connected, `GigabitEthernet0/0.30`
- $S*\quad 0.0.0.0/0$ [1/0] via $203.0.113.254$

Branch Router Outbound ACL (`show ip access-lists OUTBOUND_FILTER` excerpt):
- `10 permit udp 192.168.30.0 0.0.0.255 host 10.50.4.100 eq 443`
- `20 deny ip 192.168.30.0 0.0.0.255 10.50.0.0 0.0.255.255`

Which TWO factors are directly responsible for the observed connectivity failure? (Select TWO.)

The router lacks a specific static or dynamic route targeting the internal $10.50.0.0/16$ network via the IPsec tunnel interface.Cevap
ACL line 10 specifies UDP instead of TCP for destination port 443, causing HTTPS web traffic to be blocked by the subsequent deny rule.Cevap
C
The workstation's default gateway address resides on a different IP subnet than the client IP address.
D
The default gateway drops traffic due to a port and protocol mismatch between HTTP port 80 and HTTPS port 443 on the local client interface.

Cevap

The connectivity failures are caused by a missing specific route for the internal

10.50.0.0/16

network across the VPN tunnel, and a transport protocol mismatch in ACL line 10 specifying UDP instead of TCP for port 443.

The issue stems from two distinct misconfigurations. First, the router lacks a static or dynamic route for

10.50.0.0/16

pointing to the VPN tunnel interface, causing internal corporate traffic to be forwarded to the public ISP gateway. Second, ACL line 10 incorrectly permits UDP port 443 instead of TCP port 443; HTTPS uses TCP, so web traffic falls through to line 20 and gets dropped by the explicit deny statement.

Adım Adım Çözüm

Analyze the branch router routing table for destination network reachability.

The routing table only contains a directly connected route for

192.168.30.0/24

and a default static route (

0.0.0.0/0

) pointing out the public Internet gateway (

203.0.113.254

Traffic destined for the corporate network (

10.50.4.100

) will incorrectly follow the default route out to the public internet rather than being directed into the IPsec VPN tunnel interface.

Inspect the Access Control List configuration for application protocol accuracy.

Line 10 permits UDP port 443 for traffic to

10.50.4.100

, but HTTPS utilizes TCP port 443.

Because HTTPS traffic uses TCP, it fails to match line 10 and is caught by line 20 (`deny ip 192.168.30.0 0.0.0.255 10.50.0.0 0.0.255.255`), dropping the packets.

Anahtar Kavram

Routing Table Lookups and Access Control List Protocol Matching

Tahmini Süre:2m 30s

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru