Examkin

Soru

Zorluk: KolayFirewalls and Access Control Lists (ACLs)

A network administrator is configuring a IPv4 Access Control List (ACL) on a router interface to protect an internal server at IP address 10.0.0.5. The security requirement dictates that SSH management traffic (TCP port 22) to the server must be blocked from all sources, HTTPS web traffic (TCP port 443) must be allowed from the internal workstation subnet (192.168.1.0/24), all other general IP traffic from the internal workstation subnet to the server must be allowed, and all remaining traffic must be dropped. In what order, from top to bottom, should these ACL rules be placed to ensure proper filtering without rule shadowing?

  1. 1deny tcp any host 10.0.0.5 eq 22
  2. 2permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.5 eq 443
  3. 3permit ip 192.168.1.0 0.0.0.255 host 10.0.0.5
  4. 4deny ip any any

Cevap

The correct top-to-bottom sequence begins with the specific SSH block ('deny tcp any host 10.0.0.5 eq 22'), followed by the specific HTTPS permit rule ('permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.5 eq 443'), then the general IP permit rule for the subnet ('permit ip 192.168.1.0 0.0.0.255 host 10.0.0.5'), and ends with the default block rule ('deny ip any any').
Routers process ACL entries sequentially from top to bottom and execute the action of the very first rule that matches incoming packet headers. Specific port-based restrictions (such as denying TCP port 22 SSH traffic) must precede broader permit rules (such as allowing general IP traffic from a subnet). If general permit rules appear higher in the list, matching packets are permitted immediately, rendering subsequent specific deny rules completely ineffective due to rule shadowing. Finally, the default catch-all deny rule must sit at the bottom to drop any traffic that did not match earlier permit criteria.

Adım Adım Çözüm

1
Place specific deny statements ahead of general permits to avoid rule shadowing.
Position 'deny tcp any host 10.0.0.5 eq 22' at the top (1st line).
ACLs process rules sequentially from top to bottom using first-match logic. If a general permit rule were evaluated prior to this restriction, SSH packets would be permitted before reaching the deny statement.
2
Place specific protocol/port permit statements after specific restrictions.
Position 'permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.5 eq 443' second (2nd line).
Allows HTTPS web traffic specifically requested by the security policy after SSH has been securely denied.
3
Place broader subnet permit rules after specific port permit and deny rules.
Position 'permit ip 192.168.1.0 0.0.0.255 host 10.0.0.5' third (3rd line).
Allows remaining general IP communication from the workstation subnet. Placing this rule higher would shadow the SSH deny rule.
4
Place the catch-all drop rule at the very bottom of the ACL.
Position 'deny ip any any' last (4th line).
Ensures all unmatched traffic is dropped by the default implicit deny behavior.

Anahtar Kavram

ACL Sequential Evaluation and First-Match Logic
Bu soruyu puanla

Konular

Firewalls and Access Control Lists (ACLs)

Bu konudan daha fazla soru