A network engineer configures an extended Access Control List (ACL) on an enterprise edge router to allow internal workstations on the subnet to perform domain name queries against an external DNS server at IP address . The engineer enters the following rule on the outbound interface:
`permit udp 10.100.4.0 0.0.0.255 host 8.8.8.8 eq 53`
Users report that basic DNS lookups succeed, but certain applications fail when DNS response payloads exceed bytes or when performing DNSSEC lookups that require switching transport protocols. Which modification to the ACL configuration will resolve this issue while adhering to the principle of least privilege?
- Add a complementary extended ACL rule permitting TCP traffic from subnet 10.100.4.0/24 to host 8.8.8.8 on destination port 53.Cevap
- BModify the existing ACL rule to permit IP protocol traffic instead of UDP to automatically encompass both transport layer protocols.
- CChange the match criteria in the existing rule from destination port 53 to source port 53 so return traffic is permitted through the router.
- DRemove the default implicit deny rule from the interface configuration so unassigned TCP traffic bypasses filtering.
Cevap
Add a complementary extended ACL rule permitting TCP traffic from the internal subnet to the external DNS server IP address on destination port 53.
DNS relies on both UDP and TCP transport protocols on destination port 53. Standard DNS queries less than 512 bytes use UDP. However, when queries exceed 512 bytes or utilize DNSSEC extensions, DNS automatically switches to TCP port 53. Adding an explicit rule permitting TCP port 53 to the destination host resolves fallback issues while strictly limiting access according to least privilege.
Adım Adım Çözüm
Anahtar Kavram
DNS Dual Transport Layer Protocols (UDP/TCP Port 53) in ACL Rules