A network engineer is configuring an extended Access Control List (ACL) on a stateless rou… — CompTIA Network+

A network engineer is configuring an extended Access Control List (ACL) on a stateless router interface. Client workstations on the internal subnet ( $10.200.15.0/24$ ) can successfully transmit outgoing HTTPS requests ( $TCP$ port $443$ ) to external web servers, but return web traffic is blocked by the inbound ACL. Which of the following configuration adjustments will allow internal clients to receive return HTTPS traffic from external servers while maintaining stateless security controls? (Select TWO.)

Add an inbound ACL rule permitting TCP traffic originating from source port 443 directed to the internal subnet $10.200.15.0/24$ on destination ephemeral ports ( $1024$ - $65535$ ).Cevap
Include the established keyword on the inbound TCP permit rule for port 443 to match packets with the ACK or RST flags set.Cevap
C
Modify the inbound ACL rule to permit incoming UDP traffic on port 443 instead of TCP traffic to bypass connection tracking.
D
Replace the router's Layer 3/4 ACL with a Layer 2 MAC filtering rule on the inbound interface to inspect return packets.

Cevap

To allow return HTTPS traffic through a stateless router ACL, the configuration must explicitly permit inbound TCP traffic originating from source port 443 destined for internal ephemeral client ports (

1024

65535

), and utilize the established keyword to restrict permitted packets to established TCP sessions (packets with ACK/RST flags set).

Because stateless firewalls and ACLs do not automatically dynamically track TCP connection states, return traffic from external servers is dropped by default. To permit return HTTPS packets, an explicit inbound ACL rule must be created that matches TCP source port 443 heading to client ephemeral destination ports. Adding the established keyword guarantees that only return packets belonging to established sessions (ACK/RST flags set) are allowed, preventing unsolicited inbound SYN packets.

Adım Adım Çözüm

Analyze the stateless filtering limitation

Stateless ACLs evaluate each packet individually without maintaining a session table, meaning return packets for outbound requests are blocked unless an explicit inbound rule exists.

Outbound client traffic uses random high-numbered ephemeral ports as source ports and port 443 as the destination port; return traffic reverses these roles.

Formulate the inbound transport layer rule

Define an inbound rule matching TCP traffic from remote source port 443 to destination subnet

10.200.15.0/24

on destination ephemeral ports (

1024

65535

This explicitly opens the return path for HTTPS web server replies to client browsers.

Apply connection flag safety controls

Append the `established` keyword to the inbound TCP permit rule.

This restricts the rule to match packets with ACK or RST control bits set, preventing external actors from initiating new inbound TCP SYN connections on those ports.

Anahtar Kavram

Stateless ACL Return Traffic Handling and Established TCP Filtering

Tahmini Süre:1m 30s

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru