A network administrator needs to construct an inbound IPv4 extended Access Control List (ACL) on a gateway router to secure an internal server subnet (). The security policy requires allowing administrative SSH access from host , allowing web HTTPS traffic from the internal workstation subnet (), blocking all other traffic originating from subnet , and permitting traffic from all other internal subnets. Place the following ACL statement descriptions in the correct sequence from top to bottom (first matching rule to last).
- 1Permit TCP traffic from host destined to host on destination port 22 (SSH)
- 2Permit TCP traffic from subnet destined to subnet on destination port 443 (HTTPS)
- 3Deny IP traffic from subnet destined to subnet
- 4Permit IP traffic from any source to any destination
Cevap
The correct order from top to bottom is: 1) Permit TCP from host 192.168.1.50 to host 10.20.30.5 port 22; 2) Permit TCP from subnet 192.168.1.0/24 to subnet 10.20.30.0/24 port 443; 3) Deny IP from subnet 192.168.1.0/24 to subnet 10.20.30.0/24; 4) Permit IP from any to any.
ACL entries operate on a top-down, first-match logic. The correct sequence starts with the most specific match criteria (individual host SSH access), followed by broader protocol permissions for the subnet (HTTPS), then the broad subnet deny statement, and finally a permit statement for all remaining subnet traffic.
Adım Adım Çözüm
Anahtar Kavram
ACL Sequential Evaluation and Shadowing Prevention
Tahmini Süre:1m 30s