Soru

Zorluk: OrtaFirewalls and Access Control Lists (ACLs)

A network administrator needs to construct an inbound IPv4 extended Access Control List (ACL) on a gateway router to secure an internal server subnet (10.20.30.0/2410.20.30.0/24). The security policy requires allowing administrative SSH access from host 192.168.1.50192.168.1.50, allowing web HTTPS traffic from the internal workstation subnet (192.168.1.0/24192.168.1.0/24), blocking all other traffic originating from subnet 192.168.1.0/24192.168.1.0/24, and permitting traffic from all other internal subnets. Place the following ACL statement descriptions in the correct sequence from top to bottom (first matching rule to last).

  1. 1Permit TCP traffic from host 192.168.1.50192.168.1.50 destined to host 10.20.30.510.20.30.5 on destination port 22 (SSH)
  2. 2Permit TCP traffic from subnet 192.168.1.0/24192.168.1.0/24 destined to subnet 10.20.30.0/2410.20.30.0/24 on destination port 443 (HTTPS)
  3. 3Deny IP traffic from subnet 192.168.1.0/24192.168.1.0/24 destined to subnet 10.20.30.0/2410.20.30.0/24
  4. 4Permit IP traffic from any source to any destination

Cevap

The correct order from top to bottom is: 1) Permit TCP from host 192.168.1.50 to host 10.20.30.5 port 22; 2) Permit TCP from subnet 192.168.1.0/24 to subnet 10.20.30.0/24 port 443; 3) Deny IP from subnet 192.168.1.0/24 to subnet 10.20.30.0/24; 4) Permit IP from any to any.
ACL entries operate on a top-down, first-match logic. The correct sequence starts with the most specific match criteria (individual host SSH access), followed by broader protocol permissions for the subnet (HTTPS), then the broad subnet deny statement, and finally a permit statement for all remaining subnet traffic.

Adım Adım Çözüm

1
Identify the most specific rule
Host-specific rule permitting SSH (TCP port 22) from 192.168.1.50192.168.1.50 to 10.20.30.510.20.30.5
ACLs process rules sequentially from top to bottom. Specific single-host rules must precede broader subnet rules to prevent rule shadowing.
2
Place specific protocol/port permissions for the source subnet
Subnet rule permitting HTTPS (TCP port 443) from 192.168.1.0/24192.168.1.0/24 to 10.20.30.0/2410.20.30.0/24
HTTPS permission must occur before blocking the rest of subnet 192.168.1.0/24192.168.1.0/24 traffic.
3
Apply broad denial for the specific source subnet
Rule denying all IP traffic from subnet 192.168.1.0/24192.168.1.0/24 to 10.20.30.0/2410.20.30.0/24
This drops any non-HTTPS traffic from subnet 192.168.1.0/24192.168.1.0/24 while preserving access permitted in earlier steps.
4
Permit remaining subnets
Rule permitting IP traffic from any source to any destination
This allows traffic from other network subnets to reach the server network, overriding the implicit deny any rule at the end of the ACL.

Anahtar Kavram

ACL Sequential Evaluation and Shadowing Prevention
Tahmini Süre:1m 30s
Bu soruyu puanla