Soru

Zorluk: OrtaTroubleshooting Routing, Default Gateways, and ACLs

A system administrator is troubleshooting a database connection failure from a newly deployed application host (`10.150.12.45/24`) to an enterprise database server (`172.28.100.50`). The application requires TCP port 5432 (PostgreSQL). The administrator executes diagnostic commands on the host and the intermediary router:

Host CLI Output (`ip route` & `ip addr`):
text eth0: inet 10.150.12.45/24 brd 10.150.12.255 scope global eth0 default via 10.150.13.1 dev eth0

Router ACL Output (`show ip access-lists OUTBOUND_DB`):
text Extended IP access list OUTBOUND_DB 10 permit tcp 10.150.12.0 0.0.0.255 host 172.28.100.50 eq 3306 20 deny ip any any

Based on the diagnostic output, which TWO factors are directly preventing the application host from communicating with the database server?

  1. The default gateway IP address configured on the host resides in a different IPv4 subnet than the host's primary interface.Cevap
  2. The active router Access Control List only permits MySQL traffic (TCP 3306) and relies on an explicit deny rule that blocks PostgreSQL traffic (TCP 5432).Cevap
  3. C
    The host cannot reach external IP addresses because its primary interface requires a public IPv4 broadcast address instead of 10.150.12.25510.150.12.255.
  4. D
    PostgreSQL database traffic operates exclusively over UDP port 5432, causing a protocol mismatch when attempting TCP connections.

Cevap

The connection failure is caused by a default gateway configured on a different IP subnet than the host interface, and an ACL rule that permits TCP 3306 while blocking TCP 5432.
First, the host IP 10.150.12.45/2410.150.12.45/24 resides in the 10.150.12.0/2410.150.12.0/24 network segment, while its configured gateway (10.150.13.110.150.13.1) is in 10.150.13.0/2410.150.13.0/24, preventing local ARP resolution and off-subnet forwarding. Second, the router ACL explicitly permits TCP port 3306 (MySQL) but denies all other traffic via Rule 20, blocking the application's PostgreSQL traffic on TCP port 5432.

Adım Adım Çözüm

1
Analyze the host network configuration.
The interface address is 10.150.12.45/2410.150.12.45/24, placing valid host IPs in 10.150.12.110.150.12.1 through 10.150.12.25410.150.12.254. The gateway 10.150.13.110.150.13.1 is outside this subnet, preventing ARP resolution for outbound packets.
A host must have a default gateway within its local IP subnet boundaries.
2
Analyze the router Access Control List rules.
Rule 10 specifically matches TCP port 3306. PostgreSQL traffic on TCP port 5432 is not matched by Rule 10 and is dropped by Rule 20.
ACLs evaluate traffic sequentially against entries; unmatched traffic falls through to subsequent rules or implicit deny rules.

Anahtar Kavram

Troubleshooting Gateway Subnet Alignment and ACL Rule Matching
Bu soruyu puanla