Soru

Zorluk: OrtaTroubleshooting Routing, Default Gateways, and ACLs

A network administrator is troubleshooting remote administration access to an edge router (172.28.10.1172.28.10.1). Systems engineers on the management network (10.40.8.0/2410.40.8.0/24) report that ping requests to the router succeed, but SSH connections to port 22 time out. Upon inspecting the router interface's inbound Access Control List (ACL), the administrator reviews the following entries:

access-list 105 permit icmp 10.40.8.0 0.0.0.255 any
access-list 105 permit udp 10.40.8.0 0.0.0.255 host 172.28.10.1 eq 22
access-list 105 deny ip any any

Which of the following is the root cause preventing SSH access to the router?

  1. The ACL rule specifies UDP port 22 instead of TCP port 22, causing SSH traffic to match the deny rule.Cevap
  2. B
    The ACL rule permits ICMP traffic, which automatically overrides TCP and UDP traffic on the same interface.
  3. C
    The management workstations and the router reside on different IP subnets without a VLAN trunk.
  4. D
    The workstations require a direct Layer 2 broadcast domain connection to establish SSH management sessions.

Cevap

The ACL rule specifies UDP port 22 instead of TCP port 22, causing incoming SSH packets to be dropped by the final deny statement.
SSH utilizes TCP as its transport protocol on port 22. The configured ACL rule permits UDP port 22, causing TCP SSH initiation packets to skip the permit statement and trigger the subsequent explicit deny rule.

Adım Adım Çözüm

1
Analyze transport protocol requirements for SSH
SSH requires TCP port 22 for reliable stream-oriented communication.
Identifying the required Layer 4 protocol is essential for auditing firewalls and access lists.
2
Compare required protocol against ACL line 20
ACL line 20 permits 'udp' port 22 instead of 'tcp'.
Since SSH uses TCP, incoming TCP SYN packets for port 22 fail to match line 20.
3
Trace packet execution through the remainder of the ACL
Packets fall through to line 30 ('deny ip any any') and are dropped.
Traffic that does not match preceding permit entries is evaluated against subsequent deny rules.

Anahtar Kavram

ACL Transport Protocol Matching (TCP vs UDP)
Tahmini Süre:1m 30s
Bu soruyu puanla