A network administrator applies the following extended Access Control List (ACL) to the inbound direction of interface GigabitEthernet0/1 on a branch router to allow subnet `192.168.50.0/24` access to a web server at `10.10.20.100`:
text
Router# show access-lists 105
Extended IP access list 105
10 permit tcp 192.168.50.0 0.0.0.255 host 10.10.20.100 eq 443
20 permit tcp 192.168.50.0 0.0.0.255 host 10.10.20.100 eq 80
Immediately after applying this ACL, workstations on the `192.168.50.0/24` subnet report that they can no longer reach external internet sites or perform domain name resolution via the internal DNS server at `10.10.10.5`. Which of the following best explains the root cause of this connectivity failure?
- The implicit deny statement at the end of the ACL is dropping all unpermitted traffic, including DNS requests and traffic destined for external subnets.Cevap
- BApplying an access list to a router interface automatically removes the interface's IP configuration and invalidates the default gateway for the subnet.
- CThe workstations and the router's GigabitEthernet0/1 interface are on different subnets, preventing default gateway ARP resolution.
- DHTTP and HTTPS protocols operate over UDP, so the TCP permit statements failed to match the web traffic.
Cevap
The implicit deny rule at the end of the Access Control List filters out all traffic not explicitly permitted, blocking DNS resolution (UDP 53) and general outbound IP routing.
In network security configurations, Access Control Lists contain an unwritten implicit deny all rule (`deny ip any any`) at the end of the rule list. When only HTTP and HTTPS traffic to a specific destination host are permitted, all other IP traffic—including DNS requests (UDP port 53) and traffic routed to the default gateway for external networks—hits the implicit deny and is discarded.
Adım Adım Çözüm
Anahtar Kavram
Access Control List Implicit Deny Behavior
Tahmini Süre:1m 30s