Examkin

Soru

Zorluk: OrtaTroubleshooting Routing, Default Gateways, and ACLs

A network administrator is troubleshooting an issue where servers on VLAN 40 (subnet 172.20.40.0/24) can successfully synchronize time with an internal NTP server (192.168.1.50), but fail to retrieve software updates from an HTTP repository located on the same server (192.168.1.50:80).

Inspection of the router's inbound ACL on the VLAN 40 interface reveals the following configuration:

ip access-list extended VLAN40_IN
10 permit tcp 172.20.40.0 0.0.0.255 host 192.168.1.50 eq 443
20 permit udp 172.20.40.0 0.0.0.255 host 192.168.1.50 eq 123

Which of the following TWO statements correctly identify the root cause of the failure and the necessary corrective action? (Select TWO.)

  1. HTTP traffic on TCP port 80 is denied because it matches the unwritten implicit deny rule at the end of the access control list.Cevap
  2. A new entry explicitly permitting TCP port 80 traffic from the 172.20.40.0/24 network to 192.168.1.50 must be appended to the access control list.Cevap
  3. C
    The default gateway on the VLAN 40 hosts must be changed to 192.168.1.50 to bypass Layer 3 access list filtering.
  4. D
    Rule 10 permits HTTP requests because HTTPS on port 443 automatically handles unencrypted TCP port 80 traffic.

Cevap

HTTP traffic on TCP port 80 is denied by the implicit deny rule at the end of the access control list, and adding an explicit rule permitting TCP port 80 traffic from 172.20.40.0/24 to 192.168.1.50 resolves the issue.
Access Control Lists process traffic sequentially and evaluate unmatched traffic against an unwritten implicit deny all statement. Because the ACL only permits TCP port 443 and UDP port 123, HTTP traffic destined for TCP port 80 is implicitly blocked. To permit HTTP updates, an administrator must add an explicit permit rule for TCP port 80.

Adım Adım Çözüm

1
Analyze the Access Control List entries against the application layer ports in use.
Rule 10 explicitly permits TCP port 443 (HTTPS) and rule 20 permits UDP port 123 (NTP). The repository application relies on unencrypted HTTP (TCP port 80).
Traffic directed to TCP port 80 does not match any explicit permit rule in the access control list.
2
Evaluate the implicit behavior of standard and extended Access Control Lists.
Traffic not explicitly permitted by an earlier rule hits the unwritten implicit deny statement at the bottom of the ACL and is dropped.
This explains why NTP traffic (port 123) succeeds while HTTP traffic (port 80) is dropped.
3
Formulate the required configuration change to resolve the connectivity issue.
Add an explicit permit rule for TCP port 80 from source subnet 172.20.40.0/24 to destination host 192.168.1.50.
An explicit permit statement takes precedence over the implicit deny rule for HTTP requests.

Anahtar Kavram

Troubleshooting Access Control Lists (ACLs) and Implicit Deny Behavior
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Troubleshooting Routing, Default Gateways, and ACLs

Bu konudan daha fazla soru