300-410 · Question #100
Which traffic does the following configuration allow? ipv6 access-list cisco permit ipv6 host 2001:DB8:0:4::32 any eq ssh !vty 0 4 ipv6 access-class cisco in
The correct answer is C. only ssh traffic to vty 0 4 from source 2001:DB8:0:4::32. The IPv6 access-list configured here specifically allows only SSH traffic from a single, defined IPv6 host to access the VTY lines when applied inbound.
Question
Exhibit
Options
- Aall traffic to vty 0 4 from source 2001:DB8:0:4::32
- Bonly ssh traffic to vty 0 4 from source all
- Conly ssh traffic to vty 0 4 from source 2001:DB8:0:4::32
- Dall traffic to vty 0 4 from source all
How the community answered
(32 responses)- A3% (1)
- B16% (5)
- C75% (24)
- D6% (2)
Why each option
The IPv6 access-list configured here specifically allows only SSH traffic from a single, defined IPv6 host to access the VTY lines when applied inbound.
The access-list explicitly filters for `eq ssh`, meaning only SSH traffic is permitted, not all traffic.
The access-list specifies `host 2001:DB8:0:4::32` as the source, not 'source all', limiting it to a single host.
The `permit ipv6 host 2001:DB8:0:4::32 any eq ssh` line in the access-list specifies that only traffic using the SSH protocol (TCP port 22) is allowed, originating exclusively from the IPv6 host 2001:DB8:0:4::32. When `ipv6 access-class cisco in` is applied to VTY lines, it filters incoming connections to those virtual terminal interfaces according to these rules.
The access-list limits both the source to a specific host and the protocol to SSH, so 'all traffic' and 'source all' are incorrect.
Concept tested: IPv6 access-list for VTY lines
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_acl/configuration/xe-16/ipv6-acl-xe-16-book/ipv6-acl-cfg.html
Topics
Community Discussion
No community discussion yet for this question.