312-50V13 · Question #349
The security administrator of ABC needs to permit Internet traffic in the host 10.0.0.2 and UDP traffic in the host 10.0.0.3. He also needs to permit all FTP traffic to the rest of the network and…
The correct answer is B. The first ACL is denying all TCP traffic and the other ACLs are being ignored by the router. The initial Access Control List (ACL) rule access-list 102 deny tcp any any globally denies all TCP traffic, causing all subsequent TCP permit rules for FTP and web access to be ignored.
Question
Options
- AThe ACL 104 needs to be first because is UDP
- BThe first ACL is denying all TCP traffic and the other ACLs are being ignored by the router
- CThe ACL for FTP must be before the ACL 110
- DThe ACL 110 needs to be changed to port 80
How the community answered
(20 responses)- A10% (2)
- B70% (14)
- C15% (3)
- D5% (1)
Why each option
The initial Access Control List (ACL) rule `access-list 102 deny tcp any any` globally denies all TCP traffic, causing all subsequent TCP permit rules for FTP and web access to be ignored.
The order of ACLs primarily matters when specific rules could be overshadowed by more general rules later on; however, a broad `deny tcp any any` at the very beginning will block all TCP traffic regardless of subsequent permit rules for that protocol. UDP traffic is handled by a separate protocol and ACLs.
Access Control Lists are processed in sequential order. The first rule, `access-list 102 deny tcp any any`, explicitly denies all TCP traffic from any source to any destination. Due to this global denial, any subsequent ACL rules that attempt to permit specific TCP traffic, such as FTP or WWW, will never be evaluated, resulting in the reported access issues.
While the order of specific permit rules can be important for granular control, the overarching problem here is the initial blanket denial of all TCP traffic, rendering any order of subsequent TCP permit rules irrelevant.
Changing `eq www` to `eq 80` would not resolve the issue because 'www' is the well-known port alias for port 80, making them functionally equivalent, and the primary problem is the initial `deny tcp any any` rule blocking all TCP traffic.
Concept tested: Cisco ACL processing order and implicit deny
Source: https://www.cisco.com/c/en/us/support/docs/security/ios-firewall/23602-confaccesslists.html
Topics
Community Discussion
No community discussion yet for this question.