HPE6-A78 · Question #83

A client is connected to a Mobility Controller (MC). These firewall rules apply to this client's role: ipv4 any any svc-dhcp permit ipv4 user 10.5.5.20 svc-dns permit ipv4 user 10.1.5.0…

The correct answer is D. The first packet is denied, and the second is permitted. In an HPE Aruba Networking AOS-8 Mobility Controller (MC), firewall rules are applied based on the user role assigned to a client. The rules are evaluated in order, and the first matching rule determines the action (permit or deny) for the packet. The client's role has the…

Implementing and Configuring Aruba Network Security

Question

A client is connected to a Mobility Controller (MC). These firewall rules apply to this client's role:

ipv4 any any svc-dhcp permit ipv4 user 10.5.5.20 svc-dns permit ipv4 user 10.1.5.0 255.255.255.0 https permit ipv4 user 10.1.0.0 255.255.0.0 https deny_opt ipv4 user any any permit What correctly describes how the controller treats HTTPS packets to these two IP addresses, 10.1.20.1 and 10.5.5.20 both of which are on the other side of the firewall?

Options

ABoth packets are denied.
BThe first packet is permitted, and the second is denied.
CBoth packets are permitted.
DThe first packet is denied, and the second is permitted.

How the community answered

(53 responses)

A
17% (9)
B
8% (4)
C
6% (3)
D
70% (37)

Explanation

In an HPE Aruba Networking AOS-8 Mobility Controller (MC), firewall rules are applied based on the user role assigned to a client. The rules are evaluated in order, and the first matching rule determines the action (permit or deny) for the packet. The client's role has the following firewall ipv4 any any svc-dhcp permit: Permits DHCP traffic (UDP ports 67 and 68) from any source to any destination. ipv4 user 10.5.5.20 svc-dns permit: Permits DNS traffic (UDP port 53) from the user to the IP address 10.5.5.20. ipv4 user 10.1.5.0 255.255.255.0 https permit: Permits HTTPS traffic (TCP port 443) from the user to the subnet 10.1.5.0/24. ipv4 user 10.1.0.0 255.255.0.0 https deny_opt: Denies HTTPS traffic from the user to the subnet 10.1.0.0/16, with the deny_opt action (which typically means deny with an optimized action, such as dropping the packet without logging). ipv4 user any any permit: Permits all other traffic from the user to any destination. The question asks how the MC treats HTTPS packets (TCP port 443) to two IP addresses: 10.1.20.1 and HTTPS packet to 10.1.20.1: Rule 1: Does not match (traffic is HTTPS, not DHCP). Rule 2: Does not match (destination is 10.1.20.1, not 10.5.5.20; traffic is HTTPS, not DNS). Rule 3: Does not match (destination 10.1.20.1 is not in the subnet 10.1.5.0/24). Rule 4: Matches (destination 10.1.20.1 is in the subnet 10.1.0.0/16, and traffic is HTTPS). The action is deny_opt, so the packet is denied. HTTPS packet to 10.5.5.20: Rule 1: Does not match (traffic is HTTPS, not DHCP). Rule 2: Does not match (traffic is HTTPS, not DNS). Rule 3: Does not match (destination 10.5.5.20 is not in the subnet 10.1.5.0/24). Rule 4: Does not match (destination 10.5.5.20 is not in the subnet 10.1.0.0/16). Rule 5: Matches (catches all other traffic). The action is permit, so the packet is permitted. Therefore, the HTTPS packet to 10.1.20.1 is denied, and the HTTPS packet to 10.5.5.20 is permitted.

Topics

#firewall policy#ACL rule order#role-based access#packet filtering

Community Discussion

No community discussion yet for this question.

Full HPE6-A78 Practice