JN0-102 · Question #123
A Telnet session is initiated from host 10.1.1.1. What will happen when it is processed by the firewall filter shown in the exhibit? firewall { filter select-telnet { term 1 { from { source-address…
The correct answer is A. The packet will be accepted and logged. A Telnet packet from 10.1.1.1 will match term 1 and be logged, then it will match term 3 (which is more specific) and be accepted and sampled.
Question
A Telnet session is initiated from host 10.1.1.1. What will happen when it is processed by the firewall filter shown in the exhibit? firewall { filter select-telnet { term 1 { from { source-address { 10.0.0.0/8; } } then log; } term 2 { from { protocoltcp; port telnet; } then { syslog; reject; } } term 3 { from { source-address { 10.1.1.1/32; } protocoltcp; port telnet; } then { sample; accept; } } } }
Options
- AThe packet will be accepted and logged.
- BThe packet will be discarded and logged.
- CThe packet will be rejected and a syslog message generated.
- DThe packet will be accepted and sampled.
How the community answered
(60 responses)- A82% (49)
- B12% (7)
- C5% (3)
- D2% (1)
Why each option
A Telnet packet from 10.1.1.1 will match `term 1` and be logged, then it will match `term 3` (which is more specific) and be accepted and sampled.
When a Telnet session from 10.1.1.1 is processed, it first matches `term 1` (10.1.1.1/32 is within 10.0.0.0/8), and the `log` action is executed, with packet processing continuing. Then, it specifically matches `term 3` due to its source address, protocol, and port. The actions for `term 3` are `sample` and `accept`. Since `log` is a non-terminating action, the packet is both logged by `term 1` and subsequently accepted by `term 3`.
The packet is explicitly accepted by `term 3` and therefore not discarded.
Although `term 2` matches the protocol and port, `term 3` is a more specific match that also includes the source address 10.1.1.1/32. Junos processes terms sequentially; since `term 1` has a non-terminating `log` action, evaluation proceeds to `term 3`, which has a terminating `accept` action, thus overriding any potential rejection from `term 2` if it were the final match.
While the packet is sampled and accepted by `term 3`, it is also logged by `term 1`, so this option is incomplete.
Concept tested: Junos firewall filter term evaluation
Source: https://www.juniper.net/documentation/us/en/software/junos/firewall-security/topics/topic-map/firewall-filter-overview.html
Topics
Community Discussion
No community discussion yet for this question.