Network Design and Operations
An ACL that checks incoming packets from the top is applied to a router interface. Rule 1 is "permit traffic to TCP port 443 on 10.0.0.10," rule 2 is "deny all traffic from source 192.168.1.0/24," and rule 3 is "permit traffic from source 192.168.0.0/16 to TCP port 80"; there are no other rules. Of the four packets (i) "from 192.168.1.5 to TCP port 443 on 10.0.0.10," (ii) "from 192.168.1.5 to TCP port 80 on 10.0.0.20," (iii) "from 192.168.2.5 to TCP port 80 on 10.0.0.20" and (iv) "from 192.168.2.5 to TCP port 22 on 10.0.0.20," which choice lists all the packets that are let through?
- A(i) and (iii)
- B(i), (ii) and (iii)
- C(i), (iii) and (iv)
Show answer and explanation
Answer: A. (i) and (iii)
An ACL compares a packet with the rules from the top, decides to permit or deny it by the first rule that matches, and does not look at any later rules. A packet that matches no rule is discarded by an invisible "deny all" rule at the end (the implicit deny). Packet (i) matches rule 1 and is permitted. Packet (ii) also fits rule 3, but it matches rule 2 (source 192.168.1.0/24) first and is denied. Packet (iii) matches neither rule 1 nor rule 2 and is permitted by rule 3, and packet (iv) matches no rule and is discarded by the implicit deny.
- A. Correct. (i) is permitted by rule 1 and (iii) by rule 3; (ii) is dropped by rule 2 and (iv) by the implicit deny.
- B. (ii) matches rule 2 before rule 3, so it is denied. Rules are checked from the top, and the first match decides.
- C. (iv) matches no rule. Packets that match no rule are discarded by the implicit deny.