Volume 2 - Chapter 8: Applied IP ACLs Flashcards
A network engineer wants create an ACE entry to match the following:
* Permit Rule
* Traffic from 10.0.0.0 /8 subnets to any other subnet
* Permit only echo request messages
* Line 50
What would be the required command to implement this in a named extended ACL?
50 permit icmp 10.0.0.0 0.0.0.255 any echo
A network engineer wants create an ACE entry to match the following:
* Permit Rule
* Traffic from 10.0.0.0 /8 subnets to subnet 172.23.22.0 /23
* Permit both echo request and reply messages
* Line 50
What would be the required command to implement this in a named extended ACL?
50 permit icmp 10.0.0.0 0.0.0.255 172.23.22.0 0.0.1.255 echo
60 permit icmp 10.0.0.0 0.0.0.255 172.23.22.0 0.0.1.255 echo-reply
True or False:
OSPF message packets can only be filtered by inbound ACLs
True, routers do not forward OSPF packets.
A network engineer wants create an ACE entry on Router to match the following:
* Permit OSPF messages from Router 1 (172.19.2.6)
* Deny OSPF messages from all other routers
* Permit both echo request and reply messages from any other router
* Start at line 50
What would be the required command to implement this in a named extended ACL?
50 permit ospf host 172.19.2.6 any
60 deny ospf any any
70 permit icmp any any
PC1 is connected directly to Router 1 which acts as a DHCP relay server
What are the source and destination ports before and after the relay forwards the request?
PC1 will send a segment with a source port of 68 and a destination port of 67
Router 1 will receive the request and forward it to its configured DHCP server with a source and destination port of 67
PC1 is connected directly to Router 1 which acts as a DHCP relay server to Server 1
What are the source and destination IPs before and after the relay forwards the request?
PC1 will send a segment with a source IP of 0.0.0.0 and a destination IP of 255.255.255.255
Router 1 will receive the request and forward it to its configured DHCP server with the following:
* Source IP: Router 1’s outgoing interface
* Destination IP: Server 1’s IP address
True or False:
DHCP request IP being changed by a router due to a configured ip helper bypass any outgoing ACL.
True, an outgoing ACL on a router’s interface will not prevent it from forwarding a DHCP request.
Describe how ACLs function with routers that are configured as DHCP relays.
A router will process any inbound ACLs before modifying the IP source/destination information DHCP packet before forwarding it off.
A network engineer wants create an ACE entry on Router to match the following:
* Permit any source IP to ports 40 to 50
* Destination of any 192.168.x.x network
* Start at line 450
What would be the required command to implement this in a named extended ACL?
450 permit ip any 192.168.0.0. 0.0.255.255 range 40 50
What are the commands to apply an access-class to all VTY lines with the following?:
* Match inbound
* Name of access-classs is SSH-PERMIT
line vty 0 15
access-class SSH-PERMIT in
What are the commands to configure an access-class to all VTY lines with the following?:
* Match outbound
* Name of access-classs is SSH-DENY
* Deny all destination IPs
* Use line 15
ip access-list SSH-DENY
15 deny any
line vty 0 15
access-class SSH-DENY out
What are the commands to configure an access-class to all VTY lines with the following?:
* Match inbound
* Name of access-classs is SSH-PROTECT
* Permit all class A private networks
* Deny all class B private networks
* Permit all private class C networks
* Start at line 20, incrementing by 10
ip access-list SSH-PROTECT
20 permit 10.0.0.0 0.255.255.255
30 deny 172.16.0.0 0.240.255.255
40 deny 192.168.0.0 0.0.255.255
line vty 0 15
access-class SSH-PROTECT in
A network technician configures an access-list with the following commands:
ip access-list extended my-acl
permit tcp 192.168.144.128 0.0.0.240 any
deny tcp 10.0.0.0 0.255.255.255 any eq telnet
What will be the default sequence numbers assigned to each ACE entry?
“show access-list my-acl” provides the following output:
10 permit tcp 192.168.144.128 0.0.0.240
20 deny tcp 10.0.0.0 0.255.255.255 any eq telnet
Describe how ACL persistance differs between IOS and IOS-XE.
With IOS, ACEs are automatically resequenced by 10 after every reload
IOS-XE has ACL persistance on by default and needs to be disabled to allow for automatic ACE resequencing on a reload.
What is the command to disable ACL persistance on an IOS-XE router?
no ip access-list persistent
A network technician configures an access-list with the following commands:
ip access-list extended my-acl
10 permit tcp 192.168.0.0 0.0.255.255 any
20 permit udp 192.168.0.0 0.0.255.255 any
50 permit tcp 10.222.50 0.0.0.255 any
60 permit udp 10.222.50 0.0.0.255 any
100 deny tcp 10.0.0.0 0.255.255.255 any eq telnet
What will the sequence numbers be for each ACE after the IOS router is reloaded?
ip access-list extended my-acl
10 permit tcp 192.168.0.0 0.0.255.255 any
20 permit udp 192.168.0.0 0.0.255.255 any
30 permit tcp 10.222.50 0.0.0.255 any
40 permit udp 10.222.50 0.0.0.255 any
50 deny tcp 10.0.0.0 0.255.255.255 any eq telnet
A network technician configures an access-list with the following commands:
ip access-list extended my-acl
10 permit tcp 192.168.0.0 0.0.255.255 any
20 permit udp 192.168.0.0 0.0.255.255 any
30 permit tcp 10.222.50 0.0.0.255 any
What is the correct command to resequence the ACL by adding an increment of 30 between each ACE?
ip access-list resequence my-acl 10 30
Describe the function of common and regular ACLs in IOS-XE.
IOS-XE allows 2 ACLs to enabled in the same direction on the same interface: the common and regular ACLs.
The common ACL is matched first, and if nothing is found, the regular ACL is matched afterwards
What is the command to apply common access-list to interface Gi0/0/1 with the following parameters:
* Match inbound
* Common ACL: my-com-acl
* Regular ACL: my-acl
interface Gi0/0/1
ip access-group common my-com-acl my-acl in
What is the command to add an ACE entry to an access-list that matches the following:
* Permit any source address and port
* Permit TCP only
* Permit only 192.168.0.0 /16 as the destination
* Match these destination ports: 5, 10, 12, and 20
permit tcp any 192.168.0.0 0.0.255.255 eq 5 10 12 20
