Questions? Call 1.800.716.8955

Chapter 30

Access Control Lists

Exam topics covered

5.6 Configure and verify access control lists

Foundation. An access control list (ACL) is an ordered list of permit and deny statements that a router uses to classify packets. Applied to an interface, an ACL becomes a packet filter: the simplest firewall there is, and still the most common security tool on Cisco routers. ACLs are also used to select traffic for other features, such as NAT, QoS, VTY access and route filtering, so the matching logic you learn here appears throughout the book. This chapter covers how ACLs are processed, wildcard masks (practise these until they are automatic), standard and extended ACLs in numbered and named form, where to place them, how to edit and verify them, and IPv6 ACLs in brief. It finishes with scenario exercises and a lab.

30.1 How an ACL Is Processed

Every ACL is processed the same way, and three rules explain almost every exam question about ACL behaviour:

  • 1. Top-down, sequential: the router compares the packet with each statement (access control entry, ACE) in order, starting at the top.
  • 2. First match wins: as soon as a statement matches, the router takes its action (permit or deny) and stops. Later statements are never examined, even if they would also match.
  • 3. Implicit deny: every ACL ends with an invisible deny any (for extended ACLs, deny ip any any ). A packet that matches no statement is dropped. An ACL that contains only deny statements therefore blocks everything.

Two consequences follow. First, order matters: put specific statements before general ones. If a permit 10.1.1.0 0.0.0.255 comes before deny host 10.1.1.10 , the deny is never reached. Second, every ACL needs at least one permit unless you really intend to block all traffic. Packet arrives

ACL applied in

this direction?

  • no
  • Forward
  • yes
  • Compare with next ACE

Match?

yes

Permit?

  • yes
  • no
  • Drop
  • More no

ACEs?

Figure 30-1 ACL processing: top-down, first match wins, implicit deny at the end.

30.1.1 Direction and the one-ACL rule

An ACL does nothing until it is applied. On an interface you apply it inbound (packets arriving on the interface, checked before the routing decision) or outbound (packets leaving the interface, checked after routing). Direction is always from the router's point of view. You can apply at most one ACL per interface, per direction, per protocol: one IPv4 ACL in, one IPv4 ACL out, plus one IPv6 ACL in and one out. Applying a second IPv4 ACL in the same direction replaces the first.

R1

G0/0 G0/2

G0/0 in g0/2 out

G0/0 out g0/2 in

Inbound is checked before routing; outbound after routing. Direction is from the router's view.

Figure 30-2 PC-to-server traffic can be filtered G0/0 in or G0/2 out; replies, G0/2 in or G0/0 out.

Packets generated by the router itself (for example its own OSPF hellos or pings) are not filtered by an outbound ACL on that router. An inbound ACL, however, does filter routing protocol packets arriving from neighbours, which is a common way to break OSPF by accident.

Exam alert

Remember the trio: top-down, first match, implicit deny. And one ACL per interface, per direction, per protocol. Questions often show an ACL whose permit statement shadows a later deny, or an ACL with only deny statements that blocks everything.

30.2 Wildcard Masks

ACLs identify address ranges with an address and a wildcard mask. Each wildcard bit tells the router how to treat the corresponding address bit:

0 = must match (check this bit).

1 = ignore (don't care what this bit is).

That is the inverse of a subnet mask, so for any prefix the wildcard mask is simply the subnet mask with every bit flipped. The quick way to compute it is to subtract each octet of the subnet mask from 255.

Figure 30-3 A wildcard mask: 0 bits must match, 1 bits are ignored.

30.2.1 Worked examples

Table 30-1 gives a set of conversions, each checked by computing the host mask of the prefix.

Work through them yourself before reading the answer column.

Table 30-1 Wildcard masks for common ranges

  • Goal Subnet mask ACL address and wildcard Range matched
  • One host 10.1.1.10 /32 10.1.1.10 0.0.0.0 or host
  • 10.1.1.10
  • 10.1.1.10 only

192.168.10.0/24 255.255.255.0 192.168.10.0 0.0.0.255 .0 – .255 10.1.0.0/16 255.255.0.0 10.1.0.0 0.0.255.255 10.1.0.0 –

  • 10.1.255.255
  • 172.16.4.0/22 255.255.252.0 172.16.4.0 0.0.3.255 172.16.4.0 –
  • 172.16.7.255

172.20.32.0/19 255.255.224.0 172.20.32.0 0.0.31.255 172.20.32.0 – 172.20.63.255

10.10.10.64/26 255.255.255.192 10.10.10.64 0.0.0.63 .64 – .127 192.168.1.32/27 255.255.255.224 192.168.1.32 0.0.0.31 .32 – .63 192.168.100.128/25 255.255.255.128 192.168.100.128 0.0.0.127 .128 – .255 10.0.0.8/30 (point-to-point)255.255.255.252 10.0.0.8 0.0.0.3 .8 – .11 Everything /0 0.0.0.0 255.255.255.255 or

any

all addresses

Going the other way. Given an ACE, find the range by adding the wildcard to the address. 10.1.16.0 0.0.15.255 matches 10.1.16.0 through 10.1.(16+15).255 = 10.1.31.255. Does 10.1.17.5 match? Yes, because 17 is within 16–31. Does 172.16.8.1 match 172.16.4.0 0.0.3.255 ? No: the range ends at 172.16.7.255.

Finding the mask for a range. To match 172.16.16.0 through 172.16.31.255, count the third-octet values: 16 of them (a power of two, and 16 is a multiple of 16), so the wildcard octet is 16−1 = 15: 172.16.16.0 0.0.15.255 . If the range does not start on a multiple of its size, a single ACE cannot match it exactly and you need several.

Discontiguous wildcards. Wildcard masks do not have to be contiguous. 192.168.1.1 0.0.0.254 checks only the last bit of the fourth octet, so it matches every odd address in 192.168.1.0/24 (.1, .3, .5 … .255). You will rarely configure this, but you may be asked to interpret it.

Tip

If you enter an address with host bits that the wildcard ignores, such as access-list 1 permit 10.1.1.5 0.0.0.255 , IOS silently converts it to 10.1.1.0 0.0.0.255 . The ACL still works; just do not be surprised when show running-config differs from what you typed.

30.3 Standard ACLs

A standard ACL matches on one thing only: the source IPv4 address. It is simple, but because it cannot see the destination or the application, it must be placed carefully (section 30.5). Standard numbered ACLs use numbers 1–99 and the expanded range 1300–1999.

30.3.1 Numbered standard ACLs

Each access-list command appends one statement to the end of the list. The host keyword replaces a 0.0.0.0 wildcard and any replaces 0.0.0.0 255.255.255.255. With a standard ACL, an address entered without a wildcard is treated as a host.

Figure 30-4 The topology used for the examples in this chapter.

Using Figure 30-4, suppose only the Engineering subnet and one Sales admin PC (10.1.1.10) may reach the server LAN. Because a standard ACL sees only the source, apply it on R2 outbound toward the servers:

R2(config)# access-list 10 remark Allow Eng and the admin PC to servers
R2(config)# access-list 10 permit host 10.1.1.10
R2(config)# access-list 10 deny 10.1.1.0 0.0.0.255
R2(config)# access-list 10 permit 10.1.2.0 0.0.0.255

! implicit deny any here: all other sources are dropped

R2(config)# interface GigabitEthernet0/1
R2(config-if)# ip access-group 10 out

The host statement must come first; if the deny for 10.1.1.0/24 came first, the admin PC would match it and be dropped. The deny for Sales is actually redundant (implicit deny would catch it) but makes the intent clear.

30.3.2 Named standard ACLs

Named ACLs use a descriptive name instead of a number and are configured in a sub-mode, which makes them easier to read and, as you will see in section 30.6, easier to edit. The same policy as a named ACL:

R2(config)# ip access-list standard SERVER-ACCESS
R2(config-std-nacl)# remark Allow Eng and the admin PC to servers
R2(config-std-nacl)# permit host 10.1.1.10
R2(config-std-nacl)# deny 10.1.1.0 0.0.0.255
R2(config-std-nacl)# permit 10.1.2.0 0.0.0.255
R2(config-std-nacl)# interface GigabitEthernet0/1
R2(config-if)# ip access-group SERVER-ACCESS out

30.3.3 Securing VTY lines with access-class

A standard ACL is the classic way to limit who can SSH to a device. Apply it to the VTY lines with access-class (not ip access-group ). This filters all management sessions regardless of which interface they arrive on.

R1(config)# ip access-list standard MGMT-HOSTS
R1(config-std-nacl)# permit host 10.1.1.10
R1(config-std-nacl)# line vty 0 15
R1(config-line)# access-class MGMT-HOSTS in

30.4 Extended ACLs

An extended ACL can match on the protocol, source address, destination address, and for TCP and UDP the source and destination ports, plus other fields such as TCP flags and DSCP. Extended numbered ACLs use 100–199 and 2000–2699. The general syntax is:

access-list 100-199 {permit|deny} protocol source src-wildcard [operator src-port] destination dst-wildcard [operator dst-port] [established] [log] acc-list 101 permit tcp 10.1.1.0 0.0.0.255 host 10.2.2.100 eq 443 log number/name action protocol source + wildcard destination dest port optional The port operator after the destination matches the destination port (the server's port).

Figure 30-5 Anatomy of an extended ACE.

30.4.1 Protocols, ports and operators

The protocol keyword can be ip (any IPv4 packet), tcp , udp , icmp , ospf , gre , esp or a protocol number. Port numbers can only be matched when the protocol is tcp or udp . A port operator placed after the source matches the source port; placed after the destination, it matches the destination port. Because clients use random high source ports, you almost always match the destination port of the server.

Table 30-2 Port operators and common keywords

  • Operator Meaning Example
  • eq Equal to eq 443 , eq www (80), eq 22
  • neq Not equal to neq 23

gt / lt Greater than / less than (exclusive) gt 1023 = 1024–65535 range Inclusive range range 20 21 (FTP data and

  • control)
  • established TCP segments with ACK or RST set (return
  • traffic of a session)
  • permit tcp any 10.1.0.0
  • 0.0.255.255 established

Common keyword ports: ftp 21, ssh 22, telnet 23, smtp 25, domain 53 (TCP and UDP), bootps 67, tftp 69, www 80, pop3 110, ntp 123, snmp 161, and 443 for HTTPS. Know which are TCP and which are UDP: an ACE such as permit tcp any any eq 69 is wrong because TFTP uses UDP.

30.4.2 Extended ACL examples

Example 1. Sales may browse the web server (HTTP and HTTPS) and ping anything; Sales must not reach any other server port; everything else from Sales to anywhere is allowed. Apply inbound on R1 G0/0, the interface closest to the source:

R1(config)# ip access-list extended SALES-IN
R1(config-ext-nacl)# permit tcp 10.1.1.0 0.0.0.255 host 10.2.2.100 eq www
R1(config-ext-nacl)# permit tcp 10.1.1.0 0.0.0.255 host 10.2.2.100 eq 443
R1(config-ext-nacl)# permit icmp 10.1.1.0 0.0.0.255 any
R1(config-ext-nacl)# deny ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255 log
R1(config-ext-nacl)# permit ip 10.1.1.0 0.0.0.255 any
R1(config-ext-nacl)# interface GigabitEthernet0/0
R1(config-if)# ip access-group SALES-IN in

Example 2. Engineering may use FTP (ports 20–21) and SSH to the server LAN but not Telnet. A numbered version:

R1(config)# access-list 110 permit tcp 10.1.2.0 0.0.0.255 10.2.2.0 0.0.0.255 range 20 21
R1(config)# access-list 110 permit tcp 10.1.2.0 0.0.0.255 10.2.2.0 0.0.0.255 eq 22
R1(config)# access-list 110 deny tcp 10.1.2.0 0.0.0.255 any eq telnet
R1(config)# access-list 110 permit ip 10.1.2.0 0.0.0.255 any
R1(config)# interface GigabitEthernet0/1
R1(config-if)# ip access-group 110 in

Example 3. Allow only return traffic into the LAN from the Internet, plus DNS replies. established matches TCP segments with ACK or RST set, which every segment except the initial SYN has. It is a crude, stateless approximation of a stateful firewall, and the exam likes to test what it matches:

R1(config)# access-list 120 permit tcp any 10.1.0.0 0.0.255.255 established
R1(config)# access-list 120 permit udp any eq domain 10.1.0.0 0.0.255.255 ! source port 53
R1(config)# access-list 120 deny ip any any log

Exam alert

Check every extended ACE for four things: the right protocol (TCP versus UDP), the port on the right side (after the destination for a server port), the correct wildcard, and the correct direction on the correct interface. Numbered ranges: standard 1–99 and 1300–1999; extended 100–199 and 2000–2699.

30.5 Where to Place an ACL

The traditional placement guidelines follow from what each ACL type can see: Extended ACLs: close to the source. Because they can match the destination and application precisely, you can drop unwanted traffic as soon as it enters the network, before it wastes bandwidth on other links, without affecting traffic going elsewhere. Standard ACLs: close to the destination. They match only the source, so placing one near the source would block that source from every destination beyond that point. Placed near the destination, it affects only traffic to the protected network.

Figure 30-6 Placement guidelines: extended ACLs near the source, standard ACLs near the destination.

These are guidelines, not laws. In practice you also consider who administers which router, how many interfaces you would have to touch, and CPU impact. But on the exam, follow them.

30.6 Editing ACLs with Sequence Numbers

Every ACE has a sequence number, by default 10, 20, 30 and so on. In named ACL configuration mode (which also works for numbered ACLs: ip access-list extended 110 ) you can insert a statement between existing ones by giving it a sequence number, and delete a single statement with no plus its sequence number (for example, no 30 ). With the old global access-list command, new lines always go to the end and no access-list 110 deletes the entire list.

R1(config)# ip access-list extended SALES-IN
R1(config-ext-nacl)# 25 permit tcp 10.1.1.0 0.0.0.255 host 10.2.2.100 eq 21 ! insert
between 20 and 30
R1(config-ext-nacl)# exit
R1(config)# ip access-list resequence SALES-IN 10 10 ! renumber 10,

20, 30...

Watch out

Editing an ACL that is applied to an interface takes effect immediately. A safe habit on a remote router is to schedule a rollback ( reload in 10 ) before changing an ACL that could cut off your own session, then reload cancel once you have confirmed access.

30.7 Verifying ACLs

show access-lists (or show ip access-lists ) lists every ACL with its sequence numbers and a match counter for each line. Counters that increase show you which statement is handling the traffic; a line stuck at zero may be shadowed by an earlier, broader line. clear access-list counters resets them for a fresh test.

R1 — console

R1# show access-lists
  • Standard IP access list MGMT-HOSTS
  • 10 permit 10.1.1.10 (14 matches)
  • Extended IP access list 110

10 permit tcp 10.1.2.0 0.0.0.255 10.2.2.0 0.0.0.255 range ftp-data ftp (38 matches) 20 permit tcp 10.1.2.0 0.0.0.255 10.2.2.0 0.0.0.255 eq 22 (211 matches)

  • 30 deny tcp 10.1.2.0 0.0.0.255 any eq telnet (6 matches)
  • 40 permit ip 10.1.2.0 0.0.0.255 any (4471 matches)
  • Extended IP access list SALES-IN

10 permit tcp 10.1.1.0 0.0.0.255 host 10.2.2.100 eq www (1220 matches)

20 permit tcp 10.1.1.0 0.0.0.255 host 10.2.2.100 eq 443 (8834 matches)

30 permit tcp 10.1.1.0 0.0.0.255 host 10.2.2.100 eq ftp

40 permit icmp 10.1.1.0 0.0.0.255 any (52 matches)

50 deny ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255 log (17 matches)

60 permit ip 10.1.1.0 0.0.0.255 any (19306 matches)

Figure 30-7 show access-lists with per-line hit counts. Note that IOS displays well-known ports by keyword. (Output is illustrative of IOS 15 / IOS XE.)

To see where an ACL is applied, use show ip interface (the access list lines are near the top) or filter show running-config . show ip interface is the command that answers “is the ACL applied, and in which direction?”

R1# show ip interface GigabitEthernet0/0
  • GigabitEthernet0/0 is up, line protocol is up
  • Internet address is 10.1.1.1/24
  • Broadcast address is 255.255.255.255
  • Address determined by non-volatile memory
  • MTU is 1500 bytes
  • Helper address is not set
  • Directed broadcast forwarding is disabled
  • Multicast reserved groups joined: 224.0.0.5 224.0.0.6
  • Outgoing Common access list is not set
  • Outgoing access list is not set
  • Inbound Common access list is not set
  • Inbound access list is SALES-IN
  • Proxy ARP is enabled

...

R1# show running-config | include access-group|access-class
ip access-group SALES-IN in
ip access-group 110 in
access-class MGMT-HOSTS in

Figure 30-8 Confirming the ACL and its direction on an interface.

Tip

The log keyword on an ACE generates a syslog message (rate-limited) whenever the line matches, showing source, destination and ports. Add an explicit deny ip any any log at the end of an ACL during troubleshooting so you can see what the implicit deny would otherwise drop silently.

30.8 IPv6 ACLs in Brief

IPv6 ACLs work on the same principles with a few differences:

They are always named, and there is no standard/extended split: every IPv6 ACL can match source, destination, protocol and ports.

Addresses use prefix lengths, not wildcard masks ( 2001:db8:1::/64 ).

They are applied with ipv6 traffic-filter name {in|out} on interfaces and ipv6 access-class on VTY lines. The implicit end of every IPv6 ACL is permit icmp any any nd-na , permit icmp any any nd-ns , deny ipv6 any any . The ND permits keep neighbour discovery working; if you add your own deny ipv6 any any , you block ND too unless you permit it first.

R1(config)# ipv6 access-list V6-SERVERS
R1(config-ipv6-acl)# permit tcp 2001:db8:1:1::/64 host 2001:db8:2:2::100 eq 443
R1(config-ipv6-acl)# deny ipv6 2001:db8:1:1::/64 2001:db8:2:2::/64 log
R1(config-ipv6-acl)# permit ipv6 any any
R1(config-ipv6-acl)# interface GigabitEthernet0/0
R1(config-if)# ipv6 traffic-filter V6-SERVERS in

30.9 Scenario Exercises

Use the topology in Figure 30-4. Write your answer before reading the solution. Scenario 1. Block host 10.1.2.50 from reaching the server LAN using a standard ACL, while all other traffic is unaffected.

Solution. Place it near the destination, on R2 G0/1 outbound:

access-list 20 deny host 10.1.2.50

access-list 20 permit any ! without this, the implicit deny blocks everyone interface GigabitEthernet0/1

ip access-group 20 out

Scenario 2. Engineering must reach the web server only on HTTPS; all other Engineering traffic to 10.2.2.100 is denied; everything else is permitted.

  • Solution. Extended, close to the source, R1 G0/1 inbound:
  • ip access-list extended ENG-WEB
  • permit tcp 10.1.2.0 0.0.0.255 host 10.2.2.100 eq 443
  • deny ip 10.1.2.0 0.0.0.255 host 10.2.2.100
  • permit ip any any
  • interface GigabitEthernet0/1
  • ip access-group ENG-WEB in

Scenario 3. An engineer wrote the following and applied it inbound on R1 G0/0. Sales users report that they can no longer get DHCP addresses or ping their gateway, but web access works. What is wrong?

access-list 150 permit tcp 10.1.1.0 0.0.0.255 any eq www

access-list 150 permit tcp 10.1.1.0 0.0.0.255 any eq 443

Solution. The implicit deny drops everything else, including ICMP and DHCP Discover messages (UDP 67, sent from 0.0.0.0, which does not even match the 10.1.1.0/24 source). Add permit udp any any eq bootps and permit icmp 10.1.1.0 0.0.0.255 any , and whatever else Sales needs (DNS on UDP 53, for example).

Scenario 4. Which single ACE permits hosts 10.1.1.0 through 10.1.1.127 only? Solution. 128 addresses = /25: permit 10.1.1.0 0.0.0.127 .

Scenario 5. Only the admin PC 10.1.1.10 may SSH to R2; everyone else must be refused, regardless of which R2 interface they target.

Solution. access-list 5 permit host 10.1.1.10 , then line vty 0 15 , access-class 5 in , transport input ssh . An interface ACL would need an entry for every R2 address; access-class covers them all. Scenario 6. After an engineer applies ACL 130 inbound on R1 G0/2 to block Telnet from R2's side, the OSPF adjacency with R2 drops and routes to 10.2.2.0/24 disappear. Explain from the output below.

R1 — console

R1# show access-lists 130
  • Extended IP access list 130
  • 10 deny tcp any any eq telnet (3 matches)
  • 20 permit tcp any any (912 matches)
  • 30 permit udp any any (88 matches)
R1#

*Oct 4 11:02:47.118: %OSPF-5-ADJCHG: Process 1, Nbr 2.2.2.2 on GigabitEthernet0/2 from FULL to DOWN, Neighbor Down: Dead timer expired

Figure 30-9 An inbound ACL that silently drops OSPF hellos.

Solution. OSPF is IP protocol 89, neither TCP nor UDP, so its hellos fall through to the implicit deny; ICMP is dropped too. Add permit ospf any any (and permit icmp any any ) before the end of the list, or simply end with permit ip any any since the goal was only to deny Telnet.

LAB Filter traffic between branch LANs

Goal: on the Figure 30-4 topology, (1) allow Sales only HTTP/HTTPS and ping to the server LAN, (2) allow Engineering SSH and FTP but not Telnet to the server LAN, (3) restrict SSH to R1 and R2 to the admin PC, and verify with counters.

Figure 30-10 Lab topology with ACL application points.

Steps:

  • 1. On R1, configure SALES-IN exactly as in Example 1 and apply it inbound on G0/0.
  • 2. On R1, configure ACL 110 as in Example 2 and apply it inbound on G0/1.
  • 3. On R1 and R2, configure the standard ACL MGMT-HOSTS permitting host 10.1.1.10 and apply it with access-class MGMT-HOSTS in on line vty 0 15 .
  • 4. Run clear access-list counters on R1.
  • 5. Test: from a Sales PC browse to http://10.2.2.100 and ping it, then try ssh 10.2.2.100 ; from an Engineering PC try SSH and Telnet to 10.2.2.100; from a non-admin PC try SSH to R1.

Verify:

R1# show ip access-lists SALES-IN

Extended IP access list SALES-IN

10 permit tcp 10.1.1.0 0.0.0.255 host 10.2.2.100 eq www (9 matches)

20 permit tcp 10.1.1.0 0.0.0.255 host 10.2.2.100 eq 443

30 permit icmp 10.1.1.0 0.0.0.255 any (5 matches)

40 deny ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255 log (1 match)

50 permit ip 10.1.1.0 0.0.0.255 any

R1#

*Oct 4 10:22:31.512: %SEC-6-IPACCESSLOGP: list SALES-IN denied tcp 10.1.1.21(51544) -> 10.2.2.100(22), 1 packet

R1# show ip access-lists 110

Extended IP access list 110

10 permit tcp 10.1.2.0 0.0.0.255 10.2.2.0 0.0.0.255 range ftp-data ftp 20 permit tcp 10.1.2.0 0.0.0.255 10.2.2.0 0.0.0.255 eq 22 (12 matches)

30 deny tcp 10.1.2.0 0.0.0.255 any eq telnet (1 match)

40 permit ip 10.1.2.0 0.0.0.255 any (3 matches)

Figure 30-11 Lab verification: each test increments the expected line, and the log entry shows the denied SSH attempt.

Expected results: Sales web and ping succeed, Sales SSH to the server fails and is logged by line 40; Engineering SSH succeeds and Telnet fails at line 30; SSH to R1 from any host but 10.1.1.10 is refused with “Connection refused by remote host.” Chapter review

  • 1. Which wildcard mask matches the subnet 172.16.32.0/20?
  • A. 0.0.0.15
  • B. 0.0.15.255
  • C. 0.0.31.255
  • D. 255.255.240.0
  • 2. Which range of addresses does 10.10.8.0 0.0.7.255 match?
  • A. 10.10.8.0 – 10.10.8.255
  • B. 10.10.8.0 – 10.10.15.255
  • C. 10.10.0.0 – 10.10.7.255
  • D. 10.10.8.0 – 10.10.16.255
  • 3. A router has this ACL applied inbound: 10 permit 10.1.1.0 0.0.0.255 , 20 deny host 10.1.1.5 . What happens to a packet from 10.1.1.5?
  • A. It is denied by line 20.
  • B. It is permitted by line 10.
  • C. It is denied by the implicit deny.
  • D. It is permitted and logged.
  • 4. An ACL contains only deny 10.1.1.0 0.0.0.255 . What traffic does it permit?
  • A. Everything except 10.1.1.0/24
  • B. Only 10.1.1.0/24
  • C. Nothing
  • D. Only return traffic
  • 5. Which two number ranges identify extended IPv4 ACLs? (Choose two.)
  • A. 1–99
  • B. 100–199
  • C. 1300–1999
  • D. 2000–2699
  • E. 200–299
  • 6. Where should a standard ACL generally be placed?
  • A. As close to the source as possible
  • B. As close to the destination as possible
  • C. On the VTY lines only
  • D. On every router in the path
  • 7. Which command applies ACL 5 to restrict SSH access to a router?
  • A. ip access-group 5 in under line vty 0 15
  • B. access-class 5 in under line vty 0 15
  • C. ip access-class 5 in on each interface
  • D. access-list 5 vty
  • 8. Which ACE permits HTTPS from any host to server 10.2.2.100?
  • A. permit tcp any eq 443 host 10.2.2.100
  • B. permit udp any host 10.2.2.100 eq 443
  • C. permit tcp any host 10.2.2.100 eq 443
  • D. permit tcp host 10.2.2.100 any eq 443
  • 9. What does the established keyword match?
  • A. TCP segments with the SYN bit only
  • B. TCP segments with the ACK or RST bit set
  • C. Any UDP reply
  • D. Packets matching an entry in a state table
  • 10. An engineer needs to insert a new line between lines 20 and 30 of named ACL BRANCH. What should they do?
  • A. Delete and recreate the whole ACL
  • B. Enter ip access-list extended BRANCH then 25 permit ...
  • C. Enter access-list BRANCH 25 permit ... globally
  • D. It is not possible; new lines are always added at the end
  • 11. Which command shows whether an ACL is applied to G0/0 and in which direction?
  • A. show access-lists
  • B. show ip interface GigabitEthernet0/0
  • C. show ip route
  • D. show interfaces status
  • 12. Which two statements about IPv6 ACLs are true? (Choose two.)
  • A. They use wildcard masks.
  • B. They are applied with ipv6 traffic-filter .
  • C. They can be numbered 1–99.
  • D. They implicitly permit neighbor discovery NA and NS messages before the implicit deny.
  • E. They can match only the source address.
  • 13. How many IPv4 ACLs can be applied inbound on a single interface at the same time?
  • A. One
  • B. Two
  • C. One standard and one extended
  • D. Unlimited
  • 14. Which ACE matches all odd-numbered hosts in 192.168.1.0/24?
  • A. 192.168.1.1 0.0.0.254
  • B. 192.168.1.1 0.0.0.255
  • C. 192.168.1.0 0.0.0.1
  • D. 192.168.1.1 255.255.255.1

Answers

  • 1. B. /20 = 255.255.240.0; subtract from 255 to get 0.0.15.255.
  • 2. B. 8 + 7 = 15 in the third octet, so 10.10.8.0 through 10.10.15.255.
  • 3. B. First match wins: line 10 matches 10.1.1.5 and permits it; line 20 is never reached.
  • 4. C. The implicit deny drops everything the explicit deny does not, so nothing is permitted.
  • 5. B, D. Standard ACLs use 1–99 and 1300–1999.
  • 6. B. Standard ACLs see only the source, so place them near the destination to avoid blocking other paths.
  • 7. B. access-class applies an ACL to VTY lines.
  • 8. C. HTTPS is TCP; the server port goes after the destination. Option A matches source port 443.
  • 9. B. established checks for ACK or RST; it is stateless and keeps no table.
  • 10. B. Named ACL mode accepts a sequence number to insert a line.
  • 11. B. show ip interface lists the inbound and outbound access lists.
  • 12. B, D. IPv6 ACLs use prefix lengths, are named, can match any field, and are applied with ipv6 traffic-filter .
  • 13. A. One ACL per interface, per direction, per protocol.
  • 14. A. Only the last bit is checked and it must be 1, so every odd address matches.
Use ← → to move between sections