1

Is it just me that think there has to be something wrong with these questions/answers?

1) Why is this the best answer? How does the correct answer achieve the objective? The ACL says:

Deny any TCP traffic with IP addresses belonging to the 192.168.1.0 0.0.0.255 (match first 24 bits, left to right) with source port 80 to a single IP address 10.1.1.101

then allow all other traffic that doesn't match above

If I do that ^^^ outbound of serial 0/0/0 (sample config), it does make more sense to analyze the traffic before you send it out / before it could reach the destination.

Changing the config to "ip access-group 170 i" won't prevent packets from 172.16.0.0/16 and 192.168.1.0/24 from reaching Branch.

If it was me, I would write

deny ip 172.16.0.0 0.0.255.255 10.1.1.0 0.0.0.255
deny ip 192.168.1.0 0.0.0.255 10.1.1.0 0.0.0.255
permit ip any any

enter image description here

2) This question uses the same configs but has a different objective. How does this config/example achieve the desired objective? The port should have been on the destination address.

enter image description here

Thank you all for you time.

  • Unfortunately, questions for "education, certification, or homework" are explicitly off-topic here. – Ron Maupin Jan 20 '16 at 14:55
0

1)

Short answer

FWIW I also don't see how the answer marked in green would be the correct answer. In fact I don't see how any of those answers would be the correct answer.

Long answer

If I wanted to protect Branch I'd set incoming rules on the Branch network.

But, if only City_HQ is under my control, I can either drop what's incoming from Branch, or drop what's outgoing to Branch.

I prefer working with incoming rules. And when I start using rules I prefer using "deny any any" as last resort with explicit permits before that. But that's from a firewall perspective. We are talking about routers here... YMMV

2)

AFAICS the config is almost correct but should say

deny tcp 192.168.1.0 0.0.0.255 host 10.1.1.101 eq 80

(port should be specified on destination side)

Again I don't see how any of the red or green answers (or other) would be correct.

| improve this answer | |
  • I got this from the Cisco Learning Network. They are already looking into revising these questions. Thanks for confirming. – wildHoneyPieWalrus Jan 21 '16 at 0:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.