ISP router filtering traffic

[Raha_1990]

Hi!could you explain the correct answer in the question shown?

regards,Abdurahman

[Abzal]

Hi,

I think the correct answer is the last one.

1. First, because ACL applied to subnet /21 not to host 64.100.0.1.

2. Second, ACL effects to with source subnet /21 only not any source.

3. Third, as second.

4. Fourth, ACL 101 as per first statement it is denied.

5. So only fifth option.

Hope it will help.

[Raha_1990]

no,it's not correct

[Rahul Kukreja]

The correct answer should be 4th option.

All traffic from 64.100.0.0/21 network could access internet.

It's because -

When the traffic from RTR goes out to ISP the source address will always be in the range of 64.100.0.0/21 - which is permitted in ACL 1 applied in the inbound on ser0/0/0 of ISP. So as the ACL 1 checks only the source ip it is permitted.

For the return traffic from the Internet the source ip could be ANY and the destination would be always 64.100.0.0/21 which is permitted in the ACL 101 applied in the outbound on ser0/0/0

- HTH

Rahul

[Raha_1990]

but in ACL 101 it is denied.how to understand that we must follow ACL 1,not ACL 101?

[Rahul Kukreja]

ACL 1 will be checked for the traffic coming in on ser0/0/0

ACL's in IOS are checked from top to bottom, and as in ACL 1 traffic from 64.100.0.0/21 is permitted traffic gets routed to Internet when it comes from RTR Router.

For the return traffic, the ACL 101 is checked when the traffic leaves out from ser0/0/0 and here in the ACL 101 when it is checked from top to bottom -

access-list 101 deny ip 64.100.0.0 0.0.7.255 any

access-list 101 permit ip any 64.100.0.0 0.0.7.255

So the return traffic going out via seril0/0/0 on ISP Router will never match the first deny statement in ACL 101 (because the return traffic will never have the source ip as 64.100.0.0/21) - it matches the second permit statement and traffic is sent out via ser0/0/0

Thus for the traffic to Internet - both the ACLs are checked.

- HTH

Rahul