MENU
A company wants to enforce these controls on clients assigned to ''role1'':
DHCP permitted DNS permitted All other access to 10.0.0.0/8 denied All other traffic permitted
You have so far configured these settings:
class ip class1 10 match udp any any eq 67 20 match udp any any eq 53 30 match tcp any any eq 53
class ip class2 10 match any any 10.0.0.0/255.0.0.0
port-access policy policy1 10 class ip class1 20 class ip class2 action drop
port-access role role1 associate policy policy1
What change should you make to fulfill the company's requirements?
The existing policy permits DHCP and DNS through class1, then drops traffic matching class2, which is traffic destined for 10.0.0.0/8. However, the requirement also says all other traffic must be permitted. To make that policy complete, a final catch-all permit class must be added after the deny rule. A class that matches ''any any any'' and is referenced at the end of policy1 permits all traffic that did not match the earlier DHCP/DNS or 10.0.0.0/8 rules. Changing class2 to ignore would remove the intended deny behavior. Reversing source and destination would not meet the stated destination-based requirement. Adding action permit to class1 only affects DHCP and DNS, not all other traffic.
===============
Currently there are no comments in this discussion, be the first to comment!