We have the option of using the word host to represent a wildcard mask of 0.0.0.0.
Consider a configuration where only packets from IP source 10.1.1.1 should be allowed and all other packets denied. The following ACLs both do that.
R3(config)#access-list 6 permit 10.1.1.1 0.0.0.0
R3(config)#access-list 7 permit host 10.1.1.1
The keyword any can be used to represent a wildcard mask of 255.255.255.255. Both of the following lines permit all traffic.
R3(config)#access-list 15 permit any
R3(config)#access-list 15 permit 0.0.0.0 255.255.255.255
There’s no “right” or “wrong” decision to make when you’re configuring ACLs in the real world. For your exam, though, I’d be very familiar with the proper use of host and any.
It’s easy to think of your network as the “inside”, and everything else as “outside”. However, we’ve got a third area when it comes to firewalls - the DMZ.
From an IT standpoint, the DMZ is the part of our network that is exposed to outside networks. It’s common to find the following devices in a DMZ:
• FTP server
• Email server
• E-commerce server
• DNS servers
• Web servers
A. Stateless packet filtering considers the TCP connection state. B. Stateful packet filtering considers the TCP connection state.
C. Neither stateless nor stateful packet filtering monitor the TCP connection state.
D. Both stateless and stateful packet filtering monitor the TCP connection state, and keep a state table containing that information.
Ans: (B.) Stateful packet filtering does monitor the connection state, and that’s particularly important when it comes to preventing TCP attacks. A stateful firewall will not only monitor the state of the TCP connection, but also the sequence numbers. Stateful firewalls accomplish this by keeping a session table, or state table.
The Cisco IOS Firewall is a stateful filter.
A. IOS Firewall
B. Intrusion Prevention System
D. Authentication Proxy
E. Password Encryption
Ans:(A, B, D.) There are three major components to the IOS Firewall feature set - the IOS
Firewall, the Intrusion Prevention System (IPS), and the Authentication Proxy.