300-410 Question 209
Single answerA network engineer is troubleshooting a router where SSH access has suddenly stopped working. The router is configured with an access control list (ACL) applied to the vty lines. Upon inspection, the engineer notices that the ACL allows traffic from certain subnets but denies all other traffic by default. What is the likely cause of the issue?
- A
The ACL is not applied to the correct interface.
- B
The ACL is missing an entry to explicitly permit the IP address of the SSH client.
- C
The SSH version configured on the router is outdated.
- D
The router's CPU is overloaded, causing SSH to fail.
Show answer and explanation
Correct answer: B
Explanation
Access control lists (ACLs) are used to filter traffic based on defined rules. In this scenario, the ACL applied to the vty lines has a default deny rule, which blocks all traffic not explicitly permitted. If the IP address of the SSH client is not included in the ACL's permit rules, the connection request will be denied, causing SSH access to fail. The issue is resolved by updating the ACL to explicitly allow the client's IP address.
- A. Incorrect.
If the ACL were not applied to the correct interface, it would not block or allow traffic at all. This does not explain why SSH access is blocked.
- B. Correct.
If the ACL does not explicitly permit the IP address of the SSH client, it will be implicitly denied due to the default deny rule at the end of the ACL. This is the most likely cause of the issue.
- C. Incorrect.
An outdated SSH version could cause compatibility issues, but in this case, the issue is related to the ACL blocking traffic, not the SSH version.
- D. Incorrect.
While a high CPU load can impact router performance, it would not specifically point to the ACL as the root cause of the SSH failure.