300-410 Question 219
Single answerA network engineer is tasked with configuring an IPv6 traffic filter on a router to block all incoming ICMPv6 traffic from a specific source prefix (2001:db8:1234::/64) while allowing all other traffic. Which configuration should the engineer apply?
- A
ipv6 access-list BLOCK_ICMP deny icmp 2001:db8:1234::/64 any permit ipv6 any any interface GigabitEthernet0/0 ipv6 traffic-filter BLOCK_ICMP in
- B
ipv6 access-list BLOCK_ICMP permit icmp 2001:db8:1234::/64 any deny ipv6 any any interface GigabitEthernet0/0 ipv6 traffic-filter BLOCK_ICMP in
- C
ipv6 access-list BLOCK_ICMP deny ipv6 2001:db8:1234::/64 any permit ipv6 any any interface GigabitEthernet0/0 ipv6 traffic-filter BLOCK_ICMP in
- D
ipv6 access-list BLOCK_ICMP deny icmp any 2001:db8:1234::/64 permit ipv6 any any interface GigabitEthernet0/0 ipv6 traffic-filter BLOCK_ICMP in
Show answer and explanation
Correct answer: A
Explanation
To block all incoming ICMPv6 traffic from the source prefix 2001:db8:1234::/64 while allowing all other traffic, the IPv6 access-list must specifically deny ICMPv6 traffic from that prefix and permit all other IPv6 traffic. The traffic filter must then be applied in the inbound direction on the relevant interface. The correct configuration ensures the requirements are met without being overly restrictive.
- A. Correct.
This configuration correctly denies ICMPv6 traffic from the specified source prefix (2001:db8:1234::/64) and permits all other IPv6 traffic. It also applies the IPv6 traffic filter to the correct interface in the inbound direction.
- B. Incorrect.
This configuration incorrectly permits ICMPv6 traffic from the specified source prefix instead of denying it, which does not meet the requirement to block ICMPv6.
- C. Incorrect.
This configuration denies all IPv6 traffic from the specified source prefix, not just ICMPv6, which is more restrictive than required.
- D. Incorrect.
This configuration denies ICMPv6 traffic destined for the specified source prefix, instead of blocking ICMPv6 traffic originating from it, which does not meet the requirement.