300-410 Question 221
Select 2You are configuring IPv6 traffic filtering on a router to restrict access to a specific server in your network. The server's IPv6 address is 2001:db8:1::100, and only traffic from the subnet 2001:db8:2::/64 should be allowed. Which of the following steps are required to implement this filter using an IPv6 access control list (ACL)?
- A
Create an IPv6 ACL and permit traffic from 2001:db8:2::/64 to 2001:db8:1::100.
- B
Apply the IPv6 ACL as an inbound filter on the interface connected to the server.
- C
Apply the IPv6 ACL as an outbound filter on the interface connected to the server.
- D
Create an IPv6 ACL and deny traffic from 2001:db8:2::/64 to any destination.
- E
Apply the IPv6 ACL as an inbound filter on the interface connected to the subnet 2001:db8:2::/64.
Show answer and explanation
Correct answers: A, B
Explanation
To restrict access to the server at 2001:db8:1::100 and allow only traffic from the subnet 2001:db8:2::/64, an IPv6 ACL must be created with the appropriate permit rule. The ACL should then be applied inbound on the interface connecting to the server, as this ensures only the desired traffic reaches the server while blocking all other sources. Outbound filters or filtering on the subnet’s interface do not meet the requirements of this scenario.
- A. Correct.
Correct: You need to create an IPv6 ACL with a rule permitting traffic from the allowed subnet (2001:db8:2::/64) to the specific server's IPv6 address (2001:db8:1::100).
- B. Correct.
Correct: The ACL must be applied as an inbound filter on the interface connected to the server to restrict incoming traffic to the specified source subnet.
- C. Incorrect.
Incorrect: Applying the ACL as an outbound filter on the server's interface is unnecessary in this scenario since the requirement is to filter incoming traffic.
- D. Incorrect.
Incorrect: Denying traffic from 2001:db8:2::/64 contradicts the requirement to allow traffic from this subnet.
- E. Incorrect.
Incorrect: Applying the ACL as an inbound filter on the subnet's interface does not directly restrict access to the server, as the ACL needs to be applied where the server receives traffic.