N10-009 Question 54
Single answerTelnet: 23A network administrator is troubleshooting a legacy managed switch that only supports remote administration through Telnet. The administrator can successfully ping the switch's management IP address from a workstation, but attempts to open a remote session fail. A firewall was recently placed between the workstation VLAN and the management VLAN. Which firewall rule should the administrator verify first to restore remote administration to the switch?
- A
Allow TCP port 23 from the workstation VLAN to the switch's management IP
- B
Allow UDP port 23 from the workstation VLAN to the switch's management IP
- C
Allow TCP port 22 from the workstation VLAN to the switch's management IP
- D
Allow ICMP from the workstation VLAN to the switch's management IP
Show answer and explanation
Correct answer: A
Explanation
This scenario tests practical knowledge of well-known ports and troubleshooting remote management connectivity. Telnet is a legacy remote access protocol that uses TCP port 23. If a device responds to ping but a Telnet session cannot be established after a firewall change, the first item to verify is whether TCP 23 is permitted between the source and destination. SSH, by comparison, uses TCP 22 and is the preferred best practice because Telnet transmits data, including credentials, in cleartext. Common networking references, including IANA service name and port number assignments and standard certification objectives, identify Telnet with TCP 23.
- A. Correct.
Correct. Telnet uses TCP port 23 for remote terminal sessions. If the switch only supports Telnet and ping already works, the most likely issue is that the firewall is blocking TCP 23 between the administrator's workstation and the switch management interface.
- B. Incorrect.
Incorrect. Telnet does not use UDP port 23. A common misconception is to focus only on the port number and overlook the transport protocol. Because Telnet is a connection-oriented service, it uses TCP, not UDP.
- C. Incorrect.
Incorrect. TCP port 22 is used by SSH, not Telnet. This is a plausible distractor because SSH is the modern secure replacement for Telnet, but allowing port 22 would not help if the legacy switch supports only Telnet.
- D. Incorrect.
Incorrect. ICMP is used for functions such as ping and reachability testing, not for establishing Telnet management sessions. Since the administrator can already ping the switch, ICMP is clearly not the missing requirement for remote administration.