Which IOS ACL Command Permits DNS Traffic to the Internet
A network engineer must create an access control list on a Cisco Adaptive Security Appliance firewall to permit TCP DNS traffic to the internet from the organization’s inside network 192.168.1.0/24. Which IOS command must be used to implement the access control list?
Community Insight
The question tests correct placement of the operator/port clause in an extended ACL, and the common trap is writing eq domain directly after the source wildcard, which silently filters on the source port instead of the DNS destination port.
This 350-701 question tests IOS extended access-list syntax for permitting TCP DNS (port 53) traffic from the inside network 192.168.1.0/24 to any internet destination. The page establishes that the port/operator clause must qualify the destination, so the correct form is permit tcp 192.168.1.0 0.0.0.255 any eq domain.
Option A is the most common wrong pick because it renders the command as permit tcp 192.168.1.0 0.0.0.255 eq <port> any, which places the port match on the SOURCE side — as several learners noted, that 'is saying that the source traffic it's DNS' rather than restricting the destination service to port 53.
Community Discussion (12 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option D states the extended ACL as permit tcp 192.168.1.0 0.0.0.255 any eq domain, which is the structurally correct IOS form: the source is the inside /24 given a wildcard mask (0.0.0.255), the destination is explicitlyany for the internet, and the operator/port clause eq domain follows the destination. Because DNS over TCP uses destination port 53, matching the destination service is exactly what the requirement 'permit TCP DNS traffic to the internet' demands. The keyword domain is Cisco's alias for port 53, and as ITVI observed in lab, an ASA/IOS show access-list display normalizes eq 53 to eq domain, so the service-name form is unambiguous. This is also the form shown in Cisco's published extended ACL configuration examples.Why the Other Options Are Wrong
Option A places the operator/port immediately after the source wildcard (permit tcp 192.168.1.0 0.0.0.255 eq 53 any), which IOS parses as a match on the client's SOURCE port, leaving the destination wide open — the opposite of a DNS server-port rule. Options B and C omit the destination address entirely (noany and/or no destination wildcard), so they are syntactically incomplete and cannot be applied as written; as Surfside92 put it, "b and c are missing destination ip address or 'any' so they are wrong." Premium_Pils further points out that the ASA itself would require named/object-based extended syntax with a netmask rather than a wildcard mask, so none of the router-style variants map cleanly onto the ASA wording in the prompt.Community Comment Notes
Most commenters converged on D after lab testing: certprep2021 pasted a running-config showingaccess-list 101 permit tcp 192.168.1.0 0.0.0.255 eq domain any accepted by the device, and ITVI explained that "although both appears legitmate, I will defer to 'domain'." A minority argued for A or for both A and D, with dorf05 claiming "A and D are correct because one uses the port number (53), and the other uses the service name (domain)." Premium_Pils, who works with ASA daily, cautioned that "the syntax presented in the question is incorrect for an ASA" and cited the official extended ACL guide, while XBfoundX flagged the wording mismatch of asking for an 'IOS command' on an ASA — useful context, but it does not change which option matches the intended destination-port rule. Official Reference
Exam Strategy
On ACL syntax questions, first identify which side (source or destination) the port operator must attach to, then confirm a destination of any exists for internet-bound traffic. Remember that domain, www, and smtp are simply aliases for 53, 80, and 25.
Frequently Asked Questions
Why must the port operator follow `any` instead of the source wildcard?
In IOS extended ACL syntax the operator/port clause matches the address written immediately before it. After the source wildcard it filters the client's source port; after any it filters the DNS server's destination port 53.
Is `eq domain` the same as `eq 53` for DNS traffic?
Yes — domain is Cisco's alias for TCP/UDP port 53, and show access-list output displays either form as eq domain. Both are accepted, but the destination-side placement is what matters.