I85PREP
⌘ K
Cisco 300-710 SNCF study materials
Cisco 300-710 SNCF study resources

Cisco 300-710 SNCF: Traffic Control and Access Control Policies

Cisco 300-710 SNCF · Work through your exam, one topic at a time.

All guide sections

Traffic Control and Access Control Policies

Domain 3 tests whether you can turn intent into an ordered access control policy and predict exactly what happens to a flow. Marks come from rule order, rule actions, and the prefilter/ACP/SSL layering.

Evaluation logic

  • ACP rules evaluate top-down, first match wins; the default action applies only when nothing matched. The default action can block, allow, or allow with intrusion prevention, but it cannot carry URL, application, or user conditions.
  • Conditions inside one rule are ANDed; multiple values within a condition are ORed. Zones are the usual way to scope rules to an interface pair.

Rule actions

  • Allow: permit and apply that rule's intrusion policy, file policy, and logging.
  • Trust: permit with no further inspection - no IPS, no file policy, no decryption. Cheap on CPU, expensive for visibility.
  • Monitor: permit and log at end of connection without applying that rule's inspection; used when you want visibility only.
  • Block and Block with Reset: drop silently or send a TCP RST (TCP only). Interactive Block serves an HTTP response page that lets the user continue for a configured time; it works for web traffic only.

Prefilter and decryption

  • From 6.5 onward, prefilter rules run before the ACP to handle GRE/SGT tunnels and to Fastpath (bypass ACP) or Analyze (continue to ACP).
  • The SSL policy chooses decrypt re-sign, decrypt with known key, do-not-decrypt, or block; undecryptable traffic takes its own action. Without decryption, HTTPS application and URL matching is limited to hostname/SNI and certificate data.

Worked example

Requirement: allow the sales subnet to Facebook but block Facebook chat. Place a Block rule for application Facebook chat with the sales network above the Allow rule for application Facebook; in the reverse order, chat matches the Allow first and reaches the internet. Confirm with per-rule hit counts.

Traps

  • A broad Allow or Trust at the top silently hides every later block.
  • Expecting deep URL filtering without a URL license or without decryption.
  • Using Block with Reset on UDP traffic.
  • Assuming the default action can filter by application or URL.