Applying an ACL to an Interface

 

Applying an ACL to an Interface
The second step of the configuration process involves applying the ACL to an interface. ACLs can be defined
without applying them to an interface on a device. However, the ACL will have no effect until it is applied to the
device's interface. ACLs can also be used for various other services in addition to applying to interfaces, such as
in route-map, SNMP, or traffic-classification techniques.
ACLs can be applied on various interfaces and devices in a network, but you should consider a number of
intricate factors before deciding where to apply them. Figure 2-2 shows a requirement that is blocking traffic
that is entering the network from Router A from reaching the source Host A to destination Host B. When
deciding where to apply an ACL, such as that shown in Figure 2-2, consider the following:
When using a standard ACL, apply the ACL filter closest to the destination Router C within the traffic flow.
This is recommended because standard ACL filter packets, which are based on the source address only,
are dropped closer to the ingress point Router A. A potential danger exists in blocking Host A entirely for
all other traffic—for example, Host C or Host D in the network. Hence, applying the ACL on Router C is
more appropriate than on Router A or Router B.

When using an extended ACL, apply the ACL filter closest to the source Router A ingress point into the
network. This is recommended because with extended ACL, filter packets are based on the
source/destination IP address and source/destination ports, and so on, and are much more granular in
nature than standard ACL. Therefore, dropping the packet closer to the ingress point into the network is
more appropriate. Although dropping the packet closer to the destination will achieve the same result, it
will cause unnecessary resource consumption on the traversing routers. The packet is traversing the entire
network, chewing up resources and eventually being dropped at the destination Router C. Hence it is best
to drop the packet closer to the source (ingress) within the network by applying the ACL on Router A
instead of Router B or Router C.
 

 

For some protocols, up to two ACLs can be applied to an interface: one inbound ACL and one outbound ACL.
With other protocols, only one ACL is allowed, and this list checks both inbound and outbound packets.
Note
Outbound ACLs that are applied to router interfaces do not filter traffic that originates from the router.