Access List For A Dummy 1

[simac10]

With access lists how are they applied to the interface. I understand they can be both inbound and outbound but surely outbound for say an ethernet interface can be out to the internal network and out to the wan side network?

So are the access lists applied out on both sides?

Sorry if this sounds muddled but this is my problem with acces slists.

 

[leedsit]

Hi,

Dont think of the Application of an access list from the perspective of a router, but the interface. I.E If you have an Inbound Access list on the internal Ethernet Interface, then it will only check for traffic coming into that interface. it will then route normally and exit the other interfaces.

Again, Imagine a router with a Fast Ethernet Interface and a serial interface going to the internet.. and you have a packet being sourced from the internal lan to the internet.... and also you have an acces list applied IN to the ethernet interface and OUT on the serial. The packet will be checked as it goes IN the Ethernet interface and checked as it goes OUT the serial, however the reply packet will not be checked as no access list is applied IN the Serial interface and OUT the ethernet.....

Hope this makes sense.... P.S the above example in the real world would be the otherway round.

LEEroy
MCNE6,CCNA2,CWNA, Project+

 

[simac10]

Thankyou. Just to clarify. That a packet bound for the internet would move IN the Ethernet and OUT the serial. And the returning packet would move IN the serial and OUT the ethernet back to your PC.

 

[lgarner]

Correct. Assuming you have two interfaces, putting an ACL inbound on one interface is much the same as putting it outbound on the other. A good thing about inbound ACLs is that they protect the router itelf as well as the hosts beyond it.

Outbound ACLs are really useful if you have several interfaces, and wish to protect hosts on one of the segments against the others. In this case, an outbound ACL on the protected segment would be simpler to maintain than multiple inbound ACLs on the others.