Hi rvthost
First, a little description.
Every interface in routers, switches have an inbound buffer and outbound buffer. After device makes its calculations according to ACLs and route table, device switches the packet from the inbound buffer of interface X to the outbound buffer of interface Y. The packets which are "leaving" the device (that packets with the source address of any device connected to router or switch) are switched to outbound buffer. Packets which are destined to any device which are connected to router or switch, are placed in inbound buffer
Let me explain this with an example. I draw a diagram of switching process, which looks like the pictures I drew in primary school that has a house a sheep a sun and mountains... sorry for bad drawing.
You want to deny traffic from PC X (192.168.100.1) to PC Y (10.1.1.50) and you have the ACL 100 above. You need the packets which contain the source IP of PC X or the destination IP of PC Y. With another saying, you need packets originated from PC X and destined for PC Y. So the question is
In which buffer of which interface can you find these packets of traffic originated from PCX destined to PCY, according to the attached diagram (Choose Two)
a)Inbound buffer of fa0/5
interface fa0/5
ip access-group 100 in
b)Outbound buffer of fa0/5
interface fa0/5
ip access-group 100 out
c)Inbound buffer of fa0/14
interface fa0/14
ip access-group 100 in
d)Outbound buffer of fa0/14
interface fa0/14
ip access-group 100 out
Now you tell me the answers, and which one would you prefer to use, in above two correct options, why?
Regards
Main Topics
Browse All Topics
by: norgetekPosted on 2008-03-19 at 14:09:46ID: 21165930
On a routed interface the "in" means traffic coming from the subnet that the interface is in and attempting to get "routed" to other subnets. The "out" would mean traffic coming from other subnets attempting to go onto the subnet the interface is a part of (and has the ip access-group ** out) applied.
Instead of trying to use a ACL on a interface on to control guest wireless traffic, I would suggest dumping the guest wireless into a DMZ segment and using a firewall to control the traffic leaving and returning to the wireless network.
Your access-list is pretty wide open for "guests", depending on what you mean by a guest wireless network.