Solved

ACL question

Posted on 2003-10-28
2
196 Views
Last Modified: 2011-08-18
Hi guys,

Whats the differnce between ip access-group 101 in and ip access-group 101 out?

Cheers,
Blue Print
0
Comment
Question by:blueprint123
2 Comments
 
LVL 13

Accepted Solution

by:
td_miles earned 50 total points
ID: 9638766
"in" applies the access list to traffic "entering" the interface from an external source
"out" applies the access list to traffic leaving the interface from your router

as an example, if you have the access list:

access-list 101 permit ip w.x.y.z any
access-list 101 deny ip any any

==========
you could then apply this:
interface ethernet0
  ip access-group 101 in

which would permit any traffic from the device w.x.y.z that is connected to the ethernet0 interface (eg. via a switch) to enter the ethernet0 interface of the router. All other traffic would be denied.
==========
if you applied it:
interface ethernet0
  ip access-group 101 out

it would allow any traffic that was from the device w.x.y.z to LEAVE the ethernet0 interface. This traffic would have to be either generated locally by the router, or have entered the router from another interface and have been routed to ethernet0.
==========

In summary, think of the "in" and "out" in relation to the viewpoint of that router interface and an external device. If the external device is sending traffic to the router, then the traffic is "inbound". If the router is sending traffic to the other device, then the traffic is "outbound".

0
 
LVL 7

Expert Comment

by:NicBrey
ID: 9639932
Just to add to td_miles comment:
Outgoing  ACL's  do not apply to traffic generated by the router itself. So, if you deny outgoing ICMP for example, you would still be able tto ping from the router console.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Cisco Router DMZ 5 57
server can't ping default gateway 25 113
How to setup VPN onCisco RV016 8 50
eBGP policy and ACL in interface 7 47
It happens many times that access list (ACL) have to be applied to outgoing router interface in order to limit some traffic.This article is about how to test ACL from the router which is not very intuitive for everyone. Below scenario shows simple s…
Getting hacked is no longer a matter or "if you get hacked" — the 2016 cyber threat landscape is now titled "when you get hacked." When it happens — will you be proactive, or reactive?
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

912 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now