0

I am trying to understand ACLs and am unsure of where they are applied.

Here's my example. I am trying to prevent communication between two VLAN interfaces.

My source clients are on VLAN 1, my destination servers are on VLAN 2. I want to prevent the clients from communicating with the servers. I am only able to apply inbound ACLs.

Do I apply the ACL on the VLAN 1 interface or the VLAN 2 interface?

Improve this question
2
  • On what platform, on a switch like a Cisco, or on a linux box etc?
    – Chopper3
    Feb 2, 2011 at 10:42
  • Network hardware - we have Dell and Cisco, but I think they work the same way.
    – dunxd
    Feb 2, 2011 at 10:47

2 Answers 2

Reset to default
1

You apply the ACL in your case to VLAN1 as that is the interface where the traffic you want to control enters your router/switch.

Think about the problem from the perspective of the filtering device, rather than the traffic source - traffic is incoming to the device from VLAN1 and outgoing to VLAN2.

Improve this answer
2
  • Thanks for the info. Damn - VLAN1 is the production network, so I can't do much experimentation there. I wish that the Dell 62xx switches supported egress IP filtering, which presumably would allow me to block access coming out of VLAN 2.
    – dunxd
    Feb 3, 2011 at 10:35
  • You could block traffic from the servers back to the clients, not perfect but it would effectively prevent communication from happening, but not prevent the clients on VLAN1 attacking the servers with DoS type attacks.
    – James Yale
    Feb 3, 2011 at 11:38
1

If you are using standard ACL's who only use IP addresses it should be close to the source while extended ACL's are usually used closed to the destination.

You can find more info here: http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a00800a5b9a.shtml#acl

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .