Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to understand ACLs and am unsure of where they are applied.

Here's my example. I am trying to prevent communication between two VLAN interfaces.

My source clients are on VLAN 1, my destination servers are on VLAN 2. I want to prevent the clients from communicating with the servers. I am only able to apply inbound ACLs.

Do I apply the ACL on the VLAN 1 interface or the VLAN 2 interface?

share|improve this question
    
On what platform, on a switch like a Cisco, or on a linux box etc? –  Chopper3 Feb 2 '11 at 10:42
    
Network hardware - we have Dell and Cisco, but I think they work the same way. –  dunxd Feb 2 '11 at 10:47

2 Answers 2

up vote 1 down vote accepted

You apply the ACL in your case to VLAN1 as that is the interface where the traffic you want to control enters your router/switch.

Think about the problem from the perspective of the filtering device, rather than the traffic source - traffic is incoming to the device from VLAN1 and outgoing to VLAN2.

share|improve this answer
    
Thanks for the info. Damn - VLAN1 is the production network, so I can't do much experimentation there. I wish that the Dell 62xx switches supported egress IP filtering, which presumably would allow me to block access coming out of VLAN 2. –  dunxd Feb 3 '11 at 10:35
    
You could block traffic from the servers back to the clients, not perfect but it would effectively prevent communication from happening, but not prevent the clients on VLAN1 attacking the servers with DoS type attacks. –  James Yale Feb 3 '11 at 11:38

If you are using standard ACL's who only use IP addresses it should be close to the source while extended ACL's are usually used closed to the destination.

You can find more info here: http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a00800a5b9a.shtml#acl

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.