up vote 0 down vote favorite
share [g+] share [fb]

I am trying to understand ACLs and am unsure of where they are applied.

Here's my example. I am trying to prevent communication between two VLAN interfaces.

My source clients are on VLAN 1, my destination servers are on VLAN 2. I want to prevent the clients from communicating with the servers. I am only able to apply inbound ACLs.

Do I apply the ACL on the VLAN 1 interface or the VLAN 2 interface?

link|improve this question
76% accept rate
On what platform, on a switch like a Cisco, or on a linux box etc? – Chopper3 Feb 2 '11 at 10:42
Network hardware - we have Dell and Cisco, but I think they work the same way. – dunxd Feb 2 '11 at 10:47
feedback

2 Answers

up vote 1 down vote accepted

You apply the ACL in your case to VLAN1 as that is the interface where the traffic you want to control enters your router/switch.

Think about the problem from the perspective of the filtering device, rather than the traffic source - traffic is incoming to the device from VLAN1 and outgoing to VLAN2.

link|improve this answer
Thanks for the info. Damn - VLAN1 is the production network, so I can't do much experimentation there. I wish that the Dell 62xx switches supported egress IP filtering, which presumably would allow me to block access coming out of VLAN 2. – dunxd Feb 3 '11 at 10:35
You could block traffic from the servers back to the clients, not perfect but it would effectively prevent communication from happening, but not prevent the clients on VLAN1 attacking the servers with DoS type attacks. – James Yale Feb 3 '11 at 11:38
feedback
up vote 1 down vote

If you are using standard ACL's who only use IP addresses it should be close to the source while extended ACL's are usually used closed to the destination.

You can find more info here: http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a00800a5b9a.shtml#acl

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.