I am trying to understand ACLs and am unsure of where they are applied.

Here's my example. I am trying to prevent communication between two VLAN interfaces.

My source clients are on VLAN 1, my destination servers are on VLAN 2. I want to prevent the clients from communicating with the servers. I am only able to apply inbound ACLs.

Do I apply the ACL on the VLAN 1 interface or the VLAN 2 interface?

  • On what platform, on a switch like a Cisco, or on a linux box etc? – Chopper3 Feb 2 '11 at 10:42
  • Network hardware - we have Dell and Cisco, but I think they work the same way. – dunxd Feb 2 '11 at 10:47

You apply the ACL in your case to VLAN1 as that is the interface where the traffic you want to control enters your router/switch.

Think about the problem from the perspective of the filtering device, rather than the traffic source - traffic is incoming to the device from VLAN1 and outgoing to VLAN2.

  • Thanks for the info. Damn - VLAN1 is the production network, so I can't do much experimentation there. I wish that the Dell 62xx switches supported egress IP filtering, which presumably would allow me to block access coming out of VLAN 2. – dunxd Feb 3 '11 at 10:35
  • You could block traffic from the servers back to the clients, not perfect but it would effectively prevent communication from happening, but not prevent the clients on VLAN1 attacking the servers with DoS type attacks. – James Yale Feb 3 '11 at 11:38

If you are using standard ACL's who only use IP addresses it should be close to the source while extended ACL's are usually used closed to the destination.

You can find more info here: http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a00800a5b9a.shtml#acl

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.