Access lists

[DTrix]

When configuring an Access List Rule to an interface the syntax is:<br><br>ip access group NUMBER {out¦in}<br><br>What I am not clear on is the &quot;OUT¦IN&quot; portion of the command.&nbsp;&nbsp;It appears that the command specifies the interface is either used for inbound OR outbound traffic... but I am not exactly sure.&nbsp;&nbsp;Can anyone shed some light on this for me?<br><br>Thanks in advance!<br><br>D

 

[wybnormal]

You are correct. When you talk about outbound, you are refering to outbound traffic from the port that has the access-group applied to it. I have used this to filter &quot;non-work related sites&quot; with an IP and a port number of 80. I filtered as outbound to keep from loading the proxy with traffic that would be tossed away by the router anyways.<br><br>Mike

 

[DTrix]

So you can specify different filters for inbound and outbound traffic? For example, assign an interface to two access groups? One for inbound and one for outbound?<br><br>-D

 

[munsonbrown]

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;_________<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;!&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;!<br>-----!&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;!-----<br>&nbsp;&nbsp;&nbsp;s0!_________!e0<br><br>You can two access-groups per interface, one in one out.<br><br>If you are trying to filter traffic originating from the serial side to the ethernet side, you have a choice of where to filter it.&nbsp;&nbsp;You can apply the access-group on the serial as it comes IN to the router or on the ethernet as it goes OUT of the router.

 

[DTrix]

Thats great! Thank you for clearing that up for me. =)