ACL placement — why does it matter where I put it?
Yaron · posted · 76 views
I learned that standard ACLs should go near the destination and extended ACLs near the source. But why? If the ACL blocks traffic either way, what difference does placement make? Can someone explain with a concrete example?
- Standard ACLs only match source IP, so if you put them near the source, you'd block that source from reaching EVERYTHING — not just the one destination you intended. That's why standard goes near the destination, so you can be selective about what gets blocked where. — itayitayy,
- Extended ACLs match source AND destination AND protocol AND port, so you CAN be specific near the source. Putting them there saves bandwidth — unwanted packets get dropped early instead of traveling across the whole network just to be denied at the end. — NivSa,
- The rule I memorize: Standard ACLs near Destination (S and D — the letters match). Extended ACLs near Source (E and S — also match). Sounds silly but it stuck in my head and I never got an exam question wrong on this after that. — 22maya2n2,
- Oh I see now. A standard ACL near the source would block that source from reaching everything, not just the intended destination. That's the key insight I was missing. Near the destination you can be selective because you know where the traffic is going. — Yaron,
- Standard near Destination, Extended near Source — S-D, E-S. That mnemonic is perfect. Writing it on my cheat sheet right now. Thanks! — Yaron,
0 Answers
Your answer
Answering is a Pro feature. Free accounts can read everything and still like, comment, and connect. Upgrade to Pro →