Network Engineering Stack Exchange is a question and answer site for network engineers. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

While preparing for CCNA exam, I found this recommendation in a book:

Place extended ACLs as close as possible to the source of the packets that will be filtered. Filtering close to the source of the packets saves some bandwidth [1]

The question: Why does placing the ACL close to the packets' source save bandwidth?

[1] Source: Cisco CCNA Routing and Switching 200-120 Official Cert Guide Library

share|improve this question
up vote 5 down vote accepted

The reason for placing Extended ACL's as close to the source as possible is to prevent unnecessary traffic from traversing the network. The ACL will catch the packet before it routes it and therefore less routers have to process the packet and route it through the network

However the reason this is suggested only with extended ACL's and not standard ACL's is that an Extended ACL is more refined, where as the standard ACL can catch traffic not intended to be filtered.

share|improve this answer

To kill it as soon as possible. If you drop packets furthest down the path, you'll be wasting bandwidth (perhaps valuable), that could have otherwise been dropped sooner with no ill effects.

As a heads up, this mentality isn't just limited to extended ACLs, it applies to all ACLs. There isn't any good reason in waiting to drop traffic.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.