I have a full mesh core network running OSPF. I use OSPF down to the "L3 Agg switches". Now I want to restrict traffic between some of the networks at our site, but how is this done when there is multiple routes to every network?

Behind every "L3 Agg switch" there is a cluster that in some cases need to be isolated from the rest of the network.

enter image description here

1 Answer 1


A good practice is to place access lists as close to the source as possible. So for example, to block access to a specific host or subnet, you would place an ACL on the inbound interfaces of each agg switch (the interfaces that connect to your access layer).

  • The general rule when applying access lists is to apply standard IP access lists as close to the destination as possible and to apply extended access lists as close to the source as possible.The reasoning for this rule is that standard access lists lack granularity, it is better to implement them as close to the destination as possible; extended access lists have more potential granularity, thus they are better implemented close to the source. so its very depend on the type of access list it self
    – Gadeliow
    Sep 18, 2015 at 7:20
  • @Gadeliow, your general rule is correct for the distribution routers, not the backbone switches. The backbone should be free of anything that slows the high-speed switching of traffic.
    – Ron Maupin
    Sep 18, 2015 at 11:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.