I started a Named ACL Lab today and my configuration is not quite working.

LAB: http://gns3vault.com/security/named-access-list/

The first task is creating an ACL which blocks users from NSA's L1 to reach HTTPS on CIA's L2.

The addressing is fine and I can ping all interfaces.

My Configuration is placed on NSA, different from author's config which places the config on CIA's router. I later configured it the same way as the lab author configured, and it worked.

My configuration:

NSA#sh access-lists Extended IP access list NSA_L1_TO_CIA_L2 10 deny tcp eq 443 20 permit ip any any (444 matches) sh ip int e0/0 Ethernet0/0 is up, line protocol is up Internet address is Broadcast address is Address determined by setup command MTU is 1500 bytes Helper address is not set Directed broadcast forwarding is disabled Multicast reserved groups joined: Outgoing access list is NSA_L1_TO_CIA_L2 Inbound access list is NSA_L1_TO_CIA_L2 (This shouldn't be here, I just put for test purposes) ... (Continues...)

Can someone explain why?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it.
    – Ron Maupin
    Aug 7, 2017 at 13:18

1 Answer 1


ACL placement is important, and the ACL design is dependent on whether it is inbound or outbound.

The general rule for ACL placement is that extended ACLs should be placed as close to the traffic source as possible, and standard ACLs should be placed as close to the traffic destination as possible. If you think about the contents of the ACLs and how they work, this makes sense.

Changing the location or direction of the ACL is something that you normally don't want to do without changing the ACL itself.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.