Standard access list

Question

I have following setup

Vlan10

Pc1 192.168.10.20

Vlan20

Pc2 192.168.20.20

Vlan21

Pc2 192.168.21.20

Subnet :255.255.255.0

All connected to layer 3 switch

I have following ACL

Access-list 10 permit 192.168.10.0 0.0.0.255

Access-list 20 permit 192.168.20.0 0.0.0.255

I applied the ACL to vlan 10 as below:

Interface vlan 10
IP access-group 20 in 

Why isn't it not possible to ping from vlan20 device to vlan 10 device ?

I even tried adding

Interface vlan 10
IP access-group 10 out

but it's not working

But if I try

Interface vlan 10
IP access-group 20 out, 

things works fine

If , standard access list checks source address , then we should be using inbound interface right ? But why isn't it working

Could anyone help me with this confusion

Thanks a lot in advance

Answer 1

Standard access lists filter on source addresses. So ACL 20 only allows packets whose source IP is 192.168.20.x. But Vlan 10 is a different subnet, so any packet from VLAN 10 is dropped.

When you put the ACL in the outbound direction, then packet are coming from VLAN 20, and the packets are allowed.

Answer 2

Thanks everyone I got the difference

For all standard ACL , there is an default deny ACE

ACE means the ACL entry:

 access-list 12 permit/deny x.x.x.x x.x.x.x'

Default ACE:  if a packet doesn't match any of the ACE in the ACL , then it is automatically blocked 

So if you want to allow only packets from VLAN 12 ( 192.168.12.0 ) to VLAN 10

U have to create ACE

Access-list 12 permit 192.168.12.0 0.0.0.255

And apply it to VLAN 10 outbound interface ,

Here we choose out bound as the packet is coming in from VLAN 12 and out to VLAN 10

ACL will check for packets coming into VLAN 10 from VLAN 12

So outbound = coming into the VLAN 10
(coming **out to** VLAN 10 **from** any other network )

here we don't want to create ACE to deny all other packets as cisco implements deny any by default

if we would have applied ACL 12 to inbound interface of VLAN 10 then ,

ACL will check for packets coming from VLAN 10 into VLAN 12 , and will reject everything which doesn't match the ACE. As there is no packet with source address 192.168.12.x (all packets from have source 192.168.10.x) , none of the packet will match the ACE. So all packets from VLAN 10 will be discarded and hence VLAN 10 can't communicate with any other network.

If you add ACE permit any , then it will first check the first condition and it doesn't pass, so it will check below condition . As we gave ACe as permit any, all packets will be allowed and there won't be any filtering

ACE: access-list 12 permit any

So in inbound interface ACL will check for packets coming from VLAN 10 to other networks

Hence inbound = coming from the VLAN 10
(coming **in from** VLAN 10 **into** any other network )