I am a bit confused in the concept of source and destination. Consider that I have to create an extended acl which blocks the access of from In this case my source is and my destination is Right?

  • 1
    No. Source = from; destination = to. So, you'd have something like access-list BLAH extended deny ip if you wanted to block all IP-based protocols and ports, depending on the model of device you're doing this on. My example would be valid for an ASA but not for a switch or router.
    – Jesse P.
    Apr 22, 2019 at 15:29
  • It would also depend on the direction in which you apply the ACL to its corresponding interface.
    – Jesse P.
    Apr 22, 2019 at 15:35

1 Answer 1


Below would be the case you were talking about. Like Jesse P. said, make sure you are assessing flow and context when applying ACLs to objects. Most of the time we want to affect things on the ingress interface. This goes for all sorts of functionality.

access-list BlockFrom7To3 deny ip

interface gigabit-ethernet 1
ip access-group BlockFrom7To3 in

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.