1

I am a bit confused in the concept of source and destination. Consider that I have to create an extended acl which blocks the access of 192.16.3.0/24 from 192.16.7.0/24. In this case my source is 192.16.3.0/24 and my destination is 192.16.7.0/24. Right?

2
  • 1
    No. Source = from; destination = to. So, you'd have something like access-list BLAH extended deny ip 192.168.7.0 255.255.255.0 192.168.3.0 255.255.255.0 if you wanted to block all IP-based protocols and ports, depending on the model of device you're doing this on. My example would be valid for an ASA but not for a switch or router. – Jesse P. Apr 22 '19 at 15:29
  • It would also depend on the direction in which you apply the ACL to its corresponding interface. – Jesse P. Apr 22 '19 at 15:35
2

Below would be the case you were talking about. Like Jesse P. said, make sure you are assessing flow and context when applying ACLs to objects. Most of the time we want to affect things on the ingress interface. This goes for all sorts of functionality.


access-list BlockFrom7To3 deny ip 192.16.7.0 0.0.0.255 192.16.3.0 0.0.0.255

interface gigabit-ethernet 1
ip 192.16.3.1 255.255.255.0
ip access-group BlockFrom7To3 in

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.