I don't understand exactly when an ACL will get applied when on an SVI. Given the following (pseudo) configuration

int vlan 100
  ip address
  ip access-list in in
  ip access-list out out
int gig 1/2
  switchport access vlan 100
int gig 1/3
  switchport access vlan 100
ip access-list extended in
  deny ip any any
ip access-list extended out
  deny ip any any

Could a device on port 1/2 with IP and a device on port 1/3 with talk to each other?

Could the devices on 1/2 and 1/3 talk to the SVI at

Where specifically is the "in/out" demarcation of the SVI?

  • 3
    An ACL on a layer-3 interface is tested whenever traffic passes through the interface. Traffic on the same networks never passes through that interface. Only traffic entering or leaving that network passes through the interface. Simply think of the SVI as a physical interface, then think about when traffic would pass through the physical interface.
    – Ron Maupin
    Apr 29, 2020 at 16:52

2 Answers 2


If the SVI routes a packet, the TTL of that packet will be decreased as it's forwarded. In other words, you can see the SVI as a hop in traceroute.

As Ron Maupin explains, this is not the case for layer-2 switched traffic between hosts on the same VLAN.

If you want the ACL in your example to process traffic between hosts on Giga1/2 and Giga1/3 you may consider using a layer-2 ACL (available on some devices; not all) or configuring a Private VLAN which allows more complex isolation of devices sharing a layer-2 domain.


Actually access -list is configured and apply to switch virtual interface to restrict or allow tràffic to and from among VLANs .

Access-list is mainly used and configure to isolate traffic on same VLANs and allow traffic on different Vlan vise versa as per business requirements

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.