Standard IP ACL inbound direction

Question

The command syntax format of a standard ACL is

access-list access-list-number {permit|deny} {host|source source-wildcard|any}.

This is an example of the use of a standard ACL in order to block all traffic except that from source 10.1.1.x.

interface Ethernet0/0 
ip address 10.1.1.1 255.255.255.0 
ip access-group 1 in
access-list 1 permit 10.1.1.0 0.0.0.255 

I have a question: If the Standard ACLs are applied on interfaces closer to the destination, I suppose they are always applied in the outbound direction. Am I wrong or in which situations can they be applied in the inbound direction?

Answer 1

The direction is always in reference to the router itself. In your example, you have applied the ACL inbound on E0/0. So the ACL applies to traffic from the source entering the router on E0/0.

Which direction you apply the ACL depends on what you are trying to do. But generally, it is better to filter as close to the source as possible. There's no point to allowing traffic to flow through the network, just to end up dropping it at the destination.

The exception is where traffic is allowed to one destination, but not another. If, in your example, the source was connected to E0/0, and you had two destinations on E0/1 and E0/2, where the source can talk to E0/1, but not E0/2. In this case, you would put the ACL outbound on E0/2.

Alternatively, you could use an extended ACL inbound on E0/0 that blocks the destination on E0/2.