2

Let's say I have a vlan 1 with domain 192.168.10.0 0.0.0.255...also a vlan 2 with 192.168.20.0. 0.0.0.255..These are connected to router with intervlan enabled. Now I want to implement access list with ip-access group in...Since the traffic is checked when leaving the vlan in direction to the interface, can I use permit TCP any destination destination_wildcard-mask instead of TCP source source_wildcard-mask destination destination_wildcard-mask? Since every traffic leaving the network must originate from within that network?

Improve this question

1 Answer 1

Reset to default
2

Since the traffic is checked when leaving the vlan in direction to the interface, can I use permit TCP any destination destination_wildcard-mask instead of TCP source source_wildcard-mask destination destination_wildcard-mask?

Yes. The any keyword is translated to 0.0.0.0 255.255.255.255, and it literally means any address. Using any as the source means that the effect is any source address (even spoofed source addresses, which are possible from hosts on your VLAN, regardless of the network addressing on that VLAN) will match the ACL source address.

Cisco has a document that explains ACLs: Configure and Filter IP Access Lists.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.