1

Your Approach 1 should work, provided it is applied to the interface towards the server (allow only host IP to use TFTP). If you apply that ACL on the ingress interfaces, towards the clients, it should work as well. Applying ACL for ingress traffic should always be preferred. Note that you do need a permit ip any any at the end for an ACL to not drop all ...


Only top voted, non community-wiki answers of a minimum length are eligible