IT Employment

Ask something
Discussion Locked

Extending Access List

0 helpful
2 replies

by aaintesa

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I kind of get confused with applying access list, either as an in or out on interfaces. Is there someone that can explain it really well
Trying to add access-list 101 permit tcp any x.x.x.x eq 80 to fa0/0 on our LAN? The aim is to allow any one from the internet to get through to the server ( x.x.x.x) only via port 80.
So do i apply as

ip access-group 101 in or ip access-group in

Thanks

2 replies

by p_jensen

The correct syntax is ip access-group 101 in

Preference for the router is to apply the access list outbound on the interface leading to the server that you are controlling the access to. This keeps the router from having to use processing power on every packet coming in on the interface from the network. It only has to worry about those packets going out to the network that the server is located on. By your list statement I am assuming it is an extended list and should, therefore, be placed on the router closest to the source of the traffic to keep any unwanted traffic off the backbone to the server.

Hope this helps

Polly

by aaintesa

Thanks morpjensen.

I think the correct flow will be
ip access-group 101 in

as it is going (with respect to the router) from outside, through the router out into the LAN.

Thanks

This discussion is closed to new replies.