This article is a part of a video series on Access Control Lists (ACLs).
- What are Access Control Lists?
- Numbered ACL Syntax
- Numbered ACL Configuration
- Named ACL Syntax
- Named ACL Configuration
- IPv6 Access Lists
- Applying ACLs to Interfaces
- ACLs… Closer to the Source or the Destination?
The final video in the ACL video series answers the age old question: Where should you apply ACLs?
Specifically, we’re going to look at the ideas of applying ACLs closest to the source or closest to the destination; and in what cases you should do either, or neither.
The specific subjects and timestamps for what we talk through are below:
- 0:00 – Start
- 0:14 – Topology / Task Introduction
- 0:26 – Standard ACL
- 1:28 – Stepping through the Path to analyze Standard ACL Placement
- 5:20 – Standard ACLs should be applied closest to the Destination
- 5:55 – Extended ACL
- 6:10 – Stepping through the Path to analyze Extended ACL Placement
- 7:59 – Extended ACLs can be applied anywhere you want
- 8:15 – Why should Extended ACLs should be applied closest to the Source
- 8:53 – Practical Networking’s recommendation for ACL Placement
Enjoy!
I’ve always leaned toward destination-side ACLs for simplicity, but the argument about source-side filtering cutting down on unwanted traffic across the network makes me reconsider. Doesn’t that shift also multiply the number of ACLs you have to maintain per source segment?
<a href=”https://nano-bananapro.com/
“>nano-bananapro</a>
Access Control Lists (ACLs) should be placed based on their type to maximize network efficiency and security. Standard ACLs are typically placed closer to the destination because they filter traffic only by source IP address, reducing the chance of blocking legitimate traffic unnecessarily. Extended ACLs, on the other hand, should be placed closer to the source since they can filter traffic based on source and destination IP addresses, protocols, and port numbers. Placing extended ACLs near the source prevents unwanted traffic from consuming network bandwidth, improves performance, and enhances overall security by stopping unauthorized traffic as early as possible.