ACL placement — why does it matter where I put it?
Yaron · posted · 76 views
I learned that standard ACLs should go near the destination and extended ACLs near the source. But why? If the ACL blocks traffic either way, what difference does placement make? Can someone explain with a concrete example?
- Standard ACLs only match source IP, so if you put them near the source, you'd block that source from reaching EVERYTHING — not just the one destination you intended. That's why standard goes near the destination, so you can be selective about what gets blocked where. — itayitayy,
- Extended ACLs match source AND destination AND protocol AND port, so you CAN be specific near the source. Putting them there saves bandwidth — unwanted packets get dropped early instead of traveling across the whole network just to be denied at the end. — NivSa,
- The rule I memorize: Standard ACLs near Destination (S and D — the letters match). Extended ACLs near Source (E and S — also match). Sounds silly but it stuck in my head and I never got an exam question wrong on this after that. — 22maya2n2,
- Oh I see now. A standard ACL near the source would block that source from reaching everything, not just the intended destination. That's the key insight I was missing. Near the destination you can be selective because you know where the traffic is going.
1 Answer
Placement matters because an ACL only filters traffic that actually passes through that interface in that direction — and because a badly placed one blocks more than you intended. The classic rule splits by ACL type:
- Standard ACL → close to the destination. A standard ACL matches on source address only. If you put it near the source, you'd block that source from reaching every destination, not just the one you care about. Placing it near the destination lets the traffic flow everywhere else and only filters at the last hop.
- Extended ACL → close to the source. Extended ACLs match source + destination + protocol/port, so they're precise. Put them near the source to drop unwanted traffic early — no point carrying a packet across the whole network just to discard it at the far end. Saves bandwidth and router work.
Two other things that trip people up:
- Direction.
inboundfilters as traffic enters the interface,outboundas it leaves. Pick the one where the traffic is actually crossing. - Implicit
deny anyat the end. If nothing matches, it's dropped — so a lonepermitline silently blocks everything else.
Sketch the flow first: which interface, which direction, source vs. destination. Placement falls out of that.
ariel.lahav22 · answered
- Good summary. One gotcha to add: order within the ACL matters as much as placement — the router stops at the first match, so a broad `permit` above a specific `deny` makes the deny dead code. — ben31833,
Your answer
Answering is a Pro feature. Free accounts can read everything and still like, comment, and connect. Upgrade to Pro →