Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Attention: The Community will be in read-only mode on 12/14/2017 from 12:00 am pacific to 11:30 am.

During this time you will only be able to see content. Other interactions such as posting, replying to questions, or marking content as helpful will be disabled for few hours.

We apologize for the inconvenience while we perform important updates to the Community.

New Member

Another basic ACL question

Somebody please help me understand the concept:

I have VLAN500 on a 6509, with a network of 172.17.x.x and I want to apply an extended ACL to allow any host on that VLAN to telnet to a host on VLAN 600 (network 17.16.x.x). So I created the following ACL

Extended IP access list VLAN500

permit tcp any host 172.16.8.53 eq telnet

and added this line to the VLAN500 interface:

ip access-group VLAN500 out

And it didn't work, until I changed the interface statement to:

ip access-group VLAN500 in

And it really doesn't make sense to me that I would have to apply it in. Why wouldn't I apply it out since any host on the local VLAN can telnet out to a host on another VLAN? If anyone can explain this to me, it would be appreciated. Thanks in adavance.

1 REPLY
Bronze

Re: Another basic ACL question

Hi

The concept is that the packets are checked to the ACL based on how they

travel and as if you would sit on the router. So if you have an ACL in on a VLAN the packets will be checked whene they come from this vlan.

So if you like to have the ACL out you have to change the statements in the ACL

as following:

Extended IP access list VLAN500

permit tcp 172.16.8.53 eq telnet any

Hope that helps you.

Roger

85
Views
0
Helpful
1
Replies
CreatePlease to create content