|
|
11.2 | |
Access Control Lists (ACLs) | |
| 11.2.4 | |
Placing ACLs |
|
ACLs are used to control traffic by
filtering packets and eliminating unwanted traffic on a network.
Another important consideration of implementing ACLs is where the
access list is placed. If the ACLs are placed in the proper location,
not only can traffic be filtered, but it can make the whole network
more efficient. If traffic is going to be filtered, the ACL should be
placed where it has the greatest impact on increasing efficiency. Suppose the enterprise policy aim is to deny telnet or FTP traffic from Router A Ethernet LAN segment to the switched Ethernet LAN Fa0/1 on Router D. At the same time, other traffic must be permitted. Several approaches can accomplish this policy. The recommended approach uses an extended ACL specifying both source and destination addresses. Place this extended ACL in Router A. Then, packets do not cross Router A's Ethernet, do not cross the serial interfaces of Routers B and C, and do not enter Router D. Traffic with different source and destination addresses will still be permitted. The general rule is to put the extended ACLs as close as possible to the source of the traffic denied. Standard ACLs do not specify destination addresses, so they should be placed as close to the destination as possible. For example, a standard ACL should be placed on Fa0/0 of Router D to prevent traffic from Router A. An administrator can only place an access list on a device that they control. Therefore access list placement must be determined in the context of where the network administrator’s control extends.
|
Web Links