<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<!-- saved from url=(0014)about:internet -->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <meta http-equiv="Content-Style-Type" content="text/css" />
    <meta name="GENERATOR" content="Quadralay WebWorks AutoMap 2003 Platinum Edition Client for FrameMaker 8.6.6597.0" />
    <meta name="TEMPLATEBASE" content="emwebh8-1-17" />
    <meta name="LASTUPDATED" content="08/01/13 14:47:54" />
    <title>Applying an IP-ACL to an Interface </title>
    <!-- Copyright 2010-2013, Cisco Systems, Inc. All rights reserved. -->

    <link rel="StyleSheet" href="document.css" type="text/css" />
    <link rel="StyleSheet" href="catalog.css" type="text/css" />


<script> 
    var is_chrome = navigator.userAgent.toLowerCase().indexOf('chrome') > -1; 
   
    if(is_chrome){document.domain=document.domain}
   </script>
    <script type="text/javascript" language="JavaScript1.2" src="expand.js"></script>
    <script type="text/javascript" language="JavaScript1.2" src="page.js"></script>

    <script type="text/javascript" language="JavaScript1.2">
     <!--
      function  WWNoOp() {}
      function  WWNoValue() { return ""; }

      var  VarDropDown;

      if (typeof(HTMLHelp_Object) != "undefined")
      {
        VarDropDown = new WWDropDown_Object();
      }
      else
      {
        VarDropDown = new Object();
        VarDropDown.fAnchorOpen  = WWNoOp;
        VarDropDown.fAnchorClose = WWNoOp;
        VarDropDown.fDIVOpen  = WWNoOp;
        VarDropDown.fDIVClose = WWNoOp;
      }
     // -->
    </script>

  
<SCRIPT language="javascript">
<!--
  self.document.write("<link href='"+top.relPath+"shared/style.css' rel='stylesheet' type='text/css'>");
  myid=1716;
  self.document.write("<script type='text/javascript' language='JavaScript' src='"+top.relPath+"shared/con_utils.js'></scr"+"ipt>");
//-->
</SCRIPT>
</head>

  <body onload="highlightSearchTerms();" bgcolor="#ffffff">

    
    <blockquote>
    <a name="top"></a>

    
    


<a name="wp1074114"> </a><h1 class="pTitle">
Applying an IP-ACL to an Interface

</h1>
<a name="wp1074115"> </a><p class="pBody">
You can define IP-ACLs without applying them. However, the IP-ACLs will have no effect until they are 
applied to an interface on the switch. You can apply IP-ACLs to VSAN interfaces, the management 
interface, Gigabit Ethernet interfaces on IPS modules and MPS-14/2 modules, and Ethernet PortChannel 
interfaces.

</p>
<a name="wp1074116"> </a><p class="pBodyAutonumRel">
<strong>Tip	&nbsp;&nbsp;&nbsp;</strong> Apply the IP-ACL on the interface closest to the source of the traffic. 

</p>
<a name="wp1074117"> </a><p class="pBody">
When you are trying to block traffic from source to destination, you can apply an inbound IPv4-ACL to 
M0 on Switch 1 instead of an outbound filter to M1 on Switch 3.

</p>
<a name="wp1074127"> </a><p class="pBody">
The <b class="cBold">access-group </b>option controls access to an interface. Each interface can only be associated with one 
IP-ACL per direction. The ingress direction can have a different IP-ACL than the egress direction. The 
IP-ACL becomes active when applied to the interface.

</p>
<a name="wp1074128"> </a><p class="pBodyAutonumRel">
<strong>Tip	&nbsp;&nbsp;&nbsp;</strong> Create all conditions in an IP-ACL before applying it to the interface.

</p>
<a name="wp1074129"> </a><p class="pCaution">
<table border="0">
<tr>
<td>
<strong>Caution	&nbsp;&nbsp;&nbsp;</strong>
</td>
<td>
<p>If you apply an IP-ACL to an interface before creating it, all packets in that interface are dropped because 
the IP-ACL is empty.
</p>
</td>
</tr>
</table>

</p>
<a name="wp1074130"> </a><p class="pBody">
The terms <em class="cEmphasis">in</em><em class="cEmphasis">, </em><em class="cEmphasis">out</em><em class="cEmphasis">, </em><em class="cEmphasis">source</em>, and <em class="cEmphasis">destination</em> are used as referenced by the switch:

</p>
<div class="pSmartList1"><ul class="pSmartList1">
<a name="wp1074131"> </a><li class="pSmartList1">In&#8212;Traffic that arrives at the interface and goes through the switch; the source is where it 
transmitted from and the destination is where it is transmitted to (on the other side of the router). 
</li>
<a name="wp1074132"> </a><p class="pBodyAutonumRel">
<strong>Tip	&nbsp;&nbsp;&nbsp;</strong> The IP-ACL applied to the interface for the ingress traffic affects both local and remote traffic.

</p>
<a name="wp1074133"> </a><li class="pSmartList1">Out&#8212;Traffic that has already been through the switch and is leaving the interface; the source is 
where it transmitted from and the destination is where it is transmitted to. 
</li>
<a name="wp1074134"> </a><p class="pBodyAutonumRel">
<strong>Tip	&nbsp;&nbsp;&nbsp;</strong> The IP-ACL applied to the interface for the egress traffic only affects local traffic.

</p>
</ul></div>
<hr /><br><p class="pBody">Copyright 2010-2013, Cisco Systems, Inc. All rights reserved.</p> 

    </blockquote>

  </body>
</html>
