Which direction should ACL be applied

Kiley Arena — Fri, 21 Feb 2020 13:21:57 GMT

Hello there,

I'm adding ACLs to lock down the LAN environment and my core is a 4510+R. I want to block port 80, 443 and 8080 from coming INTO the network. My security guy tells me users use port 80, 443 and 8080 to get out and web services use other ports to come back in. I want to use an extended access-list the likes of:

ip access-list extended NO_HTTP

deny tcp any any eq 80
deny tcp any any eq 443
deny tcp any any eq 8080
permit ip any any

My confusion is: which direction on my SVI do I apply this ACL if I want users to be able to access web sites but block inbound traffic on 80, 443 and 8080? All information I've been able to read says to apply extended ACLs as close to the source as possible. With an SVI, that seems like a grey area?

Any kind of clarification on this would be most helpful and appreciative.

Thanks very much in advance,

Kiley

I think from the perspective

rvasquezmc — Mon, 29 Dec 2014 00:11:27 GMT

I think from the perspective of SVI you have to apply the access list OUT. OUT means that the traffic will be process by the access list after is get routed or exiting the interface in other words packets origin from the outside GOING OUT to your LAN.

topic I think from the perspective in Network Security

Which direction should ACL be applied

I think from the perspective