access-group in

[jackie_gx]

when i apply "access-group in" at a interface with some ACL.

is the ACL will match the route learn from that interface or it will match the packet that go in that interface?

[manish arora · Accepted solution]

Hi Jackie,

Not quite sure if I understood the question properly , but access list are applied to the interface using access-group commands , access-list can filter traffic based on source/dst IP  and/or  tcp/upd ports. so, if you want to filter a route that is being learned using any routing protocol you will have to use Distribute list or prefix list etc.

here's a little howto on filtering routes :-

http://www.petri.co.il/how-to-use-a-distribute-list-to-filter-out-routing-updates-in-cisco-ios.htm

Manish

[Latchum Naidu · Accepted solution]

Hi,

ip access-group in --> This defines access control on packets transmitted from the host. These packets are received into the router interface.

ip access-group out --> This defines access control on packets being sent to the host. These packets are transmitted out of the router interface. The default is out.

To configure an access list to be used for packets transmitted to and from the host, use the ip access-group interface configuration command. To disable control over packets transmitted to or from a host, use the no form of this command.

With this command in effect, various fields within the packet are compared to criteria within the access list for acceptability and dropped or passed. Some of the fields that can be compared include: source IP address, destination IP address, protocol, source port number and destination port number.

Hope the above clear you...

Please rate the helpfull posts.
Regards,
Naidu.