IP ACCESS LIST simple understanding problem

[B@B@r]

Dear all please solve my confusion on basic concept of ACLS

[Georg Pauwen]

What do you want to achieve ? And what means 'working' and 'not working' ? You want to deny TELNET traffic from left to right router ?

That said, with your access list and just that one deny statement, all traffic will be blocked, due to the implicit deny rule in access lists.

[B@B@r]

i want to achieve : Babar could not telnet tipu. (deny telnet from babar)
Not working : means when i apply access-list to out on interface fa0/0 , it is telneting tipu.
working : mean when i apply same access-list as IN on int fa0/0 , it is achieving my goal.
i intentionally apply one deny statement coz i am learning the concept . and i want to block telnet from babar to tipu

[paul driver · Accepted solution]

Hello

The reason for that is the acl egress (outbound) isnt being matched on due to the fact you are sourcing from the BABAR rtr itself ( Mgt/control plane - traffic originated from the router itself) and not its data plane ( traffic traversing the rtr) and as such no traffic is hitting the outside interface, if you had a device internal to BABAR rtr then that would indeed match the acl and be denied.

As for the ingress (inbound) acl, well traffic is being matched due to the return traffic from outside the BABAR rtr  and as such it will be denied.

res

Paul

[B@B@r]

its mean that if traffic generate by router itself : either its int fastethernet , serial or loopback or tunnel access. it Not in data plane its in control plane and IN and OUT will only effect on data plan traffic. The IN(ingress) or OUT(egress) will behave differently when its generated by rtr itself and when it is transit traffic

[Julio E. Moisa]

Hi

As the traffic is being originated into BARBAR router it will not be applied to the ACL, it will work for transit traffic (data plane) only, so you should apply the ACL under TIPU's interface facing BARBAR with IN (inbound).

Hope it is useful

:-)

[B@B@r]

1--its mean that if traffic generate by router itself : either its int fastethernet , serial or loopback or tunnel access. it Not in data plane its in control plane while the IN and out will only effect on Data plane . The IN(ingress) or OUT(egress) will behave differently when its generated by rtr itself and when it is transit traffic...

2- suppose if i couldn't have privileges to apply ACL under TIPU's BOSS rtr interface facing BABAR with in?
So then i have only option to apply it IN of Babar facing TIPU's. But when we enable debug or packet tracer (wireshark) tipu intface fa0/0. The boss router TIPU will show that someone is TELNETing . isnt it other way to stop it? so that MY BOSS router found that i am good NEtwork ENginner do what He want..

:) not any telnet request

i want that my boss router could not revieve any pack of telnet form BABAR. although it is block at BABAR side but i want it in that way?

Thankyou guys...