Outbound vs inbound accesslists on catalyst?

[cisco]

Hi,

I want to configure accesslists on my Catalyst 3750X-switches to protect different VLANs/networks. Are there any best-practises or suggestions about inbound versus outbound accesslists? In my head it is more readable and easier to understand the config when accesslists are assigned outbound on the VLAN to protect instead of assigning them inbound on all possible source-VLANs. But of course, from a performance point-of-view it is better to use inbound access-lists to avoid un-necessary routing etc.

Any tips on this?

Best regards,

Thor-Egil               

[Ton V Engelen · Accepted solution]

Hi,

i ll give it a try.

For instance, suppose i want to block rdp traffic from certain subnets, only towards my server vlan (where server vlan svi = Vlan 20)

ip access-list ext BLOCK-RDP

deny tcp eq 3389

permit ip any any

interface Vlan 20

ip access-group BLOCK-RDP out

But if i want to block for instance snmp from any client subnet (lets say here svi Vlan 30 and 40)  towards any destination in my network i would use

ip access-list ext BLOCK-SNMP

10 deny udp eq 160

20 permit ip any any

interface Vlan 30

ip access-group BLOCK-SNMP in

interface Vlan 40

ip access-group BLOCK-SNMP in

Ofcouse it all depends on the topology, but this is more or less how i use it.

I m not sure if this is best practise, ( i think best practise was something like "as close to the source as possible") but it serves all needs while hardly impacting performance.

The only performance impact i see is when adding an acl or a rule in an acl. There is a short cpu spike then, towards 30% on a 6509-E. It goes back to 10% in no time.

It will probably comsume a bit more on a 3750X.

i use about 25 acls or so on about 25 - 30 SVI's.