TCP 'established' keyword with SVI interfaces

[tedauction]

Hello, I am trying to clarify:

I have an SVI inteface and I want to block externally generated traffic coming in to my LAN unless it was originated by internal LAN clients.

Therefore I was going to used the 'established' keyword with an 'inbound' ACL. Do I have my directions correct ?

Thank you kindly.

permit tcp x.x.x.x x.x.x.x. x.x.x.x x.x.x.x  eq x established

Placed on SVI interface:

access-group RestrictTCP inbound

[Reza Sharifi]

Hi,

If you are trying to block externally generated traffic coming to this vlan, the acl needs to be applied in outbound direction.  Inbound is used for traffic coming from hosts in the same vlan. 

HTH