Content

| 9.6 |  | Securing User Access |
| 9.6.4 |  | Router ACLs |

Router ACLs can be applied on:

- Switch virtual interfaces (SVIs), which are Layer 3 interfaces to VLANs
- Physical Layer 3 interfaces
- Layer 3 EtherChannel interfaces

Router ACLs are applied on interfaces for specific directions (inbound or outbound). One IP access list in each direction can be specified.

One ACL can be used with multiple features (such as QoS) for a given interface, and one feature can use multiple ACLs. When a single router ACL is used by multiple features, it is examined multiple times.

Standard IP access lists use source addresses for matching operations.

Extended IP access lists use source and destination addresses and optional protocol type information for matching operations.

The switch examines ACLs associated with features configured on a given interface and a direction. As packets enter the switch on an interface, ACLs associated with all inbound features configured on that interface are examined. After packets are routed and before they are forwarded to the next hop, all ACLs associated with outbound features configured on the egress interface are examined.

ACLs permit or deny packet forwarding based on how the packet matches the entries in the ACL. For example, access lists can be used to allow one host to access a part of a network, but prevent another host from accessing the same part. ACLs applied at the router input allow Host A to access the Human Resources network, but prevent Host B from accessing the same network.