ACL question

[Pieter 't Hart · Accepted solution]

In or out is a design tradeoff.

If you think the router as a separate device and vlans as separate (managed) networks it may be easier to see the difference.
Where do you want to have control of access to the network?

If the network is collapsed into a single switch, with central control, other arguments may apply.

Theoretically "out" gives less overhead than "in". Using "in" gives a simpler configuration.

Using "out" data is filtered before it's passed to the other subnet.
Using in, data from one subnet/vlan to another subnet/vlan is first forwarded to the routing backplane, only then it's filtered out (in to vlan-x).

If you use "out" then for all vlans-a,-b,-c,-d you must add a rule to each separate acl of each vlan's to enable access to vlan-x.
Using "in" you only need the acl on vlan-x to configure.

[Matt Hobbs]

I believe that inbound ACL's are more efficient, and so does the ProCurve training. Sometimes it is simpler to just use outbound ACL's though.

Download the student guide from here and read the ACL chapter. Best thing I ever read when I was first trying to get my head around it.

http://procurve.com/network-training/training/technical/ase/irf.htm

[Pieter 't Hart]

Hey Matt,
That's an interesting link.
I'll surely dive into that in spare hours.

Regards,
Pieter

[Ryan_D]

Thanks to both of you!

[Pieter 't Hart]

Ryan, thanks for assigning points.
Pieter