What's difference between in and out?When should I use in or out?

Report this post to a moderator

From the Question you are setting a standard IP Access list (1-99) on a router port, and as a rule of thumb it is best to set standard lists "closest to the source" and extended "Closest to the Destination". The in or out... you want to filter the packets that are coming or going so do you want to stop this ip from leaving or entering your router? you can set the access-group in and out just requires more CPU process to filter all the packets...

Report this post to a moderator

An IN access-group blocks traffic going into the routerand an OUT blocks traffic going out of the router.

Use IN access-group if you will be blocking traffic to all networks that are connected to the router.

Use OUT access-group if you want to block traffic to a specicfic network/interface but allow the traffic to the other networks on the router!!

Hope this helps!!

Cy..-

[This message has been edited by CyDiver (edited 12-02-2000).]

Report this post to a moderator

Hi imyty,

Here's another way you can think of it.

Think of the router as your house where people walk in and out all day long. Think of the router ports as doors to your house.

If you want to keep people from coming in to your house, you would apply the ACL as IN.

If you want to keep people from going out of your house, apply the ACL as OUT.


This is a generic as heck explanation, but hopefully it might help!

Report this post to a moderator

Now I know,just as input and output.Thanks a lot.

Report this post to a moderator

Thats a great analogy. I always used it from the perspective of the router interface but you story is nicer to remember!

Report this post to a moderator

In response to nomad's reply, according to Sybex you should place standard access lists as close to the destination as possible and extended access lists should be placed as close to the source as possible. Any other thoughts on this?

Report this post to a moderator