Where do you place a standard ACL and where do you place an extended ACL, and why?
Show the answer
Say this first
Extended ACLs go close to the source. They can match the exact flow, so unwanted traffic is dropped at the first hop, before it uses WAN bandwidth, and nothing else is caught. Standard ACLs go close to the destination. They can only match the source address, so near the source they would block that host or subnet from everything behind the interface, not just the one destination I meant.
Go deeper
Worked example
Branch router R1 has users on 10.1.20.0/24. HQ router R2 has servers on 10.2.50.0/24 and printers on 10.2.60.0/24. Goal: users must not reach the servers, but must still reach the printers and the internet.
- Standard ACL on R1 inbound from the users:
deny 10.1.20.0 0.0.0.255blocks the users from the printers and the internet too. Wrong place. - Standard ACL on R2 outbound toward the server LAN: only traffic heading to the servers is checked. Correct, but the denied packets already crossed the WAN.
- Extended ACL on R1 inbound from the users:
deny ip 10.1.20.0 0.0.0.255 10.2.50.0 0.0.0.255thenpermit ip any any. Dropped at the first router, nothing else affected. Best.
The rule behind the rule
Filter as close to the source as the match criteria allow without collateral damage. Two more factors decide placement in practice:
- Administrative control. You can only filter on devices you own, which is why internet edge ACLs filter traffic arriving from sources you do not control.
- Direction. Inbound ACLs drop packets before the routing lookup. Outbound ACLs catch traffic arriving from every other interface toward one segment, but they do not filter traffic the router generates itself.
They will ask next
Does the rule still matter on modern hardware that filters at line rate?
Performance matters less because switches and routers evaluate ACLs in TCAM. Blast radius and clarity still matter: an extended ACL near the source affects only the flows you named, and the policy sits where the traffic enters, which makes it easier to reason about.
Where would you filter traffic between internal VLANs on a layer 3 switch?
Inbound on the source VLAN's SVI with an extended ACL, or with a VLAN ACL (VACL) when traffic inside the same VLAN must be filtered too. For real policy between zones, a firewall is better.
Traps
- Reciting "standard near destination, extended near source" without the reason. The reason is what the interviewer wants.