Application of in and out of ACL

Application of ACL in and out: www.2cto.com R1 S1/1 ip address 192.168.1.1 lo0 1.1.1.1R2 S1/0 192.168.1.2 S1/1 192.168.2.1R3 S1/0 192.168.2.2 S1/1 192.168.3.1 and above lo0 (1.1.1.1) of R1) network Segment cannot access R3 Method 1: apply OUTaccess-list 1 deny 1.1.1.0 0.0.0.255access-list 1 permit anyinterface Serial1/1 ip address 192.168.2.1 255.255.255.0 ip access-group 1 out on R2. ping 192.168.3.1 source 1.1.1.1 but ping 192.168.1.2 method 2: on R2. Use INaccess-list 1 deny 1.1.1.0 0.0.255access-list 1 permit anyinterface Serial1/0 ip address 192.168.1.2 255.255.255.0 ip access-group 1 in. ping 192.168.3.1 source 1.1.1.1. in the direction, the acl rules are used for matching, while in the out direction, the matching is performed (one is that after the out enters the route, the routing table is checked first and then the acl is matched, this may increase the device burden) ACL does not filter your local traffic for ex1.1.1.1 Lo0 -- R1--S1/1--------------------------s1/0--R2-Lo0 2.2.2.2OUT applications on R1 Access-list 1 deny 1.1.1.0 0.0.255access-list 1 Permit anyInt s1/1Ip access-group 1 out. ping 192.168.2.1soure 1.1.1.1 can be used to ping 192.168.2.1 or the routing ACL does not filter local traffic. Because 1.1.1.0 is your own traffic, you must distinguish the following scenarios to prevent confusion! Apply inaccess-list 1 deny 192.168.2.0 0.0.0.255access-list 1 permit any interface Serial1/1 ip address 192.168.1.1 255.255.255.0 ip access-group 1 inR1 ping 192.168.2.1 on R1. of