Experiencing a mental overload with ACL settings
Experiencing a mental overload with ACL settings
It simplifies entering a /32 mask. You're right about filtering through the interface—always aiming for the source when feasible, then adjusting based on traffic flow direction.
In this scenario, I'm blocking internet or external network traffic from reaching a specific router's interface.
You should list the destination IP as the host name followed by its IP address, or use a wildcard mask if you need to cover multiple ranges. A subnet format isn't standard for this purpose.
Relies on your blocking location but generally targets the interface directly (uncommon) rather than routing through it to hosts or subnets. To restrict external traffic, use a static IP rule denying any host or network access.
Lurick explained the approach will depend on your blocking needs. You may choose "deny host" for simple interface blocking or "deny ip [network|wildcard]" to restrict specific devices. For full internet access control, you'll need two ACLs and define traffic rules per interface.