This topic describes how ACLs are applied on the Cisco 8000 Series Router, and provides guidelines for referencing ACLs on terminal lines and network interfaces.
After you create an ACL, you must reference the ACL to make it work. ACLs can be applied on either outbound or inbound interfaces. This section describes guidelines on how to accomplish this task for both terminal lines and network interfaces.
Set identical restrictions on all the virtual terminal lines, because a user can attempt to connect to any of them.
Summary
These are the ways in which an ACL can be applied on an interface:
-
Inbound ACL: Applies to packets arriving at the router, before they are routed.
-
Outbound ACL: Applies to packets after they have been routed to a controlled interface, before they leave the router.
Workflow
These stages describe how Cisco IOS XR software processes packets against an applied ACL:
-
For inbound ACLs, after receiving a packet, Cisco IOS XR software checks the source address of the packet against the ACL. If the ACL permits the address, the software continues to process the packet. If the ACL rejects the address, the software discards the packet and returns an ICMP host unreachable message. The ICMP message is configurable.
-
For outbound ACLs, after receiving and routing a packet to a controlled interface, the software checks the source address of the packet against the ACL. If the ACL permits the address, the software sends the packet. If the ACL rejects the address, the software discards the packet and returns an ICMP host unreachable message.
-
When you apply an ACL that has not yet been defined to an interface, the software acts as if the ACL has not been applied to the interface and accepts all packets. Note this behavior if you use undefined ACLs as a means of security in your network.