ACL Ingress/Egress when applied to a VLAN

[MattA]

Hi Folks,

I'm having a hard time understanding when to apply an ACL as Ingress or Egress, specifically when applying it to a VLAN.

For example, I have a switch with 6 VLANs, and one of those VLANs is a guest network that shouldn't be able to access any other VLAN.

Would I apply those deny rules, within one ACL, as an Ingress on the Guest VLAN or an Egress?  Then an explicit permit at the end to allow for internet?

My initial thought was Egress, but I'm stumped after reading this article, How To: How To: Create and Apply an ACL in EXOS | Extreme Portal (force.com)

Thanks
Matt

[Gabriel_G]

Hi Matt,

When applying ACLs to a VLAN, that is effectively the same thing as applying the ACL to all ports that belong to that VLAN. Note that ACLs applied to a VLAN do not touch traffic that is routed into or out-of that VLAN locally.

In EXOS, it's generally easier to apply ingress ACLs vs Egress ACLs as Egress ACLs have more restrictions, less hardware availability, and egress ACLs are not supported on all platforms.

If you're trying to prevent client A from reaching things in network B, it's generally acceptable to apply an INGRESS ACL on the client port, or as close to the client as possible to reduce how far that traffic goes before it's dropped. Alternatively, you could use an EGRESS ACL at the router for network B if you're unsure of where traffic will be ingressing.

Regarding your specific example:
I would apply an ingress ACL to the guest VLAN with a bunch of deny rules that prevents those clients from reaching other networks (via destination-address match condition). Then the permit all at the end will allow for Internet traffic as you suggested.

Hope that helps!