Where in the router are access lists applied?
In general, Basic access lists are executed as filters on outgoing interfaces. Newer releases of the cisco code, such as 9.21 and 10, do have increased ability to filter on incoming ports. Certain special cases, such as broadcasts and bridged traffic, can be filtered on incoming interfaces in earlier releases. There are also special cases involving console access. Rules, written as ACCESS-LIST statements, are global for the entire cisco box; they are activated on individual outgoing interfaces by ACCESS-GROUP subcommands of the INTERFACE major command. Filters are applied after traffic has entered on an incoming interface and gone through a routing process; traffic that originates in a router (e.g., telnets from the console port) is not subject to filtering. +——————-+ | GLOBAL | | | | Routing | | ^ v Access | | ^ v Lists | +-^–v——–^—v-+ | ^ v ^ v | | ^ v ^ v | A———–>|-| |>>>>Access >>———–>B |1 Group 2 | <————| |<———– | | | | +—–
