ACL Placement uses the PAT edge topology — extended ACLs close to source, standard ACLs close to destination. ACL Command Builder walks through IOS syntax one field at a time with wildcard learning and packet matching. Troubleshooting fixes broken HTTPS filtering on the dual-site R1/R2 lab.
ACL Placement uses the PAT edge topology — extended ACLs close to source, standard ACLs close to destination. ACL Command Builder walks through IOS syntax one field at a time with wildcard learning and packet matching. Troubleshooting fixes broken HTTPS filtering on the dual-site R1/R2 lab.
Identify the source, then choose where to place a standard or extended ACL.
Why source matters
ACL placement starts by identifying the traffic source. Extended ACLs match source, destination, protocol, and port — place them close to the source. Standard ACLs only match source IP — place them close to the destination.
PAT reminder
PAT changes internal private addresses at the internet edge. Decide what traffic you filter, where the source is, and whether the ACL should see the original inside address.
Block 192.168.10.0/24 from accessing 192.168.20.10 on TCP port 80.
Step 1 — Who is the source?
