ip access-group [number] [direction]
Binds an existing Access Control List (ACL) to a specific network interface and defines the direction of traffic flow it will inspect. Without this command, an ACL is just a dormant text file sitting in the router's memory.
Quick Reference
Router(config-if)#no ip access-group [number] [in/out]Syntax & Processing Logic
| Direction | Router Behavior & Best Practices |
|---|---|
| in | Inbound Processing: The router checks the packet against the ACL before it looks at the routing table. If the packet is denied, it is dropped immediately. Best Practice: Used heavily with Extended ACLs to save CPU cycles. |
| out | Outbound Processing: The router processes the routing table first, determines the exit interface, and then checks the ACL before pushing it onto the wire. Best Practice: The standard application for Standard ACLs. |
CLI Deployment Scenarios
Scenario 1: Applying a Standard ACL
You created Standard ACL 10 to block a specific malicious IP address (192.168.1.50) from reaching a sensitive database server on GigabitEthernet0/1. Standard ACLs must be placed as close to the destination as possible, applied outbound.
Scenario 2: Applying an Extended ACL
You created Extended ACL 100 to block all HTTP traffic leaving the Guest WiFi VLAN (GigabitEthernet0/0). Extended ACLs are placed as close to the source as possible, applied inbound, so the router doesn't waste time routing packets it will eventually drop.
CCNA Exam Gotchas
Applying an Empty ACL
If you execute ip access-group 50 in, but you haven't actually created ACL 50 yet, what happens?
Unlike an ACL with entries (which ends in an implicit deny), an empty or non-existent ACL applied to an interface acts as a permit any. The router will allow all traffic to pass until you add the first line to ACL 50, at which point the implicit deny drops into place.
The "Self-Generated" Traffic Exception
An outbound ACL applied to a router interface will only filter traffic passing through the router from other devices. It will never filter traffic generated by the router itself (e.g., if you ping out from the router's own CLI, or if the router generates an OSPF routing update).