liveBook · Manning

Ip access-group

As explained in Acing the CCNA Exam: Volume 1 Fundamentals and Protocols

ip access-group is a Cisco IOS interface-configuration command that applies an IP access control list in an inbound or outbound direction.

ip access-group applies an IP access control list (ACL) to a router interface, controlling packets in an inbound or outbound direction. An ACL has no effect until attached to an interface. section 23.2.1 section 23.4

Use the command in interface configuration mode:

  • ip access-group {number | name} in applies the ACL as packets enter the interface. section 23.2.2 section 23.4
  • ip access-group {number | name} out applies the ACL as packets leave the interface. section 23.2.1 section 23.4
  • Apply a standard ACL close to the destination so traffic for the protected LAN is filtered without unnecessarily affecting other traffic. section 23.2.1

Applying ACL 1 outbound

On R2, enter interface g0/0 followed by ip access-group 1 out. Verification with show ip interface g0/0 reports “Outgoing access list is 1.” Packets leaving G0/0 are then evaluated against ACL 1; traffic denied by an ACE is filtered, while permitted traffic continues. section 23.2.1

R2(config)# interface g0/0
R2(config-if)# ip access-group 1 out         #1
R2(config-if)# do show ip interface g0/0
GigabitEthernet0/0 is up, line protocol is up (connected)
Internet address is 192.168.3.1/24
. . .
Outgoing access list is 1                    #2
Inbound access list is not set
. . .
#1 Applies ACL 1 outbound on G0/0
#2 ACL 1 is applied outbound (outgoing).

Review the complete Cisco IOS configuration and verification output for attaching ACL 1 outbound to R2 G0/0. section 23.2.1

How Acing the CCNA Exam: Volume 1 Fundamentals and Protocols covers it

How deep it goes
Explains syntax, direction, verification, packet effects, and standard-ACL placement, but defers broader ACL editing details.
Examples
Uses ACL 1 outbound on R2 G0/0 and BLOCK_MARTHA_BOB inbound on R2 G0/2 to demonstrate layered packet filtering.
What it assumes
Assumes familiarity with IP ACLs and ACEs while demonstrating interface attachment and packet direction.
What you can do after
Operate/configure an interface ACL and verify its inbound or outbound attachment with show ip interface.
How it connects
Connects interface configuration with IP access control lists, standard ACLs, named ACLs, ACEs, and packet filtering.
Cover of Acing the CCNA Exam: Volume 1 Fundamentals and Protocols
liveBookmanning.com
Read Acing the CCNA Exam: Volume 1 Fundamentals and Protocols on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Acing the CCNA Exam: Volume 1 Fundamentals and Protocols. The section links point to the parts of the book it draws on.