Security Basics: Re: ACL design.

["Alex Nedelcu" <alexpheno () gmail com>]

It's also important where you place your ACLS.

If you have an advanced ACL that takes into consideration the source,
destination, ports, TOS etc you should place it as close to the source
of traffic as possible.

If the ACL is based solely on source addresses they should be placed
as close as possible to the destination.

Another thing that you should take into consideration is to never
apply ACLs in the core area of your network, in a hierarchical model
network the traffic policies should be applied at the distribution
layer. You should analyze carefully the design of your network and
find the ideal places where you should implement filtering, if you
choose badly you may get decreased perfomance.