| 3.1 |  | Access Control Lists |
| 3.1.5 |  | Applying ACLs |

| ACLs can be defined without applying them. To make an ACL effective, the ACL must be applied to the interface of the router. Extended ACLs should be applied on the interface closest to the source of the traffic. To block traffic from a source to a specific destination, apply an inbound ACL to E0 on router A instead of an outbound list to E1 on router C .

Traffic on the router can be compared to international travel. If a customs officer wanted to stop certain passengers from boarding a flight from Frankfurt, Germany destined to Paris, France, Frankfurt would be the source of the airplane and Paris would be the destination. The detainment could be applied at the Frankfurt airport, as an outbound block, or the Paris airport, as an inbound block. In this case, the block would be better applied at the Frankfurt airport to save resources. As with international travel, it is best if a router permits or denies traffic closest to the source .

Applying the Access List
Once it is determined what type of ACL should be defined, the next step is to determine where the ACL should be applied. As discussed previously, an ACL can be defined without being applied. No traffic is processed until an ACL is applied to an interface. As shown in Figure , an access list is applied to an interface by using the ip access-group command.