AvailabilitySign inBook a DemoJoin Waitlist
Back to Learning
CCNA · 200-301Intermediate

Extended ACL: Direction and Placement

An extended ACL is applied outbound on the server-facing interface instead of inbound on the client-facing one. Diagnose it and fix it yourself, live, right below.

Interactive simSecurityACL

Symptom

The ACL syntax is valid, yet return traffic fails. Determine the correct interface direction and placement for the policy.

Your mission

Prove the cause, then fix it

Format

Guided CLI investigation

Start interactive labSee the investigation plan ↓Need a hint? Reveal the root cause ↓
Extended ACL: Direction and Placement

Investigate before you configure.

Use the CLI evidence to isolate the fault, make the smallest safe correction, then verify the network state changed.

Observe the symptom and link state.

Diagnose by comparing the protocol evidence.

Verify the expected device state and confirm the original symptom is resolved.

Console access: R1

This workspace stacks for portrait phones. Rotate to landscape for the full split-screen console.

Need a hint?

Reveal the root cause when you're ready.

Try the investigation first, then use this as your escape hatch, not a dead end.

Locked

Sign up with your email to open Extended ACL: Direction and Placement, free. You get the root cause and the full step-by-step fix.

No spam. The fix lands in your inbox too. Signing up includes 4 guided labs free, tracked against your email. After that, the Learning Pass unlocks every remaining lab.

Lab debrief

Turn the session into a repeatable troubleshooting pattern.

Use this reference after your attempt: first explain the symptom, then verify the evidence, then confirm the repair.

The problem

An extended ACL intended to block one client subnet from a server is applied outbound on the server-facing interface, unintentionally blocking reply traffic instead of the original request.

What you'll practice

  • Trace a packet path
  • Read ACL attachment direction
  • Apply extended ACL placement guidance
  • Use ACL counters to verify matches
Build the wildcard mask yourself — free Subnet Workbench

The topology

A client VLAN reaches a server VLAN through one router; the policy should affect only the selected client traffic.

Commands to run yourself

The real diagnostic commands for this lab, copy-paste ready. Run these in the same order to reproduce the investigation on your own session.

Inspect ACL attachment
show ip interface
Read ACL entries and counters
show access-lists
Inspect routing path
show ip route
Extended ACL: direction and placementACL 101 is attached in the wrong direction on the wrong interface.Client VLAN192.168.10.0/24R1Gi0/0 · Gi0/1Server192.168.20.100Gi0/0 (client-facing)no ACL applied hereGi0/1 (server-facing)ip access-group 101 outACL 101's direction and interfaceIt filters outbound on Gi0/1, not inbound on Gi0/0.

Frequently asked

Why not just apply the ACL outbound on the server interface? Wouldn't that also stop the traffic?

Applying it outbound on the server-facing interface evaluates traffic as it leaves toward the server, after routing has already happened, which also catches unrelated return and transit traffic. Applying it inbound on the client-facing interface filters only the traffic actually entering from the source subnet, before it's routed anywhere else.

Ready to run this lab yourself?

No setup, no image sourcing. Book a session or ask for a live demo.

View availabilityBook a demo