Enhancing Security
217
Because the access list one creates will be applied to port E0, one must
specify that port in an interface command. In addition, one would use the
ip access-group
command to apply an access list to a particular direction.
The format of that command is shown below:
ip access-group
[list number] {in/out}
Thus, the access list would be as follows:
interface S0
ip access-group 1 out
access-list 1 deny 198.78.46.0 0.0.0.255
Note that the preceding access list blocks all packets from LAN A from
flowing into the Internet. The reason one does not use the E0 interface is
because if one did, it would block LAN A users from accessing LAN B. Also
note that when one uses a standard access list, there is no way to specify a
particular TCP ...