# Standard access-list example on Cisco Router **URL:** \ **Category:** Lessons Discussion\ **Created:** [December 22, 2016, 12:33am UTC](https://forum.networklessons.com/t/standard-access-list-example-on-cisco-router/889 "2016-12-22T00:33:02Z")\ **Posts on this page:** 6\ **Page:** 4
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [June 4, 2024, 6:12am UTC](https://forum.networklessons.com/t/standard-access-list-example-on-cisco-router/889/68 "2024-06-04T06:12:11Z")
Hello Shivam > [@shivam0367](#): > > Can you advised why we can not permit traffic from network 192.168.12.0/24 on outbound interface of Router 2 , if traffic is flow from R1 to R2 , I m confused how to elect inbound and outbound interface while creating ACL , can you help me please with some example and scenerio ?? There is one more command that needs to be applied beyond what you have included in your post. As shown in the lesson, you must apply the ACL that you have created like this: ```auto R2(config)#interface fastEthernet 0/0 R2(config-if)#ip access-group 1 in ``` This command applies the ACL in an inbound direction on the interface. So the filtering will be applied to packets that are ingressing on the interface. So, with this scenario, R2 has been configured to filter incoming packets on the Fa0/0 interface. It has been set up to allow only those packets with a **source IP address** within the 192.168.12.0/24 network. The implicit `deny any` statement at the end filters out all other packets. The direction you apply on the `access-group` command indicates whether the ACL filtering is applied on ingress or egress packets. > [@shivam0367](#): > > Can you help me to understand the question asked by hroger very diffuct to undertsand seems some confusion in looback why acl not applied on loop back interface ? I don’t fully understand the question either! But I think it has to do with best practices concerning where to place standard access lists. I answered him as best I could in the following post: > [@Standard access-list example on Cisco Router](https://forum.networklessons.com/t/standard-access-list-example-on-cisco-router/889/39): > > Hello Hugues In this lesson, the standard inbound access list is applied to Fa0/0 of R2. So any ping coming from R1 destined for the loopback will be blocked on its way in. Standard access lists filter based on the source address. For this reason, best practice is to place the access list as close as possible to the expected source of traffic. Now if you want to filter traffic on a loopback interface, configuring an ACL on the loopback interface itself will not filter traffic. This is true… I hope this has been helpful! Laz ---
**Author:** ![shivam0367](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/shivam0367/32/2540_2.png) [@shivam0367](https://forum.networklessons.com/u/shivam0367)\ **Post date:** [June 8, 2024, 4:48pm UTC](https://forum.networklessons.com/t/standard-access-list-example-on-cisco-router/889/69 "2024-06-08T16:48:20Z")
Hi Rene /Laz , Hope you are doing well , Can you help me to understand what is local generated traffic and how we can filter it on router ![image](https://forum.networklessons.com/uploads/default/original/2X/3/3a271b83eb4620b34b5c9400794e232cad91dc2d.png) Some posts discuss using Control Plane Policing and the Extended Outbound ACL to filter locally generated traffic. I’m not sure how to interpret this as I’ve been stuck on the same topic for the last ten days, and my ENCOR exam is next month.Please take the necessary action and provide a scenario.It really urgent me to finish this topic any how and see the snap it totally contradict if u read the post answered by rene on same ![image](https://forum.networklessons.com/uploads/default/original/2X/e/e5cc0a59d2dc89ca0565940e228e5109f8dd39cd.jpeg) what it means router will not filter the traffic that is destined to router itself , can you explain it more in details ? Regards Shivam Chaudhary ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [June 11, 2024, 6:38am UTC](https://forum.networklessons.com/t/standard-access-list-example-on-cisco-router/889/70 "2024-06-11T06:38:57Z")
Hello Shivam > [@shivam0367](#): > > Can you help me to understand what is local generated traffic and how we can filter it on router The two types of traffic that are described here have to do with what device is generating the traffic and what device is receiving the traffic. Take a look at this topology: ![image](https://cdn-forum.networklessons.com/uploads/default/original/2X/8/814a6ce3ff0b84ee26b67fd16654ecdb643f0143.png) - **Transient traffic** is traffic that goes through a router, but **the source and destination IPs found within the packets DO NOT belong to the router itself**. When H1 sends a packet to H2, it has a source address of 192.168.12.1 and a destination address of 192.168.34.4. When R2 receives this packet, since the source and destination IP addresses **do not belong to R2** , it will forward it along based on the routing rules. For R2, this is **transient traffic**. Traffic that goes through but is not destined for R2. - **Locally generated traffic** is traffic that the router itself creates and generates. For example, R2 may send an OSPF update to R3. The source IP address of that OSPF update is 192.168.23.2, **which is R2’s IP address**. It is sourced from the router R2 itself, thus it is locally generated. Similarly, R3 will receive this OSPF update and it will see that the **destination address is its own**. R2 will never filter this outgoing traffic since it has **its own IP address as the source address** in the packet, and R3 will never filter this incoming traffic **because the destination address is its own**. The only way to filter traffic that is generated by the router itself, or is destined to the router itself is to use [Control Plane Policing (CoPP)](https://networklessons.com/system-management/copp-control-plane-policing). I hope this has been helpful! Laz ---
**Author:** ![shivam0367](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/shivam0367/32/2540_2.png) [@shivam0367](https://forum.networklessons.com/u/shivam0367)\ **Post date:** [June 12, 2024, 7:20pm UTC](https://forum.networklessons.com/t/standard-access-list-example-on-cisco-router/889/71 "2024-06-12T19:20:11Z")
Hi Laz , Once more, why do you emphasize using an extended access list to filter locally generated traffic, and when does control plane policing become relevant? Help me to what Rene want to explain it here ![image](https://forum.networklessons.com/uploads/default/original/2X/e/e21d5d9733f6d4c54a0c7dc565b8e9c804a49561.png) Many thanks for the support Regards Shivam chaudhary ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [June 15, 2024, 7:19am UTC](https://forum.networklessons.com/t/standard-access-list-example-on-cisco-router/889/72 "2024-06-15T07:19:56Z")
Hello Shivam My apologies. [That post](https://forum.networklessons.com/t/standard-access-list-example-on-cisco-router/889/20) contained incorrect information. I have updated it so that it is now correct. Control Plane Policing or CoPP becomes relevant because only with CoPP can you filter traffic that is generated by a local interface on the device itself. Otherwise, normal ACLs that are applied to interfaces will not filter any such traffic. I hope this has been helpful! Laz ---
**Author:** ![shivam0367](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/shivam0367/32/2540_2.png) [@shivam0367](https://forum.networklessons.com/u/shivam0367)\ **Post date:** [June 15, 2024, 7:46am UTC](https://forum.networklessons.com/t/standard-access-list-example-on-cisco-router/889/73 "2024-06-15T07:46:49Z")
> [@lagapidis](#): > > therwise, normal ACLs t Hi Laz , Thank you very much now will come again on new topic with new doubts Regards Shivam [Previous page](https://forum.networklessons.com/t/standard-access-list-example-on-cisco-router/889.md?page=3)