Reflexive access lists, covered later in this chapter, are applied in both directions. Figure 23-2 shows a small network connected to the Internet by a router. The router is filtering traffic from the Internet to protect the devices inside. As traffic comes from the Internet, it travels inbound on E1, is switched in the router to E0, and is then forwarded to the inside network. If the ACL is applied inbound on E1, the packets will be denied before the router has to process them any further. If the ACL is applied outbound on E0, the router must expend resources switching the packets between interfaces, only to then drop them. ACL applied inbound on E1 Interface Interface Internet ACL applied outbound on E0 Figure 23-2. Access-list application in a network Designing Access Lists Be careful when deleting access lists. If you delete an access list that is applied to an interface, the interface will deny all traffic. Always remove the relevant access-group commands before removing an access list. Naming Access Lists A quick word on naming access lists is in order. Naming access lists on Cisco rout- ers with logical names rather than numbers is possible and encouraged, as it makes the configuration easier to read. The drawback of named access lists is that they can- not be used in many of the ways in which numbered access lists can be used. For example, route maps support named access lists, but dialer maps do not. PIX fire- walls only support named access lists. That is, even if you create an access list named 10 on a PIX firewall, it will be considered a named access list rather than a standard (numbered) access list. When you name access lists, it makes sense to name them well. I've seen many installations of PIX firewalls where the inbound access list is named something like "out." Imaging troubleshooting this command: access-group out in interface outside If you're not used to configuring PIX firewalls, that command might be difficult to interpret. If the access list were instead named Inbound, the command would b