cted to port G0/20 on the switch. The first step in restricting host A's communications is to create the necessary ACL. You must allow access to the default gateway, then deny access to other hosts in the network, and, finally, permit access to the rest of the world. I'm going to continue using named access lists, though numbered access lists are still supported: ip access-list extended Permit-Bob permit ip any host 192.168.1.1 deny ip any 192.168.1.0 0.0.0.255 permit ip any any Once you've created the ACL, you can apply it to the physical interface: I0S-3750(config)#intg1/ IOS-3750 (config-if)#switchport IOS-3750 (config-if)#ip access-group Permit-Bob in Notice that even though this is a Layer-2 switch port, a Layer-3 IP access list can be applied to it. The fact that the IP access list is applied to a switch port is what makes it a port ACL. Port ACLs can also be MAC-based. Here's a small MAC access list that denies Apple- Talk packets while permitting everything else: mac access-list extended No-Appletalk deny any any appletalk permit any any Assigning this access list to an interface makes it a port ACL: IOS-3750 (config)#int g1/0/2 IOS-3750 (config-if)# mac access-group No-Appletalk in MACACLs can be mixed with IP ACLs in a single interface. Here, you can see that the MAC access list and the IP access list are active on the interface: IOS-3750# sho run int g1/0/2 interface GigabitEthernet1/0/2 ip access-group Permit-Bob in mac access-group No-Appletalk in Configuring Router ACLs Router ACLs are probably what most people think of when they think of applying ACLs. Router ACLs are applied to Layer-3 interfaces. Older routers have only Layer-3 interfaces, SO just about all older ACLs were router ACLs. If you were to take the previous example and change the port from a Layer-2 interface to a Layer-3 interface, the ACL would become a router ACL: Chapter 25: Access Lists I0S-3750(config-if)#int g1/0/2 I0S-3750(config-if)#no switchport I0S-3750(config-if)#ip access-group Permit-Bob in MAC access lists cannot be assi