 labeled the points where an access list could be applied. The thing to remember is that these terms are from the device's viewpoint. Interface Interface Figure 25-1. Access list application points Usually, when you're trying to filter traffic, you want to prevent it from getting into the network, or even getting to the device in the first place. Applying access lists to the inbound side of an interface keeps the packets from entering the device, thus saving processing time. When a packet is allowed into a device, then switched to another interface only to be dropped by an outbound filter, resources used to switch the packet have been wasted. Designing Access Lists Reflexive access lists, covered later in this chapter, are applied in both directions. Figure 25-2 shows a small network connected to the Internet by a router. The router is filtering traffic from the Internet to protect the devices inside. As traffic comes from the Internet, it travels inbound on E1, is switched in the router to E0, and is then forwarded to the inside network. If the ACL is applied inbound on E1, the packets will be denied before the router has to process them any further. If the ACL is applied outbound on E0, the router must expend resources switching the packets between interfaces, only to then drop them. ACL applied inbound on E1 Interface Interface Internet ACL applied outbound on E0 Figure 25-2. Access list application in a network Be careful when deleting access lists. If you delete an access list that is applied to an interface, the interface will deny all traffic. Always remove the relevant access-group commands before removing an access list. Naming Access Lists A quick word on naming access lists is in order. It's possible, and encouraged, to name access lists on Cisco routers with logical names rather than numbers, as it makes the configuration easier to read. The drawback of named access lists is that they cannot be used in many of the ways in which numbered access lists can be used. For example, route maps support named a