ACL Behavior with Local vs Transient Traffic

In networking, it is essential to distinguish between transient traffic and locally generated traffic when configuring routers. Transient traffic is associated with the data plane, which refers to the traffic that simply passes through the router. This type of traffic is typically subject to Access Control Lists (ACLs) applied to router interfaces.

Conversely, locally generated traffic, which originates from the router itself, is usually control plane traffic. This includes various protocol exchanges such as OSPF, EIGRP, BGP, and management protocols such as SNMP, Syslog, NTP, TFTP, DNS, HSRP, etc. Traffic generated by the router is not checked against outbound interface ACLs on Cisco routers.

If there is a need to filter and control locally generated traffic, network administrators can employ Control Plane Policing (CoPP). CoPP allows for the management and filtering of control plane traffic without impacting the data plane, ensuring essential protocol operations remain unimpeded.

Links

https://networklessons.com/security/introduction-to-access-lists-on-cisco-ios-router

https://networklessons.com/security/copp-control-plane-policing