Another variant: Filtering using access-group

• ! access-list 123 permits all packets
• ! from the customer
• ip access-list 123 permit ip 192.0.2.0 0.0.0.255 0.0.0.0 255.255.255.255
• interface fastEthernet0/0
• ip access-group 123 in

• This is less efficient and more difficult to configure