Simplifying switch ACL rules

[JA3]

As an example if I want to block or allow a subnet from accessing a few hosts on a different subnet I have a seperate rule for each destination / host (keeping the same source) e.g.

Rule #1 Source 192.168.1.0/21 Destination: 10.10.20.20

Rule #2 Source 192.168.1.0/21 Destination: 10.10.20.21

Rule #3 Source 192.168.1.0/21 Destination: 10.10.20.22

Can I instead have one rule where the destination is 10.10.10.20/30 so that all hosts are covered?

[RaphaelL]

Yes. I don't see why it wouldn't cover it.

[KarstenI · Accepted solution]

Yes, but you are covering one host more than wanted. You have to decide if that is a problem.