Cisco ACLs — standard and extended access lists

An access control list, or ACL, is an ordered set of permit and deny statements. Cisco IOS compares a packet with the entries from top to bottom and stops at the first match.

Every ACL ends with an invisible deny any or deny ip any any. If no explicit statement matches, the packet is discarded. Add the required permit statements before applying the ACL.

ACLs filter traffic; they do not create routes. The network must already have working Layer 3 connectivity.

A standard IPv4 ACL matches only the source IPv4 address. An extended IPv4 ACL can match protocol, source, destination and Layer 4 ports.

• Standard numbered ACLs: 1–99 and 1300–1999.
• Extended numbered ACLs: 100–199 and 2000–2699.
• Named ACLs use a descriptive name instead of a number.

As a general placement rule, put standard ACLs near the destination and extended ACLs near the source. The final location must still reflect exactly which traffic should be filtered.

ACLs use wildcard masks. A 0 bit means the corresponding address bit must match; a 1 bit means it is ignored.

For common subnet masks, subtract each octet from 255.

host represents one exact address and is equivalent to a wildcard of 0.0.0.0. any represents every IPv4 address and is equivalent to 0.0.0.0 255.255.255.255.

The second statement is essential when all other sources should continue to pass.

Named ACLs make the purpose easier to understand and allow sequence-based editing.

DNS primarily uses UDP 53 but can also use TCP 53, so real policies may need both.

The explicit deny blocks other traffic from LAN 10 to LAN 30. The final permit allows traffic not covered by that restriction to continue normally.

established only checks the TCP ACK or RST flags. It is not a stateful firewall and does not track a complete connection.

An interface supports one IPv4 ACL per direction and per protocol. One inbound and one outbound IPv4 ACL can coexist.

Direction is always from the router interface's point of view.

• Traffic arriving from a PC into the router is inbound on the LAN interface.
• The same traffic leaving toward another router is outbound on the transit interface.
• Return traffic arrives inbound on the transit interface and leaves outbound on the LAN interface.

Trace the packet hop by hop before selecting an interface and direction.

Named ACLs can be edited without deleting the entire list.

On classic numbered ACLs, no access-list 110 removes the complete list.

Use hit counters to confirm which entries match actual traffic. Clear counters before a controlled test when necessary.

The objective is to stop LAN 10 from reaching LAN 30 while allowing other source networks. Because a standard ACL cannot select a destination, place it close to LAN 30.

Verify that PC1 can reach the server before adding the ACL.

Expected result: traffic sourced from 192.168.10.0/24 cannot exit R2 G0/1 toward LAN 30. Other permitted sources can still reach LAN 30.

The objective is to allow LAN 10 to use HTTP and HTTPS on one server, block all other LAN 10 traffic to LAN 30, and leave unrelated traffic unaffected. An extended ACL belongs close to the source, so apply it inbound on R1 G0/0.

Expected result: HTTP and HTTPS to 192.168.30.10 are permitted. ICMP, SSH and other IP traffic from LAN 10 to LAN 30 are denied. Traffic from LAN 10 to other destinations reaches the final permit statement.

Test from the allowed administrator host before closing the existing management session. A mistake can lock out remote administration.

The log keyword generates messages for matching packets. It is useful for testing but can consume CPU and produce many logs on a busy interface.

• Forgetting the implicit deny at the end.
• Placing a broad statement before a more specific one.
• Using a subnet mask instead of a wildcard mask.
• Applying the ACL to the wrong interface or direction.
• Expecting a standard ACL to filter by destination or port.
• Forgetting that ACLs are stateless packet filters.
• Testing before routing and addressing work correctly.
• Editing a numbered ACL without checking whether the full list was removed.

First verify addressing and routes without the ACL. Then inspect the ACL entries, interface assignment, direction and match counters. Generate one controlled test flow and check which counter increases.