Security
Standard and Extended ACLs (IPv4)
Access control lists filter IPv4 traffic based on source and/or destination criteria. They are processed top down with an implicit deny at the end of every list.
What you need to know
- Standard ACLs (numbered 1-99, 1300-1999) filter on source address only and should be placed close to the destination.
- Extended ACLs (numbered 100-199, 2000-2699) filter on source, destination, protocol, and port, and should be placed close to the source.
- Every ACL has an implicit deny any at the end, even if not visible in the configuration.
- Wildcard masks are the inverse of a subnet mask; a 0 bit means match exactly, a 1 bit means ignore.
- Named ACLs (ip access-list standard|extended NAME) allow editing of individual lines by sequence number.
- An interface can have only one ACL per protocol, per direction (in or out).
- Router-generated traffic and routing protocol packets are not automatically exempted from ACLs applied to an interface.
Configuration commands
| Command | Mode | Purpose |
|---|---|---|
| access-list 10 permit 192.168.1.0 0.0.0.255 | config | Create a standard numbered ACL permitting a source subnet. |
| access-list 10 deny any | config | Explicit deny statement (optional, implicit deny already applies). |
| access-list 110 permit tcp 192.168.1.0 0.0.0.255 any eq 80 | config | Create an extended numbered ACL permitting HTTP from a subnet. |
| access-list 110 deny ip any any | config | Explicit deny all at end of extended ACL. |
| ip access-list standard BLOCK-HOSTS | config | Create a named standard ACL and enter ACL configuration mode. |
| 10 permit 10.0.0.1 | config-acl | Add a sequenced entry inside a named ACL. |
| ip access-list extended WEB-ONLY | config | Create a named extended ACL. |
| deny tcp any any eq 23 | config-acl | Deny Telnet inside a named extended ACL. |
| interface gi0/1 | config | Enter interface configuration to apply the ACL. |
| ip access-group 110 in | config-if | Apply an ACL to an interface in the inbound direction. |
| ip access-group WEB-ONLY out | config-if | Apply a named ACL to an interface in the outbound direction. |
Verify it
- show access-lists
- show access-lists 110
- show ip interface gi0/1
- show ip interface brief
- show running-config | section access-list
Common mistakes
- Placing an extended ACL near the destination instead of the source, blocking more traffic than intended.
- Forgetting the implicit deny any and wondering why all other traffic is dropped.
- Using a subnet mask instead of a wildcard mask in the access-list statement.
- Editing a numbered ACL with more access-list lines instead of using no access-list first, causing entries to append incorrectly.
- Applying the ACL to the wrong interface or wrong direction (in vs out).
Practise Standard and Extended ACLs (IPv4) in a real CLI
Generated labs, graded against the simulated network state.