1. What Is an ACL in Networking?

An Access Control List (ACL) is a set of rules configured on a router or Layer 3 device to permit or deny network traffic.

Network administrators use ACLs to control which devices can communicate with other devices or access specific services.

Why Are ACLs Important?

• Control traffic between different networks.
• Restrict unauthorized access to network resources.
• Allow specific devices to communicate.
• Filter traffic based on IP addresses and protocols.
• Improve network security through traffic filtering.

2. Types of Cisco ACLs

Standard ACL

A Standard ACL filters traffic based only on the source IPv4 address.

Standard numbered ACL ranges are 1–99 and 1300–1999.

Extended ACL

An Extended ACL can filter traffic using multiple criteria:

• Source IP address
• Destination IP address
• Protocol (TCP, UDP, ICMP, etc.)
• Source and destination port numbers

Common numbered ranges are 100–199 and 2000–2699.

Standard vs Extended ACL

3. Understanding ACL Processing

ACL rules are processed from top to bottom. The first matching rule determines whether the packet is permitted or denied.

Every ACL also has an implicit deny at the end. Traffic that does not match a permit statement is denied.

Incoming packet
      |
      v
Check ACL rule 1
      |
   Match?
   /    \
 Yes     No
 |        |
Permit/   Check next
Deny      rule
 |
End
    

Important: Rule order matters. A broad deny rule placed before a required permit rule can block legitimate traffic.

4. Lab 1 – Configure a Standard ACL

In this lab, we will prevent PC1 from accessing a remote network while allowing PC2 to communicate.

Network Topology

PC1                  PC2
 |                    |
 +------ Switch ------+
           |
          R1
           |
      Remote Network
           |
          R2
           |
       Server LAN
    

IP Addressing Table

Configure the PC default gateways as 192.168.1.1 and the server default gateway as 192.168.2.1.

Configure the router interfaces with the listed IP addresses and enable them using no shutdown. Add routing between the two LANs, for example, using static routes.

5. Step 1 – Configure the Standard ACL

We want to deny traffic from PC1 (192.168.1.10) while allowing other source addresses.

On R1, enter:

enable
configure terminal

access-list 10 deny host 192.168.1.10
access-list 10 permit any
    

Explanation:

• access-list 10 creates Standard ACL number 10.
• deny host 192.168.1.10 blocks traffic from PC1.
• permit any allows all other source addresses.

6. Step 2 – Apply the ACL to an Interface

Apply the ACL inbound on R1's LAN interface:

interface gigabitEthernet 0/0
ip access-group 10 in
exit
    

This checks packets as they enter R1 from the local LAN.

Because the ACL is applied inbound on the LAN interface, traffic sourced from PC1 is denied before it is routed onward.

7. Step 3 – Test the Standard ACL

From PC1, try:

ping 192.168.2.10
    

The ping should fail because PC1 is denied by the ACL.

From PC2, try:

ping 192.168.2.10
    

The ping should succeed if routing and addressing are correct.

8. Lab 2 – Configure an Extended ACL

Now we will create a more specific security rule.

Our requirement:

• PC1 must not access the web server using HTTP.
• PC1 must still be allowed to ping the server.
• Other traffic should be permitted.

Use the same network topology, but first remove the previous ACL from R1:

configure terminal
interface gigabitEthernet 0/0
no ip access-group 10 in
exit
no access-list 10
    

9. Step 1 – Create the Extended ACL

Configure the following extended ACL on R1:

configure terminal

ip access-list extended BLOCK_HTTP
deny tcp host 192.168.1.10 host 192.168.2.10 eq 80
permit ip any any
exit
    

Explanation:

• ip access-list extended BLOCK_HTTP creates a named Extended ACL.
• deny tcp blocks matching TCP traffic.
• host 192.168.1.10 identifies PC1.
• host 192.168.2.10 identifies the server.
• eq 80 matches destination TCP port 80 (HTTP).
• permit ip any any allows all other IPv4 traffic.

10. Step 2 – Apply the Extended ACL

Apply the ACL inbound on R1's LAN interface:

interface gigabitEthernet 0/0
ip access-group BLOCK_HTTP in
exit
    

Extended ACLs are commonly placed close to the source of the traffic they filter. This helps prevent unwanted traffic from travelling further through the network.

11. Step 3 – Test the Extended ACL

On PC1, test connectivity to the server:

ping 192.168.2.10
    

The ping should succeed because the ACL permits other IPv4 traffic.

To test HTTP filtering:

1. Enable the HTTP service on the Server-PT device.
2. Open PC1's Web Browser.
3. Visit http://192.168.2.10.
4. The HTTP connection should be blocked.

From PC2, HTTP access should still work because the deny rule only matches PC1's source address.

12. Useful ACL Verification Commands

show access-lists
show ip access-lists
show ip interface gigabitEthernet 0/0
show running-config
    

Use these commands to inspect ACL rules, packet match counters, and the interface where an ACL is applied.

13. Common ACL Troubleshooting

14. Frequently Asked Questions

15. Practice Challenge

1. Block PC2 from accessing the server using HTTP.
2. Allow PC1 to access the server using HTTP.
3. Block ICMP traffic from PC1 to the server.
4. Allow all other required traffic.
5. Verify your rules using show access-lists.

Conclusion

In this practical lab, you learned how to configure Standard and Extended Cisco ACLs in Packet Tracer. You created permit and deny rules, applied ACLs to router interfaces, controlled HTTP access, and verified the results.

ACL configuration is an important networking skill for CCNA students and network administrators.

Learn Networking with ATN Campus

Build your networking skills through practical training, configuration exercises, and hands-on labs.

• CCNA and CCNP Training
• Network Routing and Switching
• Subnetting and IP Addressing
• Network Security and CEH
• Python for Network Automation
• Practical Cisco Packet Tracer Labs

???? Want to learn networking? Visit ATN Campus.

???? Learn Networking. ???? Master Routing & Switching. ???? Practice with Real Labs. ???? Prepare for Certifications. ???? Build Your IT Career with ATN Campus.