What is an ACL?

An Access Control List is a collection of rules that a router or Layer 3 switch uses to filter network traffic.

An ACL can inspect packet information and determine whether traffic should be permitted or denied.

          Incoming Traffic
                 |
                 v
          +-------------+
          |     ACL     |
          |             |
          | PERMIT ?    |
          | DENY ?      |
          +-------------+
             |       |
          Permit    Deny
             |       |
             v       X
          Network   DROP
    

Why are ACLs Used?

ACLs can be used for traffic filtering and access control.

• Allow specific traffic
• Block unwanted traffic
• Restrict access to network resources
• Control communication between networks
• Filter traffic based on IP addresses
• Filter traffic based on protocols and ports

How Does an ACL Work?

When a packet reaches an interface where an ACL is applied, the device evaluates the packet against the ACL entries.

```

Packet
|
v
ACL Rule 1
|
+---- Match? ---- YES ---> PERMIT / DENY
|
NO
|
v
ACL Rule 2
|
+---- Match? ---- YES ---> PERMIT / DENY
|
NO
|
v
Next Rule 

ACL entries are processed in sequence. The first matching rule determines the action.

Implicit Deny

One of the most important ACL concepts is the implicit deny.

If a packet does not match an explicit permit statement, it is effectively denied at the end of the ACL.

```

ACL

1. permit network A
2. permit network B
3. deny network C

   ```
    ...
    
   ```

Implicit DENY
|
v
Everything else
|
X
DROP 

This is why administrators must carefully consider which traffic needs to be explicitly permitted.

Types of Cisco IP ACLs

Two important types of IP ACLs are:

• Standard ACL
• Extended ACL

What is a Standard ACL?

A Standard ACL primarily filters traffic based on the source IPv4 address.

```

Packet
|
+---- Source IP = 192.168.10.10
|
v
Standard ACL
|
+---- Permit
|
v
Destination 

Standard ACLs are useful when the filtering decision only needs to consider the source address.

Standard ACL Example

Suppose we want to permit traffic from the network 192.168.10.0/24.

```

Router(config)# access-list 10 permit 192.168.10.0 0.0.0.255 

This is a standard numbered ACL.

It can then be applied to an interface:

```

Router(config)# interface GigabitEthernet0/0
Router(config-if)# ip access-group 10 in 

Standard ACL Wildcard Mask

Cisco ACLs commonly use wildcard masks rather than subnet masks.

```

Network:
192.168.10.0/24

Subnet Mask:
255.255.255.0

Wildcard Mask:
0.0.0.255 

A wildcard mask indicates which bits should be treated as significant and which bits can vary when matching addresses.

What is an Extended ACL?

An Extended ACL provides more detailed traffic filtering than a Standard ACL.

Extended ACLs can make decisions based on information such as:

• Source IP address
• Destination IP address
• Protocol
• TCP or UDP ports
• ICMP traffic

         Packet
            |
    +-------+-------+
    |               |
 Source          Destination
   IP                IP
    |               |
    +-------+-------+
            |
         Protocol
            |
      TCP / UDP / ICMP
            |
         Port
            |
    Permit or Deny
    

Extended ACL Example

Suppose we want to block HTTP traffic from the 192.168.10.0/24 network to server 192.168.20.10.

```

Router(config)# access-list 100 deny tcp 192.168.10.0 0.0.0.255 192.168.20.10 0.0.0.0 eq 80 

Then we can permit other traffic:

```

Router(config)# access-list 100 permit ip any any 

Apply the ACL to the appropriate interface:

```

Router(config)# interface GigabitEthernet0/0
Router(config-if)# ip access-group 100 in 

Standard ACL vs Extended ACL

Named ACLs

Cisco also supports named ACLs, which can make configurations easier to understand and manage.

Example:

```

Router(config)# ip access-list extended BLOCK_WEB
Router(config-ext-nacl)# deny tcp 192.168.10.0 0.0.0.255 192.168.20.10 0.0.0.0 eq 80
Router(config-ext-nacl)# permit ip any any 

The descriptive name BLOCK_WEB makes the purpose of the ACL easier to identify.

Inbound vs Outbound ACL

ACLs can be applied to traffic entering or leaving an interface.

Inbound

```

Incoming Packet
|
v
+-------------+
|    ACL      |
+-------------+
|
v
Interface
|
v
Router 

Outbound

```

Router
|
v
+-------------+
|    ACL      |
+-------------+
|
v
Interface
|
v
Outgoing Packet 

The direction should be selected based on where filtering is most appropriate in the network design.

ACL Example: Blocking a Network

Suppose network 192.168.10.0/24 should not access a specific network.

```

Router(config)# access-list 110 deny ip 192.168.10.0 0.0.0.255 192.168.20.0 0.0.0.255
Router(config)# access-list 110 permit ip any any 

This configuration blocks traffic from the first network to the second network while permitting other IP traffic.

ACL Processing Order

ACL rules are evaluated from top to bottom.

```

ACL 100

Rule 1: deny specific traffic
|
v
Rule 2: permit specific traffic
|
v
Rule 3: permit other traffic
|
v
Implicit deny 

Because the first matching statement is used, the order of ACL entries is extremely important.

Common ACL Mistakes

1. Forgetting the implicit deny.
2. Putting a broad permit statement before a more specific deny.
3. Using the wrong wildcard mask.
4. Applying the ACL in the wrong direction.
5. Applying the ACL to the wrong interface.
6. Blocking required traffic accidentally.
7. Not testing the ACL after configuration.

Useful Cisco ACL Commands

```

Router# show access-lists 

```

Router# show ip access-lists 

```

Router# show running-config 

These commands can help administrators verify ACL configuration and inspect matching or hit counters.

Real-World ACL Example

         USERS
           |
    192.168.10.0/24
           |
           v
    +--------------+
    |    Router    |
    |              |
    |     ACL      |
    +--------------+
       |        |
       |        |
       v        v
   Web Server  Database
   192.168.20.10
    

An organization could use an extended ACL to control which protocols and ports users are allowed to access on specific servers.

For example, web traffic could be permitted to a web server while unwanted traffic is denied.

Standard ACL vs Extended ACL: Easy Memory Trick

```

STANDARD ACL

Source IP
|
v
Permit / Deny

EXTENDED ACL

Source IP
+
Destination IP
+
Protocol
+
Port
|
v
Permit / Deny 

Remember: Standard ACL = primarily WHO is sending. Extended ACL = more detailed control over WHO, WHERE, WHAT, and WHICH PORT.

Practical Packet Tracer Lab

1. Create two networks connected through a Cisco router.
2. Create a Standard ACL that filters traffic based on source IP.
3. Apply the ACL to the appropriate interface.
4. Test connectivity using ping.
5. Create an Extended ACL.
6. Block HTTP traffic to a specific server.
7. Permit other IP traffic.
8. Use show access-lists to verify the ACL.

Quiz

Question: Which type of ACL provides more detailed filtering using source IP, destination IP, protocol, and port information?

Bonus Question: What happens if traffic does not match any explicit ACL statement?

Key Takeaways

• ACLs control whether network traffic is permitted or denied.
• Standard ACLs primarily filter based on source IPv4 addresses.
• Extended ACLs provide more detailed traffic filtering.
• Extended ACLs can use source, destination, protocol, and port information.
• ACL entries are evaluated in order.
• The first matching ACL statement determines the action.
• An implicit deny exists at the end of an ACL.
• ACLs can be applied inbound or outbound on interfaces.
• Correct wildcard masks and rule ordering are essential.