Cisco IOS ACL Syntax Reference

An Access Control List (ACL) is a sequential set of permit or deny statements that filter packets based on criteria such as source IP, destination IP, protocol, and port numbers. ACLs are applied to interfaces inbound or outbound. They are a fundamental tool for security and traffic management.

Cisco IOS supports two main types of ACLs relevant to CCNA:

- Standard ACLs: Numbered 1-99 or 1300-1999 (extended range). They filter only on the source IP address. They are typically placed as close to the destination as possible to avoid unintended filtering. - Extended ACLs: Numbered 100-199 or 2000-2699. They filter on source IP, destination IP, protocol (IP, TCP, UDP, ICMP, etc.), and port numbers. They should be placed as close to the source as possible for efficiency.

Also, Named ACLs allow you to use a name instead of a number for both standard and extended ACLs, making configuration easier to read.

When a packet enters or leaves an interface, the router checks the ACL applied to that interface in that direction. The ACL is processed top-down. The first match determines the action (permit or deny). If no match is found, the implicit deny at the end denies the packet. This is crucial: if you don't have a permit statement for necessary traffic, it will be dropped.

access-list 10 permit 192.168.1.0 0.0.0.255
access-list 10 deny any

access-list 100 permit tcp 192.168.1.0 0.0.0.255 any eq 80
access-list 100 deny ip any any

Wildcard masks are 32-bit numbers where 0 means 'match this bit exactly' and 1 means 'ignore this bit'. For example, 0.0.0.255 matches any host in a /24 network. Common wildcards:

interface GigabitEthernet0/0
 ip access-group 100 in

show access-lists
show ip access-lists
show running-config | include access-list
show ip interface GigabitEthernet0/0

Example output:

Router# show access-lists
Standard IP access list 10
    10 permit 192.168.1.0, wildcard bits 0.0.0.255
    20 deny any
Extended IP access list 100
    10 permit tcp 192.168.1.0 0.0.0.255 any eq 80
    20 deny ip any any

Every ACL has an implicit deny any at the end. This is not shown in the output but is always present. To allow all other traffic, you must add a permit ip any any at the end.

Modern IOS automatically assigns sequence numbers (starting at 10, increment by 10) to each entry. You can insert or delete entries by sequence number:

ip access-list standard 10
 15 permit host 192.168.1.100
 no 20

ip access-list extended BLOCK_WEB
 deny tcp any any eq 80
 deny tcp any any eq 443
 permit ip any any

Then apply:

interface GigabitEthernet0/1
 ip access-group BLOCK_WEB out

ACLs are used in many features beyond filtering: route maps for policy-based routing, NAT (identifying interesting traffic), QoS class maps, and VTY access lists for management access control. For example, a VTY ACL:

access-list 12 permit 192.168.1.0 0.0.0.255
line vty 0 4
 access-class 12 in

This restricts telnet/SSH access to the router to only the 192.168.1.0/24 network.

In a typical enterprise network, ACLs are used for several critical functions:

1. Perimeter Security at the Internet Edge

At the border router, an extended ACL is applied inbound on the external interface to block known malicious traffic. For example, deny RFC 1918 private addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) from entering the internal network, deny packets with source IP equal to the internal network (spoofing), and permit only necessary services like HTTP, HTTPS, and SMTP to specific servers. This ACL is often hundreds of lines long and must be carefully maintained. A common mistake is forgetting the implicit deny – if you don't have a permit ip any any at the end, all traffic not explicitly permitted will be dropped, potentially breaking legitimate services.

2. Segmenting Internal Traffic

Inside the network, ACLs are used to enforce security policies between departments. For instance, the HR department's VLAN may be allowed to access the payroll server but not the IT server. An extended ACL is applied on the Layer 3 interface of the HR VLAN, filtering traffic leaving the HR subnet. This is often done on a firewall, but in smaller networks, a router with ACLs suffices. Performance is a consideration: hardware-switched platforms (like Cisco Catalyst switches) can apply ACLs in hardware, but software-based routers may experience CPU load with many ACL entries.

3. Controlling Management Access

Network engineers use ACLs to restrict SSH access to routers and switches to only specific management subnets. A standard ACL is applied to the VTY lines. If misconfigured – for example, if the engineer's own IP is not included – they can be locked out. Always have an out-of-band console connection to recover. Also, remember that ACLs on VTY lines do not affect console or auxiliary ports.

Scale and Performance: ACLs are processed sequentially, so large ACLs (hundreds of entries) can introduce latency. On high-end routers, ACLs are often implemented in hardware (TCAM) for wire-speed forwarding. On low-end routers, software processing can degrade performance. Best practice is to keep ACLs as short as possible and place more specific entries at the top to minimize processing.

Misconfiguration Consequences: A missing permit statement can break connectivity; a missing deny can expose the network. For example, if you intend to block only HTTP but forget to permit HTTPS, HTTPS traffic will be denied by the implicit deny. Always test ACLs in a lab or during a maintenance window.