ACL-based traffic filtering and policy-based routing: two tools that give a network manager superpowers over what data moves and where it goes. For the 300-410 exam, you need to understand how to configure these to enforce security and direct traffic, not just let the network run on autopilot. Without them, it is like leaving your front door unlocked and hoping no unwanted visitors show up.
Jump to a section
A simple way to picture ACL-Based Traffic Filtering and Policy-Based Routing
Ever wondered why some people breeze through a special lane at the airport while you queue for ages, or why certain items get flagged at security?
That is exactly how ACL-based traffic filtering and policy-based routing work on a network. Imagine a busy airport terminal. The main entrance has a security checkpoint. This checkpoint is like an Access Control List (ACL) — it checks every person (data packet) coming in. It looks at their passport (source IP address), their destination (destination IP address), and even what kind of luggage they carry (protocol like HTTP or FTP). If a rule says 'no liquids over 100ml', that passenger is turned away. If another rule says 'only ticketed passengers are allowed to proceed to the gates', the ACL makes that decision.
Now, think about the VIP lane. That is Policy-Based Routing (PBR). Instead of just letting the standard routing table decide the path (like the main queue), PBR lets the airport override that. A VIP passenger might be routed to a special lounge, given a golf cart to the gate, or sent through a fast-track channel based on their frequent flyer status, not just their boarding pass number. In networking, PBR looks at things like the traffic size or source and says, 'I do not care what the normal map says; send this traffic over the faster, less congested fibre link.'
ACLs decide what is allowed, and PBR decides which path it takes. Both work together to enforce security and performance policies, just like an airport combines security checks with special handling for certain travellers.
Let us start with the basics. A network is like a system of roads connecting different buildings (computers). Data travels in small chunks called packets. Each packet has a header, like an envelope, that contains the source address (where it came from) and the destination address (where it is going).
What is an Access Control List (ACL)?
An ACL is a set of rules, applied to a router or switch, that decides whether a packet gets through or is blocked. Think of it as a bouncer at a club who checks an ID (the packet header) against a list. If the ID matches a rule that says 'allow entry', the packet passes. If it matches a 'deny' rule, it is dropped.
ACLs come in two main flavours: Standard and Extended. - Standard ACL: Looks only at the source IP address. It is like a bouncer who only checks where you are from, not where you are going. This is less precise. - Extended ACL: Looks at source IP, destination IP, protocol (TCP, UDP, ICMP), and port numbers (like 80 for web traffic or 443 for secure web). This is like a bouncer who checks your ID, your ticket, and what you are carrying. It is much more granular.
ACLs are processed in order, top to bottom. Once a match is found, the router stops checking further rules. This means the order of your rules is critical. A common mistake is to put a broad rule before a specific one, accidentally blocking traffic you meant to allow.
Why do we use ACLs?
Security: Block unwanted traffic. For example, deny all incoming packets from a known malicious IP range.
Traffic filtering: Allow only specific types of traffic, like web traffic, but block file-sharing protocols that could spread malware.
Quality of Service (QoS) marking: Identify traffic for special treatment (though this is more of an advanced use).
Now, let us move to Policy-Based Routing (PBR).
Normal routing uses a routing table. The router looks at the destination IP address of a packet and forwards it based on the best path stored in that table. This is like following a GPS navigation system that always uses the same algorithm.
PBR overrides the routing table. With PBR, you create a 'route map' that checks the packet against conditions (like source address, destination, protocol, or even packet size). If the conditions are met, you tell the router to send the packet a different way, ignoring the usual routing table.
For example, imagine you have two internet connections: one is a slow, cheap DSL line, the other is a fast, expensive fibre line. You want all video-conferencing traffic to use the fast fibre because it needs low latency. Normal routing might randomly send video traffic over the DSL line. With PBR, you configure a rule: 'If the packet is from a video-conferencing app (identified by source port 3478), forward it out the fibre interface.'
PBR works in three steps:
Define a route map: A sequence of 'permit' or 'deny' statements. 'Permit' means the packet matches and will be redirected. 'Deny' means it will be routed normally.
Set match criteria: Use an ACL or other conditions to identify the traffic.
Set action: For example, 'set ip next-hop 10.0.0.1' to send the packet to a specific router or 'set interface GigabitEthernet0/1'.
What does PBR replace?
PBR does not replace routing tables; it supplements them. It is used when you need more control than the routing protocol (like OSPF or EIGRP) provides. For example, if you want to send traffic from the sales department via a different path than the engineering department, even though both have the same destination, PBR is your tool.
Key differences between ACLs and PBR:
ACLs are a policy that either allows or denies a packet. PBR is a policy that influences the path a packet takes.
ACLs are typically used for security filtering. PBR is used for performance or cost optimisation.
ACLs stop packets. PBR redirects them.
In the 300-410 exam, you will be tested on configuring both. You need to know the syntax, the order of operations, and common pitfalls. For instance, when applying an ACL to an interface, you must specify whether it is for inbound or outbound traffic. An inbound ACL checks packets arriving on the interface. An outbound ACL checks packets leaving the interface.
To sum up: ACLs are your security guards, blocking the bad stuff. PBR is your traffic controller, directing specific traffic to specific paths for better performance or compliance.
Define your policy goal
Before touching the CLI, decide what traffic you want to permit, deny, or redirect. For example: 'Block all Telnet (port 23) traffic from the HR subnet to the finance servers.' This clarity prevents mistakes in ACL or PBR configuration.
Create the ACL to match traffic
Write the ACL using global configuration mode. For an extended ACL blocking Telnet: 'access-list 101 deny tcp 192.168.10.0 0.0.0.255 10.0.0.0 0.0.255.255 eq 23'. This statement matches the source, destination, and port. Remember to add a permit statement for other traffic if needed, e.g., 'access-list 101 permit ip any any'.
Apply the ACL to an interface
Enter interface configuration mode (e.g., 'interface GigabitEthernet0/1') and apply the ACL with direction: 'ip access-group 101 in'. 'In' means packets arriving on that interface are checked. 'Out' means packets leaving are checked. Incorrect direction is a common exam trap.
Create a route map for PBR
If you want PBR, start with: 'route-map SPECIAL permit 10'. Then define match criteria: 'match ip address 101' (using the ACL you just created). Then set the next hop: 'set ip next-hop 192.168.1.100'. You can add multiple sequence numbers for different conditions.
Apply the route map to an interface
Exit back to interface configuration and apply the route map: 'ip policy route-map SPECIAL'. This tells the router to check incoming packets on this interface against the route map. Only packets matching the ACL in the route map will be redirected. Others follow the routing table.
Verify the configuration
Use 'show access-lists' to check hit counts and confirm your ACL is being triggered. Use 'show run | include route-map' to verify the route map is applied. Use 'show ip policy' to list which interfaces have PBR enabled. Testing with a ping or traceroute from a host can validate the behaviour.
Implement logging and monitoring
Add the 'log' keyword to ACL entries (e.g., 'access-list 101 deny tcp ... log') to log denied packets. This helps in troubleshooting and security auditing. For PBR, monitor with 'debug ip policy' during maintenance windows (careful with production traffic).
Imagine you are the network administrator for a medium-sized company called 'TechFlow Ltd'. The company has 200 employees, a branch office in another city, and two internet connections: a primary fibre line and a backup DSL line. Your job is to secure the network and ensure that critical traffic (like voice calls and video conferences) always gets priority.
One day, the CEO complains that Zoom calls are choppy. Meanwhile, the sales team is complaining that they cannot access a customer portal because they keep getting blocked. How do you solve these problems? You use ACLs and PBR.
Step-by-step scenario:
Identify the problem:
Choppy Zoom calls: Video traffic is mixing with large file downloads, causing latency. Solution: Use PBR to send Zoom traffic (identified by UDP ports 3478-3481) over the fibre line, and all other internet traffic over the DSL line by default.
Blocked sales portal: The firewall mistakenly blocks the sales portal IP. Solution: Create an ACL that permits traffic from the sales subnet to the portal IP and apply it to the router interface facing the firewall.
Implementing the PBR solution:
First, you create an ACL to match Zoom traffic: 'access-list 100 permit udp any any range 3478 3481'.
Then, you create a route map: 'route-map ZOOM permit 10'. Inside it, you specify 'match ip address 100' and 'set ip next-hop 192.168.1.2' (the fibre line interface).
Finally, you apply the route map to the incoming interface on the router that connects to the internal network: 'ip policy route-map ZOOM'.
Now, any Zoom traffic hitting that interface gets sent to the fibre line, bypassing the normal routing table. Other traffic continues using the standard routing table, which might send it over the DSL line.
Implementing the ACL solution:
You need to allow the sales subnet (192.168.10.0/24) to reach the customer portal (203.0.113.50). Create an extended ACL: 'access-list 110 permit ip 192.168.10.0 0.0.0.255 host 203.0.113.50'. Then apply it inbound to the interface that connects to the sales switch: 'ip access-group 110 in'.
But wait: you also have a global policy that blocks all traffic to external IPs except through a proxy. You must place this ACL before the more general deny rule.
Testing and verification:
Use 'show run | section route-map' to verify the PBR configuration.
Use 'show ip policy' to see which interfaces have PBR applied.
Use 'show access-lists' to see the ACL hit counts. If the count for the permit rule does not increase when the sales team tries to connect, maybe the ACL is applied to the wrong interface or in the wrong direction.
Troubleshooting:
A common issue: PBR only works on packets that originate from the router or are forwarded through it. It does not affect packets generated by the router itself (like a ping from the router CLI).
Another trap: ACLs have an implicit 'deny all' at the end. If you forget to add a permit statement for the traffic you want to allow, it will be blocked.
In a real business, you would also document these policies in a network change request. You would schedule the change during a maintenance window, and roll back if something breaks. You might even use a tool like Ansible to push the configuration to multiple routers at once.
The IT professional's daily work with these tools includes:
Writing and testing ACLs to comply with security policies (e.g., PCI DSS).
Configuring PBR to manage bandwidth costs or improve application performance.
Auditing existing ACLs to remove stale rules that could be security holes.
Using logging on ACLs (with the 'log' keyword) to monitor for intrusion attempts.
Ultimately, these skills are not just for the exam. They are fundamental to keeping a network secure, efficient, and aligned with business needs.
The 300-410 ENARSI exam tests ACL-based traffic filtering and policy-based routing thoroughly. You can expect multiple-choice questions, drag-and-drop scenarios (e.g., order the ACL statements correctly), and simulator tasks where you configure a router from scratch or troubleshoot an existing config. Here is exactly what they want you to know.
Key concepts they test:
ACL types and differences: Standard vs. Extended. Standard ACLs (numbered 1-99, 1300-1999) only match source IP. Extended ACLs (100-199, 2000-2699) match source, destination, protocol, and port. You must know these number ranges by heart.
ACL placement: Standard ACLs should be placed as close to the destination as possible (because they only check source IP, you do not want to block too much). Extended ACLs should be placed as close to the source as possible (to block unwanted traffic early).
Implicit deny: Every ACL has an invisible 'deny any' at the end. If your ACL does not have a permit statement for traffic, it is blocked.
Order of entries: The router checks rules in sequence from top to bottom. Once a match is found, processing stops. So a broad 'permit any' at the top will bypass any deny rules below.
Named ACLs: You can use names instead of numbers (e.g., 'ip access-list extended BLOCK_FTP'). They are more readable.
Applying ACLs: Use the 'ip access-group' command on an interface. You must specify direction: 'in' or 'out'.
For Policy-Based Routing (PBR):
Route map configuration: 'route-map [name] [permit/deny] [sequence number]'.
Match criteria: Typically using an ACL ('match ip address [acl number]'), or other conditions like packet length.
Set actions: 'set ip next-hop [ip]' (to send to a specific router), 'set interface [interface]' (to force out a specific port), or 'set default interface' (to force a default route).
Sequence numbers matter: Lower numbers are processed first. If a packet does not match any permit statement in the route map, it is routed normally.
Local PBR: By default, PBR only applies to packets that pass through the router, not packets originated by the router itself. To apply it to locally originated packets, use 'ip local policy route-map [name]'.
Common traps and patterns:
Trap: They show you an ACL with a 'deny' rule first, then a 'permit' rule that covers the same traffic. The deny will block everything, and the permit later is pointless because the packet never reaches it. Answer: Reorder the rules.
Trap: They configure an ACL on an interface but forget to specify the direction or apply it to the wrong interface. The traffic still passes. Answer: Check the 'ip access-group' command applied to the correct interface with the correct direction.
Trap: PBR set next-hop to an IP that is not reachable. The router will drop the packet. Answer: Ensure the next-hop IP is in the routing table.
Trap: Using 'match ip address [acl]' in a route map but the ACL uses the wrong port number. The PBR never matches. Answer: Double-check the ACL definition.
Trap: They ask what happens when PBR match criteria conflict with routing table. PBR always takes precedence for matched traffic.
Exam questions you might see:
'What is the effect of applying a standard ACL to an interface outbound?' Expect you to know that it checks the source IP of packets leaving the interface.
'Given a route-map with multiple sequence numbers, how is traffic processed?' Sequence order, from lowest to highest, until a match is found.
'Why would you use PBR instead of adjusting metrics?' PBR allows you to base routing decisions on attributes other than destination, such as packet size or source.
Key definitions to memorise:
ACL: Ordered set of permit/deny statements used to filter traffic.
PBR: Mechanism to override routing table based on policy (route map).
Route map: Set of conditional statements used in PBR and redistribution.
Implicit deny: The default action for any ACL entry list.
Sequence number: The order in which route map entries are evaluated.
To succeed, you must be able to read and write ACL and PBR configurations quickly. Practise on a simulator or on real equipment. The exam loves to present a 'show run' output and ask what the effect is or what is misconfigured.
ACLs filter traffic using source IP (standard) or source/destination IP, protocol, and port (extended) with an implicit deny at the end.
Order of entries in an ACL is critical; the router stops processing after the first match.
Place standard ACLs close to the destination and extended ACLs close to the source for optimal performance.
Policy-Based Routing (PBR) uses route maps to override the routing table for matched traffic, allowing path selection based on attributes like source address or packet size.
A route map must be applied to an interface with the 'ip policy route-map' command to take effect.
PBR only applies to packets passing through the router unless 'ip local policy route-map' is configured for locally originated packets.
ACLs are used both for security filtering and for marking traffic in PBR or QoS policies.
Remember the number ranges: standard ACLs 1-99, 1300-1999; extended ACLs 100-199, 2000-2699.
These come up on the exam all the time. Here's how to tell them apart.
Standard ACL
Matches only on source IP address.
Number ranges 1-99 and 1300-1999.
Should be placed close to the destination to minimise unintended blocking.
Extended ACL
Matches on source IP, destination IP, protocol, and port.
Number ranges 100-199 and 2000-2699.
Should be placed close to the source for efficient filtering.
ACL Applied Inbound
Filters packets before the routing decision.
Useful for blocking unwanted traffic before it is processed.
Packet source is known, destination routing is unknown at that point.
ACL Applied Outbound
Filters packets after the routing decision, just before they leave the interface.
Useful for controlling traffic exiting the router.
Can use knowledge of both source and destination routes.
Policy-Based Routing
Uses route maps with match/set conditions to override the routing table.
Can base decisions on attributes like source address, protocol, or packet length.
Requires manual configuration; not dynamic.
Normal Routing
Uses the routing table built by dynamic routing protocols (OSPF, EIGRP) or static routes.
Decision is based solely on destination IP address.
Automatically adapts to network changes (if using dynamic protocols).
Named ACL
Identified by a name (e.g., 'BLOCK_HTTP').
Can be standard or extended, but the name indicates type.
More readable and easier to manage in large configurations.
Numbered ACL
Identified by a number (e.g., 101).
Number range determines type (standard vs extended).
Less intuitive but still widely used in legacy setups.
Mistake
An ACL permits or denies traffic based on the destination IP alone.
Correct
Standard ACLs only use source IP. Extended ACLs use source and destination IP, plus protocol and port. Both can be used for filtering, but they are not limited to destination alone.
People confuse the capabilities of standard vs extended ACLs. Cisco's naming (Standard vs Extended) is not intuitive to beginners.
Mistake
Once you configure a route map, the router uses it for all traffic all the time.
Correct
A route map only affects packets that match its match criteria and are processed through an interface with the 'ip policy route-map' command applied. Traffic not matching is routed normally.
Beginners think PBR replaces routing entirely, but it is an override for specific traffic only.
Mistake
ACLs work the same way whether applied inbound or outbound.
Correct
An inbound ACL filters packets arriving on an interface before the routing decision. An outbound ACL filters packets after the routing decision, just before they leave. The direction affects which packets are inspected and the order of processing relative to routing.
The difference in placement and timing is subtle but critical. Newcomers often ignore the direction keyword.
Mistake
Policy-based routing uses the lowest metric route to forward traffic.
Correct
PBR completely ignores the routing table and metric. It forwards traffic based on the 'set ip next-hop' or 'set interface' command in the matching route map entry, regardless of route metrics.
Beginners assume 'routing' is always metric-based. PBR is explicitly a policy override, not an optimisation.
Mistake
If you write an ACL with a deny statement for a specific IP, all other traffic is automatically permitted.
Correct
Every ACL has an implicit 'deny any' at the end. If you do not include a 'permit any' statement (or a specific permit rule), all traffic not explicitly permitted is blocked.
People often think ACLs are permissive by default, but they are restrictive by default (implicit deny).
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Every ACL has a built-in final rule that denies all traffic not explicitly permitted by earlier entries. So if you only have one permit rule for web traffic, all other traffic (SSH, email, etc.) will be blocked.
No. You can only apply one ACL per direction per interface. You can have one ACL for inbound and a different ACL for outbound, but not the same ACL in both directions with one command.
In PBR, a route map matches traffic (using ACLs) and sets the next hop or interface to override routing. In BGP, route maps manipulate routing attributes (like AS path or local preference) during route advertisement or redistribution.
By default, PBR only applies to packets that are forwarded (transit traffic). To apply PBR to locally originated packets, you need the 'ip local policy route-map [name]' command in global config.
Yes, PBR typically uses an ACL to define which packets to match. You can also match based on packet length using 'match length min max', but ACLs are the most common method for filtering specific traffic types.
No, route map names are unique. However, a single route map can have multiple sequence numbers (e.g., permit 10, permit 20) for different match and set conditions.
The packet will be dropped because the router cannot forward it to a next hop that is not reachable. This is a common misconfiguration. Always verify that the next-hop IP is in the routing table.
You've finished ACL-Based Traffic Filtering and Policy-Based Routing. Continue through the 300-410 study guide to build a complete picture of the exam.
Done with this chapter?