ACL

🔐 Access Control Lists (ACLs): Technical Guide

Welcome to the definitive guide to Access Control Lists (ACLs) — optimized for learners, revision, and interview preparation. This guide covers Standard and Extended ACLs, along with configuration best practices, verification, and editing techniques.

📘 1. Inroduction to ACLs

• Definition: An Access Control List (ACL) is an ordered list of Access Control Entries (ACEs) used to filter network packets at router interfaces.

🔧 Primary Functions

• Packet Filtering: Allow or deny traffic based on rules.
• Security Enforcement: Restrict access to resources (e.g., servers, segments).
• Traffic Classification: Identify traffic for VPNs, QoS, or monitoring.

⚙️ Router Behavior & ACLs

• Default behavior: Forward packets if a route exists.
• ACLs override this by enforcing access rules.
• Logic resembles if-then-else:

  If packet matches Rule 1 → Apply action
  Else if matches Rule 2 → Apply action
  Else → Implicitly denied
  

📘 2. Core ACL Concepts

Concept	Description
ACE	Each rule in an ACL (permit or deny)
Sequential Matching	Rules processed from top to bottom
First Match Wins	Once matched, packet is acted on and evaluation stops
Implicit Deny	Hidden rule at the end denies everything not explicitly permitted
Wildcard Mask	Inverse subnet mask used to define IP ranges
Direction	ACLs are applied inbound or outbound on interfaces
Shadowed Rules	Redundant ACEs that are never matched due to previous rules
VTY Filtering	ACLs can secure remote access via Telnet/SSH on VTY lines

🎯 Wildcard Mask Tips

• 0 = must match

  1 = doesn’t matter

• Example: 0.0.0.255 → matches a /24 network

• Shortcut: Wildcard Mask = 255.255.255.255 - Subnet Mask

🔌 ACL Application Points

• Inbound: Evaluates traffic entering an interface.

• Outbound: Evaluates traffic leaving an interface.

• Each interface: Max one ACL per direction.

• ACLs must be explicitly applied to be active.

📘 3. ACL Identification Types

Type	Description
Numbered	Identified using a specific number range
Named	Assigned a custom name for clarity/editing

🧩 Benefits of Named ACLs

• Easier editing (remove individual ACEs)

• Use of sequence numbers

• Better documentation (remark statements)

📘 4. Standard ACLs

🔑 Key Feature

• Filters only on Source IP Address

• Simple but less granular filtering (broad strokes)

🧮 Number Ranges

• 1–99

• 1300–1999

🛠️ Configuration

• ✅ Numbered ACL Example

access-list 10 permit 192.168.1.0 0.0.0.255

• ✅ Named ACL Example

ip access-list standard BLOCK-HOSTS
  deny host 192.168.10.100
  permit any

• ✅ With Remarks

access-list 15 remark Block Marketing Dept
access-list 15 deny 192.168.10.0 0.0.0.255

• 🚦 Application

interface GigabitEthernet0/1
  ip access-group BLOCK-HOSTS out

Best Practice: Apply outbound, close to destination to avoid unintended blocking.

• ** 🧪 Verification**

show access-lists
show ip access-lists
show ip interface GigabitEthernet0/1

✏️ Editing Standard ACLs

| Type | Can Delete ACEs? | Edit Inline? | Notes | | ———— | —————- | ———— | ————————————— | | Numbered | ❌ No | ❌ No | no access-list 10 removes entire ACL | | Named | ✅ Yes | ✅ Yes | Use sequence numbers and no seq-num |

📘 5. Extended ACLs

🔑 Key Feature

• Filters traffic based on multiple parameters:
  • Protocol (TCP, UDP, ICMP, etc.)
  • Source IP
  • Destination IP
  • Port numbers
  • Flags (e.g., ACK, SYN)

🗃️ Number Ranges

• 100–199
• 2000–2699

🛠️ Configuration

✅ Numbered ACL Example

access-list 110 permit tcp host 192.168.1.10 any eq 80

✅ Named ACL Example

ip access-list extended WEB-ACCESS
  permit tcp host 192.168.1.10 any eq www

🔍 Matching Options

Field	Example
Protocol	tcp, udp, icmp, ip
IP Address (single)	host 192.168.1.5
IP Range	192.168.1.0 0.0.0.255
Any IP	any
Port Operators	eq, gt, lt, neq, range
Port Keywords	www, ftp, domain, ntp, etc.

🚦 Application

interface GigabitEthernet0/0
  ip access-group WEB-ACCESS in

Best Practice: Apply inbound, close to source to drop unwanted traffic early.

🧪 Verification

show access-lists
show ip access-lists
show ip interface GigabitEthernet0/0

✏️ Editing Extended ACLs

Task	Command/Method
Delete ACE	no 20 (in ACL config mode)
Insert ACE	Use specific sequence-number
Resequence ACEs	ip access-list resequence ACL_NAME 10 10

📘 6. Wildcard Mask Cheat Sheet

Subnet Mask	Wildcard Mask	Description
255.255.255.0	0.0.0.255	/24 – Match last octet
255.255.0.0	0.0.255.255	/16 – Match last 2
host keyword	0.0.0.0	Match exact IP

📘 7. ACL Application Commands

Interface Example

interface GigabitEthernet0/1
  ip access-group 110 in

🔐 VTY Lines Example (Telnet/SSH ACL)

line vty 0 4
  access-class VTY-ACL in

📘 8. Interview & Revision Summary

Feature	Standard ACL	Extended ACL
Filters By	Source IP only	Protocol, Source/Destination IP, Port
Number Range	1–99, 1300–1999	100–199, 2000–2699
Placement	Close to destination	Close to source
Port Filtering	❌ Not Supported	✅ Yes
Protocol Awareness	❌ No	✅ Yes
Complexity	Simple	Advanced
Editing	Harder (unless named)	Easier with named ACLs + seq nums

✅ ACL Knowledge = Network Security Control

With ACLs, you gain control, visibility, and security over network traffic — whether you’re securing routers, segmenting users, or preparing for certification/interviews.

🙌 Connect With Me