Chapter 23: Standard access control lists
The chapter introduction explains why networks need ACLs and describes how standard ACLs filter packets.
After this chapter you will be able to
- ACL packet filtering. Explain that ACLs use predefined rules to allow or block packets entering or leaving a router interface, and that standard ACLs filter by source IP address.
- Ordered ACL packet filtering. Explain how an ACL checks packets against rules in order, takes the action for a matching rule, and discards a packet if no rule matches.
- ACL entries and first matches. Explain that an ACL contains ordered access control entries, each with an IP-address matching condition and a permit or deny action. Describe how the router stops evaluating the ACL after the first match.
- Rule order and shadowing. Trace how the two example ACL orders treat a packet from 192.168.1.1, and explain why placing the broader permit first makes the narrower deny a shadowed rule.
- Implicit deny in ACLs. Explain that an ACL has a hidden deny rule after its configured entries, so a packet that matches no entry is discarded even if the router has a valid route for it.
- ACL application and direction. Explain why creating an ACL alone does not change router behavior, and distinguish what inbound and outbound ACLs evaluate and do with permitted or denied packets.
- Traffic-aware ACL placement. Justify why the example ACL is useful outbound on R1’s G0/2 but ineffective inbound there, and state the usual placement for a standard ACL protecting a destination LAN.
- Two ACL classification axes. Explain that ACLs are categorized by matching parameters and by identification method, producing four combinations of standard or extended with numbered or named.
- Standard and extended matching. Distinguish standard ACLs, which match a packet’s source IP address, from extended ACLs, which can match additional parameters.
- Two-step ACL configuration. State that configuring an ACL involves creating it and then applying it.
- Ordered standard ACL entries. Describe the command for adding an ACE to a standard numbered ACL and explain why the ACEs must be configured in the intended order.
- Destination-side ACL application. Explain how the example ACL is activated on R2 and why its interface and direction limit filtering to traffic for Server LAN A.
- Named ACL configuration mode. Describe how to create a standard named ACL and add ACEs, including how sequence numbers affect their placement.
- Named ACL interface placement. Explain how the example ACL is applied and why that interface and direction filter traffic for both protected LANs.
- Accounting access to Server LAN B. Explain how an ACL on R2 blocks the accounting subnet from Server LAN B while allowing other sources.
- Two-way department isolation. Trace how two ACLs on R1 prevent engineering and accounting hosts from reaching each other.
What it builds on
- The routing table (chapter 9) · Introduces the routing table used to identify a matching route.
- The structure of an IPv4 address (chapter 7) · Understanding that an IPv4 address range can contain a smaller range.
- The network command (chapter 17) · The earlier introduction to wildcard masks.
Section by section
Introduction
The chapter introduction explains why networks need ACLs and describes how standard ACLs filter packets.
- ACL packet filtering: Explain that ACLs use predefined rules to allow or block packets entering or leaving a router interface, and that standard ACLs filter by source IP address.
Why it matters: This is the basic purpose of the standard ACLs configured later in the chapter. - Security need for ACLs: Explain why a network may need ACLs even when its router can forward packets, and describe the network engineer’s role in meeting security requirements.
Why it matters: Routing determines where packets can go, while security requirements may call for restricting that access.
Key terms: access control lists (ACLs), packet filters, standard ACLs, source IP address, routing table, security requirements
23.1 How ACLs work
Introduces ACLs as ordered packet-filtering rules and shows how they choose an action or discard an unmatched packet.
- Ordered ACL packet filtering: Explain how an ACL checks packets against rules in order, takes the action for a matching rule, and discards a packet if no rule matches.
Why it matters: This basic rule-by-rule logic is the foundation for understanding what an ACL does to a packet.
Key terms: ACL, ordered list of rules, source IP address
23.1.1 Matching and acting on packets
This subsection explains how a router matches packets against ACL entries and why entry order changes which packets are permitted or denied.
- ACL entries and first matches: Explain that an ACL contains ordered access control entries, each with an IP-address matching condition and a permit or deny action. Describe how the router stops evaluating the ACL after the first match.
Why it matters: The first matching entry determines what happens to a packet. - Rule order and shadowing: Trace how the two example ACL orders treat a packet from 192.168.1.1, and explain why placing the broader permit first makes the narrower deny a shadowed rule.
Why it matters: Putting a broad rule first can prevent a more specific security restriction from taking effect.
Key terms: access control list, access control entry, ACE, permit, deny, 192.168.1.0/24, 192.168.0.0/16, shadowed rule, more specific rules
23.1.2 The implicit deny
Explains why an ACL denies packets that match none of its configured entries, even when no explicit deny entry covers them.
- Implicit deny in ACLs: Explain that an ACL has a hidden deny rule after its configured entries, so a packet that matches no entry is discarded even if the router has a valid route for it.
Why it matters: It explains why traffic can be dropped without an explicit deny entry for its address.
Key terms: implicit deny, ACL, ACE
23.1.3 Applying ACLs
Explains how applying an ACL to a router interface in a chosen direction determines which packets it filters, and why placement matters.
- ACL application and direction: Explain why creating an ACL alone does not change router behavior, and distinguish what inbound and outbound ACLs evaluate and do with permitted or denied packets.
Why it matters: An ACL cannot filter the intended traffic unless it is applied where that traffic travels, in the right direction. - Traffic-aware ACL placement: Justify why the example ACL is useful outbound on R1’s G0/2 but ineffective inbound there, and state the usual placement for a standard ACL protecting a destination LAN.
Why it matters: Correct placement makes the ACL encounter the traffic it is meant to block. - Per-interface ACL limits: State how many ACLs an interface can have in each direction and whether one ACL can be reused on other interfaces.
Why it matters: These limits matter when deciding how to apply ACLs across router interfaces.
Key terms: inbound, outbound, ingress, egress, standard ACLs, destination LAN, G0/2, one inbound, one outbound
23.1.4 ACL types
This section classifies IP ACLs by what they match and how they are identified, then states the CCNA exam’s ACL scope.
- Two ACL classification axes: Explain that ACLs are categorized by matching parameters and by identification method, producing four combinations of standard or extended with numbered or named.
Why it matters: The two axes let you identify an ACL type without confusing what it matches with how it is identified. - Standard and extended matching: Distinguish standard ACLs, which match a packet’s source IP address, from extended ACLs, which can match additional parameters.
Why it matters: The matching distinction explains when an ACL type offers more precise packet filtering. - CCNA IP ACL scope: State that the CCNA exam covers IP ACLs that filter IP packets, specifically IPv4 ACLs rather than IPv6 ACLs.
Why it matters: This keeps exam preparation focused on the ACL scope stated in the section.
Key terms: matching parameters, identification method, standard ACLs, extended ACLs, numbered ACLs, named ACLs, source IP address, source/destination port numbers, IP ACLs, IPv4 ACLs
23.2 Configuring standard ACLs
Introduces the two steps of configuring ACLs and illustrates how standard ACLs are applied to interfaces in a sample network.
- Two-step ACL configuration: State that configuring an ACL involves creating it and then applying it.
Why it matters: Creating an ACL alone does not complete the configuration described here. - Sample ACL placements and effects: Describe where the two example ACLs are applied and what traffic each blocks.
Why it matters: The examples connect each ACL’s interface and direction with the traffic it is meant to block.
Key terms: creating the ACLs, applying the ACLs, ACL 1, BLOCK_MARTHA_BOB, outbound, inbound
23.2.1 Numbered ACLs
This section shows how to create, verify, and apply a standard numbered ACL to restrict access to a destination LAN.
- Numbered ACL ranges: State which number ranges identify standard IP ACLs and distinguish them from the ranges for extended IP ACLs.
Why it matters: The ACL number determines whether it is valid for the type you intend to configure. - Ordered standard ACL entries: Describe the command for adding an ACE to a standard numbered ACL and explain why the ACEs must be configured in the intended order.
Why it matters: An ACE's position affects which action a packet encounters during ACL evaluation. - Wildcard mask matching: Explain what zero and one bits mean in an ACL wildcard mask and relate the section's /24 example to its netmask.
Why it matters: The wildcard mask determines which source-address bits an ACE checks. - ACL verification and sequence numbers: Describe how to display a configured IP ACL and explain the sequence numbers shown beside its ACEs.
Why it matters: The display lets you check the entries and their order after configuration. - Destination-side ACL application: Explain how the example ACL is activated on R2 and why its interface and direction limit filtering to traffic for Server LAN A.
Why it matters: Choosing the interface and direction controls which traffic the restriction affects.
Key terms: numbered ACL, standard IP ACL, extended IP ACL, ACE, access-list, permit, deny, source-ip, wildcard-mask, wildcard mask
23.2.2 Named ACLs
This section shows how to configure and apply a standard named ACL, then compares its configuration options with numbered ACLs.
- Named ACL configuration mode: Describe how to create a standard named ACL and add ACEs, including how sequence numbers affect their placement.
Why it matters: The configuration mode and sequence numbers determine how you build and extend the ACL. - Single-host and any matching: Explain the equivalent ways to match one source IP address and how to match all IP addresses in an ACE.
Why it matters: These equivalent forms make it easier to read and write the ACL entries in the example. - Named ACL interface placement: Explain how the example ACL is applied and why that interface and direction filter traffic for both protected LANs.
Why it matters: One inbound application point lets the example ACL cover traffic headed to both server LANs. - Numbered and named ACL equivalence: Distinguish configuration-method benefits from packet-filtering behavior for standard named and numbered ACLs.
Why it matters: It prevents you from mistaking a configuration choice for a different kind of packet filtering.
Key terms: standard named ACL config mode, ACE, seq-num, sequence number, host, any, wildcard mask, ip access-group, inbound, G0/2
23.3 Example scenario
The section works through placing three standard ACLs to meet two access requirements in an example network.
- Accounting access to Server LAN B: Explain how an ACL on R2 blocks the accounting subnet from Server LAN B while allowing other sources.
Why it matters: The ACL’s placement makes its source-address rule block accounting traffic headed to Server LAN B without blocking other hosts. - Two-way department isolation: Trace how two ACLs on R1 prevent engineering and accounting hosts from reaching each other.
Why it matters: Blocking communication between two departments requires accounting for traffic in each direction.
Key terms: standard ACLs, accounting subnet, outbound, R2’s G0/1 interface, engineering department, accounting department, R1 G0/1, R1 G0/0
23.4 Summary
Where this is used later
- (chapter intro) (chapter 24) · Explains the ACL fundamentals that also apply to extended ACLs.
- Matching protocol, source, and destination (chapter 24) · ACL entries match packets and act on matching traffic.
- Editing ACLs (chapter 24) · Editing ACL entries requires considering whether their order changes which rule matches first.
- Configuring extended ACLs (chapter 24) · Introduces ACL types.
- Deleting ACEs (chapter 24) · The distinction between numbered ACLs and their ACEs.
- Resequencing ACEs (chapter 24) · Resequencing ACEs builds on the idea that entries have sequence numbers.
Concepts explained in this chapter
- access control listA standard access control list is an IPv4 access control list that filters traffic primarily by source IP address.
- numbered access control listA numbered access control list is an access control list identified by a numeric identifier and traditionally configured from global configuration mode.
- access control entryAn access control entry is an ordered rule in an access control list that specifies packet-matching conditions and an action such as permitting or denying traffic.
- ip access-groupip access-group is a Cisco IOS interface-configuration command that applies an IP access control list in an inbound or outbound direction.
- standard named aclA named access control list is an access control list identified by a name and configured through a dedicated ACL configuration mode.
- deny-by-defaultAn implicit deny is a hidden access-control rule that denies traffic matching none of an access control list's explicit conditions.
- acl sequence numberAn ACL sequence number is an ordering value assigned to an access control entry within an access control list.
- extended access control listAn extended access control list is an access control list that filters packets using multiple packet attributes, including Layer 4 protocols, source and destination IP addresses, and source and destination ports.
- wildcard maskA wildcard mask is a 32-bit bit mask in which zero bits require corresponding address bits to match and one bits ignore them during address matching.
- named acl config modeNamed ACL config mode is a Cisco IOS configuration mode in which individual access control entries are added or edited for an access control list.
- show access-listsshow ip access-lists is a Cisco IOS command that displays configured IP access control lists.
- extended named aclAn extended named ACL is an extended access control list identified by a name.
- extended numbered aclAn extended numbered ACL is an extended access control list identified by a number from the extended ACL ranges.
← Chapter 22: Transmission Control Protocol and User Datagram Protocol
Chapter 24: Extended access control lists →
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.