A numbered access control list (ACL) is identified by a number and filters IPv4 packets according to ordered access control entries (ACEs). Standard numbered ACLs match source IP addresses and are configured one ACE at a time from global configuration mode. section 23.2.1 section 23.1.4
Use numbered standard ACLs by following these rules:
- Choose an identifier from 1–99 or 1300–1999; ranges 100–199 and 2000–2699 identify extended ACLs. section 23.2.1
- Create ACEs sequentially with access-list number {permit | deny} source-ip wildcard-mask; the router evaluates them in configuration order. section 23.2.1 section 23.4
- Add an optional remark to document the ACL’s purpose; automatically assigned sequence numbers begin at 10 and increase by 10. section 23.2.1 section 23.4
- Apply the ACL with ip access-group {number | name} {in | out}; creation alone does not filter traffic. section 23.2 section 23.4
- Verify operation with show access-lists, show ip access-lists, or show ip interface interface-id. section 23.2.1 section 23.4
Block one subnet from a server LAN
On R2, ACL 1 denies engineering traffic, permits the rest of 192.168.0.0/16, and filters packets leaving G0/0: access-list 1 deny 192.168.1.0 0.0.0.255; access-list 1 permit 192.168.0.0 0.0.255.255; interface g0/0; ip access-group 1 out. The first matching ACE decides whether each packet is denied or permitted. section 23.2.1
Meet multiple access requirements
ACL 10 on R2 denies accounting traffic outbound toward Server LAN B. Separate numbered ACLs can similarly block engineering and accounting traffic on R1’s outbound interfaces, placing filtering near the destination. section 23.3
R2(config)# access-list 1 deny 192.168.1.0 0.0.0.255 #1 R2(config)# access-list 1 permit 192.168.0.0 0.0.255.255 #2 R2(config)# access-list 1 remark Block Engineering #3 #1 Denies the engineering department’s subnet #2 Permits the rest of the 192.168.0.0/16 range #3 Configures a descriptive remark (optional)
Review annotated Cisco IOS commands for creating a numbered ACL, permitting a broader range, and adding a descriptive remark. section 23.2.1
