A standard named access control list (ACL) identifies the ACL with a name and matches packets using only their source IP address. Unlike a numbered ACL, it is created globally, then configured through a separate standard named ACL configuration mode. section 23.2.2 section 23.1.4
Configure and use a standard named ACL in this order:
- Create it with `ip access-list standard name`. section 23.2.2
- Add ACEs with `permit` or `deny`, a source IP address, and an optional wildcard mask. section 23.2.2
- Use sequence numbers when you need to control ACE placement; default sequence numbers begin at 10 and increase by 10. section 23.2.2
- Apply the ACL to an interface with `ip access-group name in|out`; configuration alone does not filter traffic. section 23.2 section 23.4
- Verify it with `show access-lists`, optionally specifying the ACL name. section 23.2.2 section 23.4
Blocking two users while permitting everyone else
On R2, enter `ip access-list standard BLOCK_MARTHA_BOB`, then configure `deny 192.168.1.11`, `deny 192.168.2.17`, and `permit any`. Apply it inbound with `ip access-group BLOCK_MARTHA_BOB in`. The resulting ACL uses sequence numbers 10, 20, and 30, respectively. section 23.2.2
R2(config)# ip access-list standard BLOCK_MARTHA_BOB #1
R2(config-std-nacl)# deny 192.168.1.11 #2
R2(config-std-nacl)# deny 192.168.2.17 #2
R2(config-std-nacl)# permit any #3
R2(config-std-nacl)# do show access-lists BLOCK_MARTHA_BOB
Standard IP access list BLOCK_MARTHA_BOB
10 deny 192.168.1.11
20 deny 192.168.2.17
30 permit any
#1 Creates the standard named ACL
#2 Denies Martha and Bob
#3 Permits all other traffic
View the annotated Cisco IOS listing showing named ACL creation, user-specific deny entries, a permit-any entry, and verification output. section 23.2.2
