Access Control Lists (ACLs)

An Access Control List (ACL) is essentially a set of IF/THEN rules that you apply to a router interface. It acts as a firewall for your network, inspecting packets as they pass through and deciding whether to permit (let them pass) or deny (drop them) based on criteria like IP addresses or port numbers.

1. Rules of ACLs

Sequential Processing (Top-Down): The router reads the rules in order from top to bottom. The moment a packet matches a rule, the router takes action (permit or deny) and stops reading. It does not care what the rest of the list says.

The Implicit Deny: At the very bottom of every single ACL is an invisible, unwritten rule that says deny any. If a packet makes it through your entire list and doesn’t match a single rule, it is dropped. (This is why an ACL with only deny statements blocks 100% of traffic).

One Per Interface, Per Direction, Per Protocol: You can only have one ACL applied to an interface going IN, and one going OUT, for IPv4.

2. Types of ACLs

2.1 Standard ACLs (Numbers 1 - 99)

They can only filter traffic based on the Source IP Address. It has to be applied as close to the destiny as possible.

2.1.1 Configuration

Router(config)# access-list 10 deny host 192.168.1.50
Router(config)# access-list 10 permit any

Enter the configuration mode of the ACL

Router(config)# ip access-list standard MI_ACL_WEB

Remove an ACL

Router(config-std-nacl)# no 20

Insert an ACL in a determined position

Router(config)# ip access-list standard MI_ACL
Router(config-std-nacl)# 15 permit host 192.168.1.20

Re-sequence the numbers

Router(config-std-nacl)# ip access-list resequence [ACL_NAME] [Start_Number] [Increment]

2.2 Extended ACLs (Numbers 100 - 199)

They are highly precise. They can filter based on Source IP, Destination IP, Protocol (TCP/UDP/ICMP), and specific Port Numbers (like 80 for HTTP or 22 for SSH).

2.2.1 Configuration

Router(config)# access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.5 eq 80
Router(config)# access-list 100 deny icmp 192.168.1.0 0.0.0.255 host 10.0.0.5
Router(config)# access-list 100 permit ip any any

3. Applying the ACL

An ACL does absolutely nothing until you attach it to an interface and tell the router which direction to watch (in or out).

Router(config)# interface GigabitEthernet0/0
Router(config-if)# ip access-group 100 in

4. Eliminate the ACL from the port

Router(config-if)# no ip access-group [ACL_NAME_OR_NUMBER] in

5. Eliminate the ACL from the map

Router(config)# no access-list [ACL_NUMBER]
Router(config)# no ip access-list [standard or extended] [ACL_NAME]

6. Verification commands

Router# show access-lists -- Shows all lists
Router# show ip access-lists -- Shows only ipv4 lists

The command shows :

10 deny tcp any 10.55.55.0 0.0.0.255 eq www

If the ACL has been not applied of it hasn’t got any matches

10 deny tcp any 10.55.55.0 0.0.0.255 eq www (18 matches)

Shows the parentesis if has at least 1 match

IOS XE -> Common ACL feature Allows two ACLs per router interface per direction

To apply an ACL to management lines:

access-class [name/number] [in/out]