Cisco CCNA Preparation · lesson 29 of 36 · 25 min
ACL Fundamentals
ACLs (Access Control Lists) are ordered lists of permit/deny statements that filter traffic on a router interface. They are processed top-down — the first matching statement wins. An implicit deny any at the end blocks all traffic not explicitly permitted.
There are two types: standard ACLs (filter by source IP only) and extended ACLs (filter by source IP, destination IP, protocol, and port). Named ACLs are the modern approach — they allow editing individual entries and use descriptive names.
Named ACL Configuration
Named ACL advantage
Named ACLs allow you to delete or insert individual entries using sequence numbers. Numbered ACLs require deleting the entire ACL and re-entering it to make changes. Always use named ACLs in production.
Wildcard Masks
Wildcard masks are the inverse of subnet masks. A 0 bit means “must match”; a 1 bit means “ignore”. They are used in ACL source/destination matching and OSPF network statements.
Shortcuts
host 192.168.1.1 = 192.168.1.1 0.0.0.0. any = 0.0.0.0 255.255.255.255. Use these shortcuts for clarity.
ACL Placement Rules
Placement determines which traffic is filtered. The golden rules:
Standard ACLs: Place as close to the destination as possible (they only match source IP — placing near the source would block traffic to all destinations).
Extended ACLs: Place as close to the source as possible (they can match specific destination/port — filtering early saves bandwidth).
Inbound vs outbound: Inbound ACL is applied before the routing decision (more efficient — drops packets before routing). Outbound ACL is applied after routing, before sending out the interface.
Applying and Verifying ACLs
Knowledge Check — 10 Questions
Named ACLs, Placement, Wildcard Masks
What is the implicit rule at the end of every ACL?
- permit any
- deny any
- permit ip any any
- log any
Answer: deny any
Every ACL ends with an implicit deny any — traffic not matched by any explicit permit is dropped. This is why you must explicitly permit all desired traffic.
What is the wildcard mask for a /26 subnet (255.255.255.192)?
- 0.0.0.63
- 0.0.0.127
- 0.0.0.192
- 0.0.0.255
Answer: 0.0.0.63
Wildcard = inverse of subnet mask. 255 – 192 = 63. Wildcard for /26 = 0.0.0.63. This matches all 64 addresses in a /26 block.
Where should a standard ACL be placed?
- As close to the source as possible
- As close to the destination as possible
- On the backbone router
- On the DHCP server interface
Answer: As close to the destination as possible
Standard ACLs only match source IP. Placing near the source would block traffic to ALL destinations. Place near the destination to limit the scope of filtering.
Where should an extended ACL be placed?
- As close to the destination as possible
- As close to the source as possible
- On the default gateway only
- On inbound interfaces only
Answer: As close to the source as possible
Extended ACLs can match specific destination/port combinations. Placing near the source drops unwanted traffic early, saving bandwidth across the network.
What is the advantage of named ACLs over numbered ACLs?
- Named ACLs support more entries
- Named ACLs allow inserting or deleting individual entries using sequence numbers
- Named ACLs are processed faster
- Named ACLs support IPv6 only
Answer: Named ACLs allow inserting or deleting individual entries using sequence numbers
Named ACLs support sequence numbers, allowing you to insert entries between existing ones or delete specific entries. Numbered ACLs require deleting and re-entering the entire ACL.
What does host 10.1.1.1 mean in an ACL entry?
- All hosts in the 10.1.1.0/24 subnet
- Exactly the host 10.1.1.1 (wildcard 0.0.0.0)
- Any host in the 10.0.0.0/8 network
- The default gateway 10.1.1.1
Answer: Exactly the host 10.1.1.1 (wildcard 0.0.0.0)
host [IP] is shorthand for [IP] 0.0.0.0 — matches exactly one IP address. All 32 bits must match.
An inbound ACL is applied:
- After the routing decision, before sending out the interface
- Before the routing decision, on packets arriving on the interface
- Only on trunk interfaces
- Only on WAN interfaces
- Answer: Before the routing decision, on packets arriving on the interface
Inbound ACLs filter traffic as it arrives on an interface, before the router makes a routing decision. This is more efficient — dropped packets never consume routing resources.
What command shows ACL match counts (how many packets matched each entry)?
- show ip interface
- show access-lists
- show ip route
- show running-config
Answer: show access-lists
show access-lists displays all ACLs with a match count for each entry. Zero matches may indicate the ACL is not applied correctly or traffic is not reaching the interface.
The keyword _____ in an ACL entry matches all IP addresses (equivalent to 0.0.0.0 255.255.255.255).
Answer: any
any is shorthand for 0.0.0.0 255.255.255.255 — matches any IP address. Used in permit ip any any to allow all traffic, or deny ip any any to block all traffic.
ACL entries are processed in which order?
- Random order
- Top-down — first match wins
- Bottom-up — last match wins
- Most specific match first
Answer: Top-down — first match wins
ACLs are processed sequentially from the first entry to the last. The first matching entry determines the action (permit or deny). Subsequent entries are not checked.
Previous lesson: ACLs: standard and extended; Layer 2 security: DHCP snooping, dynamic ARP inspection, port security
Back to Cisco CCNA Preparation
Next lesson: Device hardening: disable unused services, secure passwords, AAA, login banners