An ACL is a list of rules applied to an interface to control traffic policy.
There are two main types of ACL:
Standard: Usually applied to the outbound interface because it only inspects the source address of the packet. Identified by numbers between 1 and 99. Named ACLs are also supported but use a different syntax.
Extended: Usually applied to the inbound interface because it inspects both source and destination IPs, preventing unnecessary traffic from traversing the network. It also filters by port to restrict or allow specific services. Can be identified by numbers (100–199) or names, making them easier to manage.
Standard ACL syntax:
access-list 10 access-list 10 allow 192.168.1.9 access-list 10 deny 10.0.0.0 0.0.0.255
Note: 10 is the ACL identifier, 0.0.0.255 is the wildcard mask for network 10.0.0.0. For a single host, no wildcard is needed.
Applying to an interface:
interface g0/0 ip access-group 10 out
Extended ACL syntax:
access-list 100 remark Allow HTTP+SSH access-list 100 permit tcp host 192.168.10.3 host 10.2.2.1 eq 22 access-list 100 permit tcp any any eq 80 ip access-list extended WEB-POLICY permit tcp 192.168.30.0 0.0.0.255 host 10.1.1.1 eq 80 permit tcp 192.168.30.0 0.0.0.255 209.165.200.224 0.0.0.31 eq 80
Note: 100 and WEB-POLICY are the ACL identifiers. Using the host keyword removes the need for a wildcard mask, and eq stands for “equal to,” followed by the port number the rule applies to.
Applying to an interface:
interface g0/0 ip access-group 100 out interface g0/1 ip access-group WEB-POLICY in
Editing a rule in an Extended ACL:
ip access-list extended 100 30 permit ip 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255
Remember: ACLs always have an implicit final rule that denies all traffic from any source to any destination. To permit everything else, add this at the end:
access-list 100 deny icmp any any echo access-list 100 deny icmp any any echo-reply access-list 100 permit ip any any
To allow already-established traffic (i.e., responses to outgoing requests), add “established” at the end of the rule:
access-list 100 permit tcp any any established
Note: established can only be used with tcp, not with udp or ip.
Useful commands to view ACLs:
show access-lists show access-list 100
Removing or modifying a rule:
ip access-list extended 100 do show access-list 100 no 30 20 xxxxx
Note: 100 is the ACL identifier, and 30 and 20 are the line numbers shown by the second command.
A common mistake when creating ACL rules is accidentally blocking return traffic. Double-check your rules to avoid this.
The following example shows how to allow traffic for already-established TCP connections:
access-list 100 permit tcp any any established access-list 100 deny tcp any any eq telnet
In the example above, ACL 100 is applied inbound on a WAN interface. It blocks incoming Telnet connections but allows incoming TCP traffic that belongs to an already-established session, which could itself be a Telnet connection initiated from the inside.